ci: retry transient QuickStack rollouts

.gitea/actions/quickstack-oci/deploy.test.mjs

@@ -59,6 +59,10 @@ test("resolves push and pull request deployment branches without accepting empty
 test("validates OCI paths and repository-local build paths", () => {
   assert.equal(validateTarget({ name: "Web", image: "Owner/Web", appId: "app-1" }).image, "owner/web");
   assert.throws(() => validateTarget({ name: "Web", image: "owner/web", appId: "app-1", context: "../secret" }), /inside/);
+  assert.throws(
+    () => validateTarget({ name: "Web", image: "owner/web", appId: "app-1", deploymentAttempts: 0 }),
+    /positive integer/,
+  );
 });
 
 test("preserves response-only fields and existing environment secrets safely", () => {
@@ -111,3 +115,35 @@ test("failed public verification restores and redeploys the previous source", as
   assert.equal(current.sourceType, original.sourceType);
   assert.equal(current.containerImageSource, original.containerImageSource);
 });
+
+test("transient QuickStack deployment failures retry the desired immutable image", async () => {
+  let current = app();
+  let deployments = 0;
+  const image = `gitea.example/owner/app@sha256:${"b".repeat(64)}`;
+  const client = {
+    getApp: async () => current,
+    saveApp: async (payload) => { current = { ...current, ...payload }; },
+    deployApp: async () => ({ deploymentId: `deployment-${++deployments}` }),
+    getDeployment: async (_appId, deploymentId) => ({
+      deploymentId,
+      status: deploymentId === "deployment-1" ? "ERROR" : "DEPLOYED",
+    }),
+  };
+
+  const result = await deployExactImage({
+    client,
+    appId: "app-one",
+    image,
+    registryUsername: "deploy",
+    registryToken: "token",
+    sha: "2".repeat(40),
+    deploymentAttempts: 2,
+    deploymentRetrySeconds: 0,
+    sleep: async () => {},
+  });
+
+  assert.equal(deployments, 2);
+  assert.equal(result.image, image);
+  assert.equal(current.sourceType, "CONTAINER");
+  assert.equal(current.containerImageSource, image);
+});