fix: Retry the test harness download and surface curl errors

[kinyoklion]

Requirements

• I have added test coverage for new or changed functionality
• I have followed the repository's pull request submission guidelines
• I have validated my changes against all supported platform versions

Related issues

Intermittent Download failed failures in SDK contract-test jobs, e.g. launchdarkly/python-server-sdk#484 where 4 of 5 matrix jobs died at the same second while the rest passed on identical code.

Describe the solution you've provided

downloader/run.sh resolves the release version through the GitHub API (authenticated when GITHUB_TOKEN is set), but then downloads the release asset with a single un-retried curl --fail -s, and -s hides the reason for a failure:

-curl --fail -s -L -o "${TEMP_DIR}/archive.${EXTENSION}" "${DOWNLOAD_URL}" || (echo "Download failed" >&2; exit 1)
+curl --fail -sS -L --retry 5 --retry-delay 2 \
+  -o "${TEMP_DIR}/archive.${EXTENSION}" "${DOWNLOAD_URL}" \
+  || { echo "Download failed" >&2; exit 1; }

--retry covers transient 5xx/408/429 responses (consistent with several matrix jobs failing at once while others succeed), and -sS means the next failure reports the actual curl error instead of a bare Download failed.

Describe alternatives you've considered

• --retry-all-errors: rejected, it requires curl 7.71+ and this script also runs on older macOS runners.
• Sending the token on the asset download: the asset URL redirects to an unauthenticated object store, so an Authorization header there is at best useless and can break the redirect.

Additional context

The contract-tests GitHub action reads this script from the v2 branch by default, so this also covers repos running the v3 harness through that action. main has the same line and should get the same change.

Link to Devin session: https://app.devin.ai/sessions/bfe54128e2804a96bb100e6120e9a3ef
Requested by: @kinyoklion

---

Note

Overview
Contract-test jobs intermittently failed with a bare Download failed when fetching the sdk-test-harness release asset from GitHub.

The download curl in downloader/run.sh now uses --retry 5 --retry-delay 2 for transient HTTP failures (aligned with matrix jobs failing together while others pass) and -sS instead of -s so failures include the actual curl error message.

^{Reviewed by Cursor Bugbot for commit 2c23020. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

@cursor review

[devin-ai-integration]

More evidence for this: I pushed six SDK PRs within a few seconds to validate v2.39.0 / v3.2.0-alpha.6 end-to-end, and nearly every contract-test job failed on Download failed between 21:55 and 21:58 UTC — python-server-sdk#484, go-server-sdk#430, js-core#1849, php-server-sdk#265, cpp-sdks#594 — for both the v2.39.0 and v3.0.0-alpha.6 assets. Re-downloading the same URLs from another host right after returns HTTP 200, so the asset endpoint is throttling concurrent downloads and one un-retried curl is enough to kill the job.

The jobs that did get the binary confirm the new test works end-to-end, e.g. go with sdk-test-harness v2.39.0:

[hooks/evaluation/provides the environment ID]
[hooks/evaluation/provides the environment ID/default data source]
[hooks/evaluation/provides the environment ID/polling]
All tests passed

v3 counterpart of this change: #413.