CI: retry dependency downloads and stabilize the quoted deadlock fixture

[BrentOzar]

Fixes #4124. Fixes #4126.

The SQL Server smoke tests can fail before execution on transient dependency-download errors, or during the quoted-output regression once its fixed deadlock XML ages out of sp_BlitzLock's default seven-day window.

Enable curl's built-in transient-error retries, including connection refusals, with up to five retries after the initial attempt. Curl honors Retry-After and otherwise uses exponential backoff. Set a 180-second retry budget, a 10-second connection timeout, and a 30-second timeout per transfer; the final transfer can extend past the retry budget. The dependency revision, URLs, and SHA-256 checks before installation remain unchanged, with no token required.

For the quoted sp_BlitzLock output test, supply the same explicit September 11–14, 2026 date range on both create/append calls. It contains the XML fixture's September 12 timestamp with timezone margin. The table-identity, nonempty-output, two-participant, and append assertions remain intact.

The failure reported in #4126 occurred on both SQL Server 2017 and 2025. The logs end in sp_BlitzLock's Results to table/Findings to table messages followed by the empty-output assertion. The September 12 event was already older than seven days at the September 19 run. This fix addresses that expired test input; it does not require changes to production identifier handling.

Validation:

• Shell syntax and git diff --check passed.
• Executed the actual dependency-install block against a temporary local HTTP server using real curl and GNU SHA-256 verification. Normal downloads, recovery from 429 with Retry-After, and recovery from repeated 503 responses passed. Persistent 429 stopped after six attempts; 404 failed immediately; corrupted HTTP 200 content failed checksum verification before installation.
• Verified both explicit date ranges against the fixture's XML timestamp for UTC offsets from -14 to +14 hours.
• The initial CI run downloaded and verified dependencies successfully on both SQL Server versions; each passed 52 of 53 matrix steps, failing only on the expired quoted-output fixture. After the fixture fix, SQL Server 2017 and 2025 both passed all 53 matrix steps and the uninstall regression. The Azure SQL Database smoke test also passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-19T11:38:38.121480Z	cd93a27	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified, and integrity checks remain unchanged.

Review effort: Lite
Findings: None

What changed in this PR

Improves resilience of SQL Server smoke-test dependency downloads against transient HTTP and network failures.

Changes:

• Adds bounded curl retries with backoff and Retry-After support.
• Configures connection, transfer, and retry timeouts.
• Preserves pinned URLs, revisions, and checksum verification.

File	Description
.github/​scripts/​run-sql-server-smoke-tests.sh	Adds resilient curl options for pinned dependency downloads.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approval recommended

The changes correctly address both reported CI failure modes while preserving checksum and regression assertions.

Review effort: Balanced
Findings: None