ci: harden OpenAPI fetch + push against transient failures

- Add curl retry (5 attempts, 2s delay, 60s timeout) so a transient SSL
  error on zernio.com/openapi.yaml no longer fails the run.
- Wrap `git push` in a pull-rebase-retry loop (3 attempts) so concurrent
  dispatches that land back-to-back don't race for the same ref.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mikipalet

.github/workflows/generate.yml

@@ -36,7 +36,7 @@ jobs:
 
       - name: Fetch latest OpenAPI spec
         run: |
-          curl -f -o openapi.yaml https://zernio.com/openapi.yaml
+          curl -f --retry 5 --retry-delay 2 --retry-all-errors --max-time 60 -o openapi.yaml https://zernio.com/openapi.yaml
           echo "Fetched OpenAPI spec"
 
       - name: Generate SDK
@@ -153,7 +153,14 @@ jobs:
 
           - Auto-generated SDK updates
           - Version: ${{ steps.version.outputs.new_version }}"
-          git push
+          # Retry with rebase to survive concurrent dispatches that land
+          # back-to-back pushes to main.
+          for attempt in 1 2 3; do
+            if git push; then break; fi
+            echo "Push attempt $attempt failed; rebasing and retrying..."
+            git pull --rebase origin main
+            sleep $((attempt * 5))
+          done
 
       - name: Create GitHub Release
         if: steps.changes.outputs.has_changes == 'true'