build: add cosign 409 diagnostic message

[ideaship]

Summary

When cosign sign fails with HTTP 409 createLogEntryConflict, the raw Rekor error gives no indication of the cause or when it will self-resolve. This adds a diagnostic NOTE after the error that points to the upstream bug and explains that the next build will succeed.

• Build still fails with the original non-zero exit code — no behaviour change for any other error
• Upstream bug: cosign sign fails permanently with createLogEntryConflict if initial OCI push fails sigstore/cosign#4711 (cosign v3.0.6, unfixed)
• Root cause: Rekor accepts the signing bundle, the OCI .sig push then fails transiently, and any retry of the full cosign sign command hits a duplicate Rekor entry permanently

Test plan

• Verify CI passes on this branch
• Confirm the wrapper does not affect the success path (no createLogEntryConflict → no change in output or exit code)
• When the upstream bug is fixed in cosign, the wrapper can be removed

🤖 Generated with Claude Code

[sourcery-ai]

Hey - I've left some high level feedback:

• This shell snippet now depends on Bash-specific features like PIPESTATUS and [[ ]]; if the Ansible task runs with /bin/sh or a non-Bash shell, consider explicitly setting executable: /bin/bash or rewriting to POSIX shell to avoid runtime errors.
• The use of a hardcoded cosign-output.txt file may leave artifacts and could clash in reused workspaces; consider using a temporary file (e.g., via mktemp) and cleaning it up after use or capturing the output in a variable instead.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- This shell snippet now depends on Bash-specific features like PIPESTATUS and `[[ ]]`; if the Ansible task runs with `/bin/sh` or a non-Bash shell, consider explicitly setting `executable: /bin/bash` or rewriting to POSIX shell to avoid runtime errors.
- The use of a hardcoded `cosign-output.txt` file may leave artifacts and could clash in reused workspaces; consider using a temporary file (e.g., via `mktemp`) and cleaning it up after use or capturing the output in a variable instead.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}