ci: harden Composer downloads against rate limits

Dockerfile

@@ -17,12 +17,29 @@ COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
 
 COPY composer.json composer.lock ./
 
-RUN composer install \
-    --no-dev \
-    --no-interaction \
-    --prefer-dist \
-    --optimize-autoloader \
-    --no-scripts
+RUN --mount=type=cache,target=/tmp/composer-cache \
+    --mount=type=secret,id=composer_github_token,required=false \
+    set -eu; \
+    if [ -s /run/secrets/composer_github_token ]; then \
+        export COMPOSER_AUTH="{\"github-oauth\":{\"github.com\":\"$(cat /run/secrets/composer_github_token)\"}}"; \
+    fi; \
+    export COMPOSER_CACHE_DIR=/tmp/composer-cache; \
+    export COMPOSER_MAX_PARALLEL_HTTP=4; \
+    attempt=1; \
+    until composer install \
+        --no-dev \
+        --no-interaction \
+        --prefer-dist \
+        --optimize-autoloader \
+        --no-scripts; do \
+        if [ "$attempt" -ge 4 ]; then \
+            exit 1; \
+        fi; \
+        delay=$((attempt * 15)); \
+        echo "Composer install failed (attempt $attempt/4), retrying in ${delay}s..."; \
+        sleep "$delay"; \
+        attempt=$((attempt + 1)); \
+    done
 
 
 COPY . .