fix: retry AppImage downloads and trust Homebrew taps

debian/setup.yaml

@@ -511,6 +511,10 @@
         dest: "{{ appimage_install_dir }}/{{ item.0.name }}.AppImage"
         mode: '0755'
         checksum: "{{ item.0.checksum | default(omit) }}"
+      register: appimage_download
+      retries: 3
+      delay: 5
+      until: appimage_download is succeeded
       loop: "{{ appimage_packages | default([], true) | zip(appimage_stat.results | default([], true)) | list }}"
       when:
         - item.1.stat is defined

fedora/setup.yaml

@@ -489,6 +489,10 @@
         dest: "{{ appimage_install_dir }}/{{ item.0.name }}.AppImage"
         mode: '0755'
         checksum: "{{ item.0.checksum | default(omit) }}"
+      register: appimage_download
+      retries: 3
+      delay: 5
+      until: appimage_download is succeeded
       loop: "{{ appimage_packages | default([], true) | zip(appimage_stat.results | default([], true)) | list }}"
       when:
         - item.1.stat is defined

macOS/setup.yaml

@@ -65,6 +65,35 @@
         - homebrew
         - taps
 
+    # Newer Homebrew (6.x) requires third-party taps to be explicitly
+    # trusted or it ignores their formulae/casks. Older brew has no
+    # `brew trust` subcommand and exits nonzero on the check below, so the
+    # trust task is guarded on the check succeeding and skipped there.
+    - name: Check which Homebrew taps are trusted
+      ansible.builtin.command:
+        cmd: brew trust --json v1
+      register: brew_trust_list
+      changed_when: false
+      failed_when: false
+      when: (homebrew_taps | default([], true)) | length > 0
+      tags:
+        - homebrew
+        - taps
+
+    - name: Ensure Homebrew taps are trusted
+      ansible.builtin.command:
+        cmd: brew trust --tap {{ item }}
+      changed_when: true
+      when:
+        - brew_trust_list.rc | default(1) == 0
+        - item not in ((brew_trust_list.stdout | from_json).taps | default([], true))
+      loop: "{{ homebrew_taps | default([], true) }}"
+      loop_control:
+        label: "Trusting tap: {{ item }}"
+      tags:
+        - homebrew
+        - taps
+
     - name: Check if Homebrew casks are already installed
       ansible.builtin.command:
         cmd: "brew list --cask {{ item }}"

tests/macOS/verify.sh

@@ -13,6 +13,11 @@ check "git-lfs installed (Homebrew formula)" command -v git-lfs
 # Homebrew tap
 check "hashicorp/tap tapped (Homebrew tap)" sh -c 'brew tap | grep -q "^hashicorp/tap$"'
 
+# Homebrew tap trust (older brew has no `brew trust`; skip there)
+if brew trust --json v1 >/dev/null 2>&1; then
+  check "hashicorp/tap trusted (Homebrew tap trust)" sh -c 'brew trust --json v1 | grep -q "\"hashicorp/tap\""'
+fi
+
 # Homebrew cask
 check "iTerm2 installed (Homebrew cask)" test -d /Applications/iTerm.app
 check "VS Code installed (Homebrew cask)" test -d "/Applications/Visual Studio Code.app"

ubuntu/setup.yaml

@@ -515,6 +515,10 @@
         dest: "{{ appimage_install_dir }}/{{ item.0.name }}.AppImage"
         mode: '0755'
         checksum: "{{ item.0.checksum | default(omit) }}"
+      register: appimage_download
+      retries: 3
+      delay: 5
+      until: appimage_download is succeeded
       loop: "{{ appimage_packages | default([], true) | zip(appimage_stat.results | default([], true)) | list }}"
       when:
         - item.1.stat is defined