fix: retry only Linear queries

Author: msukkari

.github/scripts/linear-graphql-request.sh

@@ -7,9 +7,19 @@ if [[ -z "${LINEAR_API_KEY:-}" ]]; then
 fi
 
 payload=$(cat)
-attempts="${LINEAR_GRAPHQL_ATTEMPTS:-4}"
+configured_attempts="${LINEAR_GRAPHQL_ATTEMPTS:-4}"
 retry_delay="${LINEAR_GRAPHQL_RETRY_DELAY_SECONDS:-2}"
 endpoint="${LINEAR_GRAPHQL_ENDPOINT:-https://api.linear.app/graphql}"
+is_mutation=$(jq -r '(.query // "") | test("^\\s*mutation(?:\\s|\\(|\\{)")' <<<"$payload")
+
+# Retrying a mutation after an ambiguous transport failure can replay a write
+# that Linear already committed. Queries are safe to retry; mutations fail
+# visibly after one attempt and rely on the workflow's reconciliation pass.
+if [[ "$is_mutation" == "true" ]]; then
+  attempts=1
+else
+  attempts="$configured_attempts"
+fi
 
 for ((attempt = 1; attempt <= attempts; attempt++)); do
   response_file=$(mktemp)

.github/scripts/test-vulnerability-triage.sh

@@ -87,6 +87,21 @@ if [[ "$(<"$FAKE_CURL_COUNT")" != "3" ]]; then
   exit 1
 fi
 
+printf '0\n' > "$FAKE_CURL_COUNT"
+if PATH="$FAKE_CURL_DIR:$PATH" \
+  FAKE_CURL_COUNT="$FAKE_CURL_COUNT" \
+  LINEAR_API_KEY="test-key" \
+  LINEAR_GRAPHQL_ATTEMPTS=3 \
+  LINEAR_GRAPHQL_RETRY_DELAY_SECONDS=0 \
+  "$LINEAR_REQUEST" <<<'{"query":"mutation { issueCreate(input: {}) { success } }"}' >/dev/null 2>&1; then
+  echo "FAIL: ambiguous Linear mutations must not be retried"
+  exit 1
+fi
+if [[ "$(<"$FAKE_CURL_COUNT")" != "1" ]]; then
+  echo "FAIL: expected exactly one Linear mutation attempt"
+  exit 1
+fi
+
 match() {
   local finding_id="$1"
   jq -c --arg prefix "$PREFIX" --arg findingId "$finding_id" -f "$MATCH_FILTER"

CHANGELOG.md

@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Vulnerability triage now keeps Linear issues synchronized with current security findings.
 
 ### Fixed
-- Fixed vulnerability triage for reusable-workflow callers, repositories without CodeQL, and transient non-JSON Linear API responses. [#1515](https://github.com/sourcebot-dev/sourcebot/pull/1515)
+- Fixed vulnerability triage for reusable-workflow callers, repositories without CodeQL, and transient non-JSON Linear query responses. [#1515](https://github.com/sourcebot-dev/sourcebot/pull/1515)
 
 ## [5.1.4] - 2026-07-24