fix(build): improve asset download resilience against rate limits

- Increase GitHub release cache TTL from 1h to 4h to reduce API calls
- Use exponential backoff (factor 2) instead of linear retries
- Add SKIP_ASSET_DOWNLOAD env var to skip downloads when assets are
  already cached locally (avoids rate limit exhaustion during repeated
  local builds and pre-commit hook reruns)
- Simplify cli package.json placeholder version to 0.0.0

Author: jdalton

packages/build-infra/lib/github-releases.mjs

@@ -12,11 +12,11 @@ import { pRetry } from '@socketsecurity/lib/promises'
 
 const logger = getDefaultLogger()
 
-// Cache GitHub API responses for 1 hour to avoid rate limiting.
+// Cache GitHub API responses for 4 hours to reduce API calls and avoid rate limiting.
 const cache = createTtlCache({
   memoize: true,
   prefix: 'github-releases',
-  ttl: 60 * 60 * 1000, // 1 hour.
+  ttl: 4 * 60 * 60 * 1000, // 4 hours.
 })
 
 /**
@@ -155,8 +155,8 @@ export async function getLatestRelease(
         return null
       },
       {
-        backoffFactor: 1,
-        baseDelayMs: 5_000,
+        backoffFactor: 2,
+        baseDelayMs: 3_000,
         onRetry: (attempt, error) => {
           if (!quiet) {
             logger.info(
@@ -231,8 +231,8 @@ export async function getReleaseAssetUrl(
         return asset.browser_download_url
       },
       {
-        backoffFactor: 1,
-        baseDelayMs: 5_000,
+        backoffFactor: 2,
+        baseDelayMs: 3_000,
         onRetry: (attempt, error) => {
           if (!quiet) {
             logger.info(`  Retry attempt ${attempt + 1}/3 for asset URL...`)

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/cli",
-  "version": "0.0.0-copied-from-packages-socket",
+  "version": "0.0.0",
   "description": "CLI for Socket.dev",
   "private": true,
   "license": "MIT",

packages/cli/scripts/download-assets.mjs

@@ -231,6 +231,14 @@ async function downloadAssets(assetNames, parallel = true) {
  * Main entry point.
  */
 async function main() {
+  // Skip downloads entirely when SKIP_ASSET_DOWNLOAD is set.
+  // Useful for repeated local builds where assets are already cached,
+  // or when GitHub API rate limits are exhausted.
+  if (process.env.SKIP_ASSET_DOWNLOAD) {
+    logger.info('Skipping asset downloads (SKIP_ASSET_DOWNLOAD is set)')
+    return
+  }
+
   const args = process.argv.slice(2)
   const parallel = !args.includes('--no-parallel')
   const assetArgs = args.filter(arg => !arg.startsWith('--'))