fix: Prevent panic on non-retryable download errors (#619)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
#### Summary

Fixes a panic in `downloadFile` caused by an unsafe type assertion (`err.(retry.Error)`) when the retry library returns a plain error.

Changes included:
- Replace string-based retry classification with sentinel errors + `errors.Is`
- Remove the unsafe type assertion path and return clean errors for both retry and non-retry failures
- Add regression tests that verify `downloadFile` does not panic on:
  - invalid/non-retryable request errors
  - 404 responses
  
In `github.com/avast/retry-go/v5`, it can return a non-retry.Error in these cases:

1. `LastErrorOnly(true)` is set. It returns the last underlying error directly. 

2. Context is already done before retries start. Do() returns `context.Cause(ctx)` directly (often `context.Canceled` / `context.DeadlineExceeded`, which can be `*errors.errorString`).

3. Attempts(0) / UntilSucceeded() mode. If the function returns an unrecoverable error (`retry.Unrecoverable(...)`) or `RetryIf` says “don’t retry”, it returns that raw error directly.
If context is canceled in this mode (and `WrapContextErrorWithLastError(false)`), it also returns raw context error.


---

Author: erezrokah

managedplugin/download.go

@@ -340,10 +340,13 @@ func downloadFile(ctx context.Context, localPath string, downloadURL string, dop
 	}
 	defer out.Close()
 
+	errStatusCodeNotOK := errors.New("statusCode != 200")
+	errNotFound := errors.New("not found")
+
 	checksum := ""
 	options := []retry.Option{
 		retry.RetryIf(func(err error) bool {
-			return err.Error() == "statusCode != 200"
+			return errors.Is(err, errStatusCodeNotOK)
 		}),
 		retry.Context(ctx),
 		retry.Attempts(RetryAttempts),
@@ -366,10 +369,10 @@ func downloadFile(ctx context.Context, localPath string, downloadURL string, dop
 		defer resp.Body.Close()
 		// Check server response
 		if resp.StatusCode == http.StatusNotFound {
-			return errors.New("not found")
+			return errNotFound
 		} else if resp.StatusCode != http.StatusOK {
 			fmt.Printf("Failed downloading %s with status code %d. Retrying\n", downloadURL, resp.StatusCode)
-			return errors.New("statusCode != 200")
+			return errStatusCodeNotOK
 		}
 
 		urlForLog := downloadURL
@@ -398,10 +401,8 @@ func downloadFile(ctx context.Context, localPath string, downloadURL string, dop
 		return nil
 	})
 	if err != nil {
-		for _, e := range err.(retry.Error) {
-			if e.Error() == "not found" {
-				return "", e
-			}
+		if errors.Is(err, errNotFound) {
+			return "", errNotFound
 		}
 		return "", fmt.Errorf("failed downloading URL %q. Error %w", downloadURL, err)
 	}

managedplugin/download_test.go

@@ -2,14 +2,62 @@ package managedplugin
 
 import (
 	"context"
+	"net/http"
+	"net/http/httptest"
 	"path"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	cloudquery_api "github.com/cloudquery/cloudquery-api-go"
 	"github.com/rs/zerolog"
 )
 
+func TestDownloadFileNonRetryErrorDoesNotPanic(t *testing.T) {
+	t.Helper()
+
+	localPath := filepath.Join(t.TempDir(), "plugin.zip")
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("downloadFile panicked: %v", r)
+		}
+	}()
+
+	_, err := downloadFile(context.Background(), localPath, "://invalid-url", DownloaderOptions{NoProgress: true})
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if !strings.Contains(err.Error(), "failed downloading URL") {
+		t.Fatalf("expected wrapped download error, got: %v", err)
+	}
+}
+
+func TestDownloadFileNotFoundDoesNotPanic(t *testing.T) {
+	t.Helper()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	t.Cleanup(server.Close)
+
+	localPath := filepath.Join(t.TempDir(), "plugin.zip")
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("downloadFile panicked: %v", r)
+		}
+	}()
+
+	_, err := downloadFile(context.Background(), localPath, server.URL, DownloaderOptions{NoProgress: true})
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if err.Error() != "not found" {
+		t.Fatalf("expected not found error, got: %v", err)
+	}
+}
+
 func TestDownloadPluginFromGithubIntegration(t *testing.T) {
 	tmp := t.TempDir()
 	cases := []struct {