feat(sync): [DC-216839]: use HTTP/2 with automatic HTTP/1.1 fallback on framing errors

[rchincha]

What type of PR is this?

Which issue does this PR fix:

What does this PR do / Why do we need it:

If an issue # is not available please add repro steps and logs showing the issue:

Testing done on this change:

Automation added to e2e:

Will this break upgrades or downgrades?

Does this PR introduce any user-facing change?:

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[Copilot]

Pull request overview

Adds a sync-specific HTTP transport that prefers HTTP/2 but automatically retries over HTTP/1.1 when upstreams emit HTTP/2 framing/protocol errors (e.g., the “malformed HTTP response” class of failures), and documents/validates the behavior via tests.

Changes:

• Introduces http2FallbackTransport and wires it into sync’s regclient HTTP client.
• Adds unit coverage for framing-error classification + retry/sticky-host behavior, plus a new blackbox smoke test and CI inclusion.
• Updates documentation and module dependencies to support the new HTTP/2 transport logic.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/ports.json	Allocates port ranges for the new blackbox test.
test/blackbox/sync_http2_fallback.bats	New smoke test for sync behavior with the new transport (happy-path).
test/blackbox/ci.sh	Adds the new blackbox test to CI execution list.
pkg/extensions/sync/sync_test.go	Makes TLS sync test more robust by retrying until the manifest is available.
pkg/extensions/sync/service.go	Switches sync regclient HTTP client transport to the new HTTP/2-with-fallback transport.
pkg/extensions/sync/http2_fallback.go	Implements HTTP/2-first RoundTripper with sticky HTTP/1.1 fallback on framing errors.
pkg/extensions/sync/http2_fallback_internal_test.go	Adds focused unit tests for fallback, stickiness, and real-transport boundary behavior.
go.mod	Promotes golang.org/x/net to a direct dependency (for http2).
examples/README.md	Documents the new HTTP/2 transport and automatic fallback behavior for operators.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

❌ Patch coverage is 81.00559% with 34 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.44%. Comparing base (273b153) to head (ca5e796).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
pkg/extensions/sync/http2_fallback.go	83.12%	16 Missing and 11 partials ⚠️
pkg/extensions/sync/utils.go	61.11%	2 Missing and 5 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4114      +/-   ##
==========================================
- Coverage   91.55%   91.44%   -0.11%     
==========================================
  Files         200      201       +1     
  Lines       29306    29479     +173     
==========================================
+ Hits        26830    26958     +128     
- Misses       1594     1625      +31     
- Partials      882      896      +14     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

[andaaron]

sync_http2_fallback.bats is largely redundant with existing CI tests for sync. It doesn’t test fallback, and the smoke path it does run is already exercised by sync.bats (and friends).

Can we drop this?

[andaaron]

This matches all StreamError / GoAwayError codes, not just protocol/framing mismatches (e.g. REFUSED_STREAM, ENHANCE_YOUR_CALM). For Docker Hub that’s probably fine, but it could mask genuine HTTP/2 issues on other registries by silently downgrading to HTTP/1.1.

I suggest this is refactored in 3 separate functions

func shouldRetryOnHTTP11Fallback(err error) bool {
    return isHTTP2SessionError(err) || isHTTP1HTTP2Mismatch(err)
}

func isHTTP2SessionError(err error) bool { /* StreamError, GoAwayError */ }

func isHTTP1HTTP2Mismatch(err error) bool {
    return strings.Contains(err.Error(), "malformed HTTP response")
}

[andaaron]

@mrudnoru Please review this. I see you left some comments on #4075