Skip to content

ci: bound apt-get so a dead mirror cannot wedge a job - #3924

Open
hubcio wants to merge 2 commits into
masterfrom
ci/harden-apt-update
Open

ci: bound apt-get so a dead mirror cannot wedge a job#3924
hubcio wants to merge 2 commits into
masterfrom
ci/harden-apt-update

Conversation

@hubcio

@hubcio hubcio commented Aug 19, 2026

Copy link
Copy Markdown
Contributor

Runners intermittently lose egress to azure.archive.ubuntu.com.
apt falls back through the mirror list, then stalls with no
output at all, so the job sits dead until it burns the full 60
minute budget. Three consecutive doctest runs on PR #3921 died
this way, each on a different runner, while sibling jobs on the
same run finished apt in nine seconds.

apt's own Acquire::*::Timeout does not bound this - the observed
stalls ran half an hour past the 120s default - so
scripts/ci/apt-install.sh caps both the index refresh and the
install with timeout(1). A wedged runner now fails loudly in
minutes instead of dying quietly at the job limit. Installation
still runs after a failed update, so a merely stale index set is
not fatal. Every call site routes through it rather than
repeating the loop inline.

Runners intermittently lose egress to azure.archive.ubuntu.com.
apt falls back through the mirror list, then stalls with no
output at all, so the job sits dead until it burns the full 60
minute budget. Three consecutive doctest runs on PR #3921 died
this way, each on a different runner, while sibling jobs on the
same run finished apt in nine seconds.

apt's own Acquire::*::Timeout does not bound this - the observed
stalls ran half an hour past the 120s default - so
scripts/ci/apt-install.sh caps both the index refresh and the
install with timeout(1). A wedged runner now fails loudly in
minutes instead of dying quietly at the job limit. Installation
still runs after a failed update, so a merely stale index set is
not fatal. Every call site routes through it rather than
repeating the loop inline.
@github-actions github-actions Bot added the S-waiting-on-review PR is waiting on a reviewer label Aug 19, 2026
@codecov

codecov Bot commented Aug 19, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.69%. Comparing base (3cd0860) to head (f31a043).

Additional details and impacted files
@@             Coverage Diff              @@
##             master    #3924      +/-   ##
============================================
- Coverage     83.82%   83.69%   -0.13%     
  Complexity     1358     1358              
============================================
  Files          1212     1212              
  Lines        166148   166191      +43     
  Branches     133622   133790     +168     
============================================
- Hits         139272   139095     -177     
- Misses        23253    23318      +65     
- Partials       3623     3778     +155     
Components Coverage Δ
Rust Core 84.52% <ø> (-0.11%) ⬇️
Java SDK 66.67% <ø> (ø)
C# SDK 74.99% <ø> (-1.10%) ⬇️
Python SDK 90.00% <ø> (ø)
PHP SDK 84.48% <ø> (ø)
Node SDK 95.94% <ø> (+0.09%) ⬆️
Go SDK 68.32% <ø> (ø)
see 79 files with indirect coverage changes
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

S-waiting-on-review PR is waiting on a reviewer

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants