From b74e5ee93e074d0e6f7b76ad7df58139e8bb0707 Mon Sep 17 00:00:00 2001 From: Techmore Date: Tue, 27 Oct 2026 11:03:10 -0400 Subject: [PATCH] ci: apt retries everywhere, missing timeouts and read-only permissions - fast-apt: write Acquire::Retries "5" (plus 20 s HTTP timeouts) on every runner before the arm64-only mirror swap, so amd64 jobs retry too. - mseries-image-studio: use fast-apt before its apt calls. - build-release: timeout-minutes 180 (same as daily-9.0); proposed-9.0 comment job: timeout-minutes 5. - Top-level permissions: contents: read on message-pins, stable-9.0, validate-mseries, verification-codes and proposed-9.0; stable-9.0's reusable call keeps contents: write for build-release. Co-Authored-By: Claude Opus 5.5 --- .github/actions/fast-apt/action.yml | 13 +++++++------ .github/workflows/build-release.yml | 2 ++ .github/workflows/message-pins.yml | 3 +++ .github/workflows/mseries-image-studio.yml | 1 + .github/workflows/proposed-9.0.yml | 4 ++++ .github/workflows/stable-9.0.yml | 6 ++++++ .github/workflows/validate-mseries.yml | 3 +++ .github/workflows/verification-codes.yml | 3 +++ 8 files changed, 29 insertions(+), 6 deletions(-) diff --git a/.github/actions/fast-apt/action.yml b/.github/actions/fast-apt/action.yml index ada00e4f4..91eead4dc 100644 --- a/.github/actions/fast-apt/action.yml +++ b/.github/actions/fast-apt/action.yml @@ -1,17 +1,18 @@ name: Fast apt on arm64 runners description: >- - Point Ubuntu package sources at the official ports mirror and set apt retry/timeout - defaults. The default Azure mirror (azure.archive.ubuntu.com) took 15-34 minutes for - dependency installs on arm64 runners (runs 40418762416, 40418762747, 40482489505). - No-op on non-arm64 runners. Prints the resulting URIs so logs show it took effect. + Set apt retry/timeout defaults on every runner, and on arm64 point Ubuntu package + sources at the official ports mirror. The default Azure mirror (azure.archive.ubuntu.com) + took 15-34 minutes for dependency installs on arm64 runners (runs 40418762416, + 40418762747, 40482489505) and stalls mid-download on amd64 too, so retries apply to + both. Prints the resulting URIs so logs show it took effect. runs: using: composite steps: - shell: bash run: | + printf 'Acquire::Retries "5";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \ + | sudo tee /etc/apt/apt.conf.d/80-retries >/dev/null [ "$(dpkg --print-architecture)" = arm64 ] || exit 0 - printf 'Acquire::Retries "3";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \ - | sudo tee /etc/apt/apt.conf.d/99ci-fast >/dev/null f=/etc/apt/sources.list.d/ubuntu.sources if [ -f "$f" ]; then # Replace the whole line: the runner may use azure.archive.ubuntu.com or mirror+file:. diff --git a/.github/workflows/build-release.yml b/.github/workflows/build-release.yml index d7db7bae6..4f3d478ff 100644 --- a/.github/workflows/build-release.yml +++ b/.github/workflows/build-release.yml @@ -26,6 +26,8 @@ jobs: - runner: ubuntu-26.04-arm arch: arm64 runs-on: ${{ matrix.runner }} + # mkosi image build plus R2 upload; daily-9.0.yml gives the same build 180 minutes. + timeout-minutes: 180 permissions: contents: write outputs: diff --git a/.github/workflows/message-pins.yml b/.github/workflows/message-pins.yml index f12167bb6..32661f63e 100644 --- a/.github/workflows/message-pins.yml +++ b/.github/workflows/message-pins.yml @@ -11,6 +11,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + jobs: linux-import: name: Native pin import and private keyring (Linux) diff --git a/.github/workflows/mseries-image-studio.yml b/.github/workflows/mseries-image-studio.yml index 76a264a77..f7575ccf5 100644 --- a/.github/workflows/mseries-image-studio.yml +++ b/.github/workflows/mseries-image-studio.yml @@ -35,6 +35,7 @@ jobs: CARGO_TARGET_DIR: ${{ github.workspace }}/../mseries-image-studio-target steps: - uses: actions/checkout@v7 + - uses: ./.github/actions/fast-apt - name: Install build and test dependencies run: | diff --git a/.github/workflows/proposed-9.0.yml b/.github/workflows/proposed-9.0.yml index 6c5c712df..9c77607dd 100644 --- a/.github/workflows/proposed-9.0.yml +++ b/.github/workflows/proposed-9.0.yml @@ -16,6 +16,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + jobs: call-reusable-build: # Reusable-workflow permissions are validated before the repository gate. @@ -36,6 +39,7 @@ jobs: name: Comment Installer URLs needs: call-reusable-build runs-on: ubuntu-latest + timeout-minutes: 5 permissions: pull-requests: write diff --git a/.github/workflows/stable-9.0.yml b/.github/workflows/stable-9.0.yml index 0d687bdbe..b1785e80c 100644 --- a/.github/workflows/stable-9.0.yml +++ b/.github/workflows/stable-9.0.yml @@ -6,8 +6,14 @@ name: Build and Release Stable (elementary OS 9) on: workflow_dispatch: +permissions: + contents: read + jobs: call-reusable-build: + # build-release.yml asks for contents: write; a reusable call cannot exceed its caller. + permissions: + contents: write if: github.repository == 'elementary/os' uses: ./.github/workflows/build-release.yml with: diff --git a/.github/workflows/validate-mseries.yml b/.github/workflows/validate-mseries.yml index c12173a1f..5b30f73ba 100644 --- a/.github/workflows/validate-mseries.yml +++ b/.github/workflows/validate-mseries.yml @@ -15,6 +15,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + jobs: teams-web: name: Teams desktop launcher contracts diff --git a/.github/workflows/verification-codes.yml b/.github/workflows/verification-codes.yml index 6fdbcab8a..38d2513dc 100644 --- a/.github/workflows/verification-codes.yml +++ b/.github/workflows/verification-codes.yml @@ -11,6 +11,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} cancel-in-progress: ${{ github.event_name == 'pull_request' }} +permissions: + contents: read + jobs: codes: name: Private native field insertion and shortcut preservation (arm64)