ci: apt retries, missing timeouts, read-only permissions

.github/actions/fast-apt/action.yml

@@ -1,17 +1,18 @@
 name: Fast apt on arm64 runners
 description: >-
-  Point Ubuntu package sources at the official ports mirror and set apt retry/timeout
-  defaults. The default Azure mirror (azure.archive.ubuntu.com) took 15-34 minutes for
-  dependency installs on arm64 runners (runs 40418762416, 40418762747, 40482489505).
-  No-op on non-arm64 runners. Prints the resulting URIs so logs show it took effect.
+  Set apt retry/timeout defaults on every runner, and on arm64 point Ubuntu package
+  sources at the official ports mirror. The default Azure mirror (azure.archive.ubuntu.com)
+  took 15-34 minutes for dependency installs on arm64 runners (runs 40418762416,
+  40418762747, 40482489505) and stalls mid-download on amd64 too, so retries apply to
+  both. Prints the resulting URIs so logs show it took effect.
 runs:
   using: composite
   steps:
     - shell: bash
       run: |
+        printf 'Acquire::Retries "5";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \
+          | sudo tee /etc/apt/apt.conf.d/80-retries >/dev/null
         [ "$(dpkg --print-architecture)" = arm64 ] || exit 0
-        printf 'Acquire::Retries "3";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \
-          | sudo tee /etc/apt/apt.conf.d/99ci-fast >/dev/null
         f=/etc/apt/sources.list.d/ubuntu.sources
         if [ -f "$f" ]; then
           # Replace the whole line: the runner may use azure.archive.ubuntu.com or mirror+file:.

.github/workflows/build-release.yml

@@ -26,6 +26,8 @@ jobs:
             - runner: ubuntu-26.04-arm
               arch: arm64
     runs-on: ${{ matrix.runner }}
+    # mkosi image build plus R2 upload; daily-9.0.yml gives the same build 180 minutes.
+    timeout-minutes: 180
     permissions:
       contents: write
     outputs:

.github/workflows/message-pins.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   linux-import:
     name: Native pin import and private keyring (Linux)

.github/workflows/mseries-image-studio.yml

@@ -35,6 +35,7 @@ jobs:
       CARGO_TARGET_DIR: ${{ github.workspace }}/../mseries-image-studio-target
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/fast-apt
 
       - name: Install build and test dependencies
         run: |

.github/workflows/proposed-9.0.yml

@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable-build:
     # Reusable-workflow permissions are validated before the repository gate.
@@ -36,6 +39,7 @@ jobs:
     name: Comment Installer URLs
     needs: call-reusable-build
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     permissions:
       pull-requests: write
 

.github/workflows/stable-9.0.yml

@@ -6,8 +6,14 @@ name: Build and Release Stable (elementary OS 9)
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   call-reusable-build:
+    # build-release.yml asks for contents: write; a reusable call cannot exceed its caller.
+    permissions:
+      contents: write
     if: github.repository == 'elementary/os'
     uses: ./.github/workflows/build-release.yml
     with:

.github/workflows/validate-mseries.yml

@@ -15,6 +15,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   teams-web:
     name: Teams desktop launcher contracts

.github/workflows/verification-codes.yml

@@ -11,6 +11,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   codes:
     name: Private native field insertion and shortcut preservation (arm64)