From f6d689d1d0b3dc328ca2e7e42919fede43ce32be Mon Sep 17 00:00:00 2001
From: Techmore <sdolbec1@gmail.com>
Date: Tue, 27 Oct 2026 11:03:52 -0400
Subject: [PATCH] ci: apt retries on every runner, message-pins permissions,
 protocol-drift concurrency

- fast-apt: write Acquire::Retries "5" (plus 20 s HTTP timeouts) on every
  runner before the arm64-only mirror swap.
- mseries-battery-app, mseries-image-studio: use fast-apt before apt.
- message-pins: top-level permissions: contents: read.
- protocol-drift: concurrency grouped by workflow and ref, no cancel.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/actions/fast-apt/action.yml        | 13 +++++++------
 .github/workflows/message-pins.yml         |  3 +++
 .github/workflows/mseries-battery-app.yml  |  1 +
 .github/workflows/mseries-image-studio.yml |  1 +
 .github/workflows/protocol-drift.yml       |  5 +++++
 5 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/actions/fast-apt/action.yml b/.github/actions/fast-apt/action.yml
index ada00e4..91eead4 100644
--- a/.github/actions/fast-apt/action.yml
+++ b/.github/actions/fast-apt/action.yml
@@ -1,17 +1,18 @@
 name: Fast apt on arm64 runners
 description: >-
-  Point Ubuntu package sources at the official ports mirror and set apt retry/timeout
-  defaults. The default Azure mirror (azure.archive.ubuntu.com) took 15-34 minutes for
-  dependency installs on arm64 runners (runs 40418762416, 40418762747, 40482489505).
-  No-op on non-arm64 runners. Prints the resulting URIs so logs show it took effect.
+  Set apt retry/timeout defaults on every runner, and on arm64 point Ubuntu package
+  sources at the official ports mirror. The default Azure mirror (azure.archive.ubuntu.com)
+  took 15-34 minutes for dependency installs on arm64 runners (runs 40418762416,
+  40418762747, 40482489505) and stalls mid-download on amd64 too, so retries apply to
+  both. Prints the resulting URIs so logs show it took effect.
 runs:
   using: composite
   steps:
     - shell: bash
       run: |
+        printf 'Acquire::Retries "5";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \
+          | sudo tee /etc/apt/apt.conf.d/80-retries >/dev/null
         [ "$(dpkg --print-architecture)" = arm64 ] || exit 0
-        printf 'Acquire::Retries "3";\nAcquire::http::Timeout "20";\nAcquire::https::Timeout "20";\n' \
-          | sudo tee /etc/apt/apt.conf.d/99ci-fast >/dev/null
         f=/etc/apt/sources.list.d/ubuntu.sources
         if [ -f "$f" ]; then
           # Replace the whole line: the runner may use azure.archive.ubuntu.com or mirror+file:.
diff --git a/.github/workflows/message-pins.yml b/.github/workflows/message-pins.yml
index 88948c3..afbf59a 100644
--- a/.github/workflows/message-pins.yml
+++ b/.github/workflows/message-pins.yml
@@ -18,6 +18,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
+permissions:
+  contents: read
+
 jobs:
   linux-import:
     name: Native pin import and private keyring (Linux)
diff --git a/.github/workflows/mseries-battery-app.yml b/.github/workflows/mseries-battery-app.yml
index 0098f70..67d971e 100644
--- a/.github/workflows/mseries-battery-app.yml
+++ b/.github/workflows/mseries-battery-app.yml
@@ -29,6 +29,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/fast-apt
 
       - name: Install test dependencies
         run: |
diff --git a/.github/workflows/mseries-image-studio.yml b/.github/workflows/mseries-image-studio.yml
index 099535d..72d5694 100644
--- a/.github/workflows/mseries-image-studio.yml
+++ b/.github/workflows/mseries-image-studio.yml
@@ -35,6 +35,7 @@ jobs:
       CARGO_TARGET_DIR: ${{ github.workspace }}/../mseries-image-studio-target
     steps:
       - uses: actions/checkout@v7
+      - uses: ./.github/actions/fast-apt
 
       - name: Install build and test dependencies
         run: |
diff --git a/.github/workflows/protocol-drift.yml b/.github/workflows/protocol-drift.yml
index db5e959..2ef3cf7 100644
--- a/.github/workflows/protocol-drift.yml
+++ b/.github/workflows/protocol-drift.yml
@@ -12,6 +12,11 @@ on:
 permissions:
   contents: read
 
+# One run per ref at a time; a scheduled or manual run is never cancelled mid-check.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   compare:
     runs-on: ubuntu-latest