CI: install apt packages from ghcr .deb bundles - #1293
Open
ejohnstown wants to merge 4 commits into
Open
ejohnstown wants to merge 4 commits into
ejohnstown wants to merge 4 commits into
Conversation
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Both FatFS install deadlines exceed the enclosing job timeout and therefore cannot provide the intended step-level failure reporting.
Review effort: Balanced
Findings: 1
Open (1)
What changed in this PR
Improves CI resilience against flaky Ubuntu package mirrors and stalled installations.
Changes:
- Adds three retries to
apt-getoperations. - Adds time limits to package-install steps.
- Separates inline
expectandvalgrindinstallation from test execution.
| File | Description |
|---|---|
.github/workflows/x509-interop.yml |
Hardens build and test dependency installation. |
.github/workflows/windows-cert-store-test.yml |
Hardens MinGW toolchain installation. |
.github/workflows/tpm-ssh.yml |
Hardens TPM dependency installation. |
.github/workflows/test-fatfs.yml |
Hardens FatFS dependencies, but adds ineffective step timeouts. |
.github/workflows/sshd-test.yml |
Separates and hardens Valgrind installation. |
.github/workflows/sftp-test.yml |
Separates and hardens Expect installation. |
.github/workflows/paramiko-sftp-test.yml |
Hardens Paramiko test dependencies. |
.github/workflows/network-contention-test.yml |
Hardens Expect installation. |
.github/workflows/multi-compiler.yml |
Hardens compiler installation. |
.github/workflows/cppcheck.yml |
Updates package metadata and installs cppcheck noninteractively. |
.github/workflows/code-coverage.yml |
Hardens Clang and LLVM installation. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Every workflow that installs packages now passes Acquire::Retries=3 to apt-get, and each install step gets its own timeout, sized to fit inside its job's limit, so a stalled mirror fails fast under a step name that says what went wrong. - cppcheck runs apt-get update before installing, and installs with -y - sftp-test and sshd-test move their inline installs into their own steps - test-fatfs job timeout goes from 4 to 10 minutes to hold its installs
ejohnstown
force-pushed
the
ci-apt-retry
branch
from
October 1, 2026 18:21
989eade to
20cb1eb
Compare
Port wolfSSL's install-apt-deps action and ci-deps-image workflow. A daily job on master downloads each package list's .debs and publishes them as ghcr.io/wolfssl/wolfssh-ci-debs; the workflows install from that bundle offline and fall back to the mirror with bounded retries. - two bundles: ubuntu-24.04-tests and ubuntu-24.04-compilers - every apt-get install step in the workflows now uses the action - the package must be made public once after the first build; until then every job takes the mirror fallback - sshd-test job timeout goes from 10 to 15 minutes to fit the install
ejohnstown
changed the title
download-deb-closure.sh runs as root, so a debs directory it creates is root-owned and the unprivileged index step cannot write Packages into it. Create the directory as the runner user first; the script then chowns the .debs to match.
The sshd-test valgrind install pulled 27 MB with gdb and libc6-dbg, which a slow mirror could not deliver inside the 180s fallback budget. Skip the recommends and give the fallback 300s, which still fits the 15-minute job.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keep CI package installs off the Ubuntu mirror. A daily job on master publishes the workflows' apt packages as .deb bundles on ghcr, ported from wolfSSL's
install-apt-deps; jobs install from them offline and fall back to the mirror.ci-deps-imageworkflow andinstall-apt-depsaction; every install step uses the actionAfter merge and the first
ci-deps-imagerun, an org admin must make thewolfssh-ci-debspackage public once. Until then every job, including this PR's CI, takes the mirror fallback.