ci: drop the runner's Microsoft apt repos before installing packages - #718
Merged
Conversation
`packages.microsoft.com` answered 403 Forbidden on the `InRelease` files of both repos the runner image preinstalls, `repos/azure-cli` and `ubuntu/24.04/prod`, and `apt-get update` exits 100 when any configured source fails to verify. That reddened the Delta Sync Integration lane on main at the "Install system dependencies" step, three attempts in a row, before a line of our own code had run. The sibling job in the same run passed the same step a few minutes earlier, so it is intermittent, and a re-run of the failed job went green with nothing changed. Nothing in this repository installs from those repos. The only mentions of Microsoft packages in the workflows are `rm -rf /usr/share/dotnet` lines that free disk space. So the twenty places that run `sudo apt-get update` now remove those two source lists first, and only those: the Ubuntu archives and the Chrome repo the image also ships stay where they are. The removal cannot itself fail a step: `rm -f` returns success when a glob matches nothing, so a future runner image that stops shipping those files changes nothing here. Every one of the twenty sites is inside a Linux-only step, either guarded by `runner.os == 'Linux'` or by a matrix target, and runs under bash. This is a lane-flake class, not a bug in the runner image we can wait out: the same 403 will come back, and every workflow that installs a package is exposed to it. The alternative, retrying, is already in place where it matters and did not help, because the outage lasted longer than the three attempts. Signed-off-by: axpnet <45786925+axpnet@users.noreply.github.com>
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: 📒 Files selected for processing (8)
Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review. 📝 WalkthroughWalkthroughCI workflow dependency steps now remove Microsoft and Azure CLI APT source files before running ChangesCI APT source cleanup
Estimated code review effort: 1 (Trivial) | ~5 minutes Merge Risk: ⚪ Minimal · up to CI dependency steps now avoid intermittent Microsoft APT repository failures while preserving the Ubuntu and Chrome repositories and existing package installation sequence. No current merge-blocking risk remains. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
packages.microsoft.comanswers 403 Forbidden on theInReleasefiles of the two repositories the runner image preinstalls,repos/azure-cliandubuntu/24.04/prod, often enough to redden a run at random.apt-get updateexits 100 when any configured source fails to verify, so the step dies before a line of this repository's code has run. It happened onmainright after #717 merged: the Delta Sync Integration lane failed at "Install system dependencies" in the password-only job, three attempts in a row, while the sibling job in the same run had passed the same step minutes earlier, and a re-run of the failed job went green with nothing changed.Nothing here installs from those repositories. The only mentions of Microsoft packages in the workflows are the
rm -rf /usr/share/dotnetlines that free disk space. So the twenty places that runsudo apt-get updatenow drop those two source lists first, and only those: the Ubuntu archives and the Chrome repository the image also ships are left alone.The removal cannot fail a step on its own.
rm -freturns success when a glob matches nothing, so a future runner image that stops shipping those files changes nothing here, and there is no pipeline for aset -o pipefailto trip on. Every one of the twenty sites sits inside a Linux-only step, guarded either byrunner.os == 'Linux'or by a matrix target, and runs under bash.This pull request verifies itself: its own CI runs with the change in place, so a green run is the evidence that the twenty edits are well formed. The YAML of all thirteen workflows was also parsed locally.
Retrying was already in place where it matters and did not help, because the outage outlived the three attempts. The trap is now entry 15 of the recurring CI-red checklist, with the instruction to add the same line to any new workflow step that installs a package.
Type of Change
Checklist
git commit -s), see CONTRIBUTINGRelated Issues
None. Follows the red seen on
mainat50bcd412eafter #717.Summary by CodeRabbit