From e15412f91061014f420b21f2ddfa8cd7d08d5f4e Mon Sep 17 00:00:00 2001 From: Takwa Date: Wed, 11 Nov 2026 16:15:16 +0100 Subject: [PATCH] Claude review: don't let an apt mirror outage eat the review Install only the sandbox tools the runner lacks, first from the image's own package lists, refreshing them once only if that fails, with apt fetch timeouts and a 6-minute cap on the step. Fail with a clear error when the tools still can't be installed. On ipni/workers#36 the runner could not resolve security.ubuntu.com: three full apt-get update + install rounds took 11 minutes, then the step failed with no explanation on the PR. bwrap was already on the runner; only socat was missing. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/claude-review.yml | 25 ++++++++++++++++++++----- 1 file changed, 20 insertions(+), 5 deletions(-) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index d2a0ebb..89347a6 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -149,14 +149,29 @@ jobs: # bubblewrap sandbox, which also needs socat. The action only installs # these when allowed_non_write_users is set, so install them here. # Without them every Bash call fails and no review gets posted. + # + # Install only what the runner image lacks (it usually has bwrap, not + # socat), first from the package lists it already has, refreshing them + # only if that fails. When a runner cannot reach Ubuntu's mirrors + # ("Temporary failure resolving 'security.ubuntu.com'"), three full + # `apt-get update`s used to take 11 minutes before failing anyway; the + # step's timeout now caps that. - name: Install sandbox dependencies if: steps.cfg.outputs.skip != 'true' + timeout-minutes: 6 run: | - for i in 1 2 3; do - sudo apt-get update -qq && sudo apt-get install -y --no-install-recommends bubblewrap socat && break - echo "apt-get attempt $i failed, retrying..." - sleep 5 - done + missing=() + command -v bwrap >/dev/null || missing+=(bubblewrap) + command -v socat >/dev/null || missing+=(socat) + if [ "${#missing[@]}" -gt 0 ]; then + apt=(sudo apt-get -o Acquire::Retries=2 -o Acquire::http::Timeout=20 + -o Acquire::https::Timeout=20 -o DPkg::Lock::Timeout=60) + install_missing() { "${apt[@]}" install -y --no-install-recommends "${missing[@]}"; } + install_missing || { "${apt[@]}" update -qq; install_missing; } || { + echo "::error::Could not install ${missing[*]}: the runner may not reach Ubuntu's mirrors. Re-run the job." + exit 1 + } + fi command -v bwrap && command -v socat # Ubuntu 24.04+ restricts unprivileged user namespaces via AppArmor. if [ -f /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then