ci: bound desktop apt dependency installs

Co-authored-by: Mordecai <8859d29d23052964630ecc632cf2ff0ac51934d1addd905f4888cce26a7443c2@buzz.block.builderlab.xyz>
Signed-off-by: Wes <wesbillman@users.noreply.github.com>

.github/workflows/ci.yml

@@ -55,6 +55,7 @@ jobs:
               - 'scripts/normative-corpus.json'
               - 'desktop/**'
               - '!desktop/src-tauri/**'
+              - 'scripts/install-desktop-system-deps-ci.sh'
               - 'pnpm-lock.yaml'
             desktop-rust:
               - 'desktop/src-tauri/**'
@@ -152,30 +153,23 @@ jobs:
           workspaces: desktop/src-tauri
           save-if: ${{ github.event_name != 'pull_request' }}
       - name: Install Tauri dependencies (Linux)
-        env:
-          DEBIAN_FRONTEND: noninteractive
         run: |
-          sudo apt-get update \
-            -o Acquire::Retries=3 \
-            -o Acquire::http::Timeout=30 \
-            -o Acquire::https::Timeout=30
-          sudo apt-get install -y --no-install-recommends \
-            -o Acquire::Retries=3 \
-            -o Acquire::http::Timeout=30 \
-            -o Acquire::https::Timeout=30 \
-            -o DPkg::Lock::Timeout=120 \
-            build-essential \
-            curl \
-            file \
-            libasound2-dev \
-            libayatana-appindicator3-dev \
-            libgtk-3-dev \
-            librsvg2-dev \
-            libssl-dev \
-            libwebkit2gtk-4.1-dev \
-            libxdo-dev \
-            patchelf \
-            wget
+          scripts/install-desktop-system-deps-ci.sh bash -c '
+            sudo apt-get update
+            sudo apt-get install -y --no-install-recommends \
+              build-essential \
+              curl \
+              file \
+              libasound2-dev \
+              libayatana-appindicator3-dev \
+              libgtk-3-dev \
+              librsvg2-dev \
+              libssl-dev \
+              libwebkit2gtk-4.1-dev \
+              libxdo-dev \
+              patchelf \
+              wget
+          '
       - name: Get pnpm store directory
         id: pnpm-cache
         run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
@@ -264,7 +258,7 @@ jobs:
         if: steps.playwright-cache.outputs.cache-hit != 'true'
         run: cd desktop && pnpm exec playwright install chromium
       - name: Install Playwright system dependencies
-        run: cd desktop && pnpm exec playwright install-deps chromium
+        run: scripts/install-desktop-system-deps-ci.sh pnpm -C desktop exec playwright install-deps chromium
       - name: Save Playwright browser cache
         if: steps.playwright-cache.outputs.cache-hit != 'true' && github.event_name == 'push' && matrix.shard == 1
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
@@ -447,7 +441,7 @@ jobs:
         if: steps.playwright-cache.outputs.cache-hit != 'true'
         run: cd desktop && pnpm exec playwright install chromium
       - name: Install Playwright system dependencies
-        run: cd desktop && pnpm exec playwright install-deps chromium
+        run: scripts/install-desktop-system-deps-ci.sh pnpm -C desktop exec playwright install-deps chromium
       - name: Save Playwright browser cache
         if: steps.playwright-cache.outputs.cache-hit != 'true' && github.event_name == 'push' && matrix.shard == 1
         uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5

lefthook.yml

@@ -1,7 +1,8 @@
 # Glob patterns below mirror the `changes` job's dorny/paths-filter groups in
 # .github/workflows/ci.yml — keep the two in sync. Deliberate deviations:
 # - The `.github/workflows/ci.yml` path CI adds to its `rust`/`mobile` filters
-#   is omitted; a CI-workflow-only edit doesn't need a local test run.
+#   and the desktop CI system-dependency helper are omitted; CI-only edits
+#   don't need a local application test run.
 # - `desktop-check`/`desktop-typecheck`/`desktop-test` don't trigger on `rust`
 #   changes, though CI's Desktop Core job does. Those commands are pure TS
 #   (biome + tsc + node:test) with no Rust dependency, so the extra trigger

scripts/install-desktop-system-deps-ci.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Bound apt-backed CI dependency installation. The command gets two attempts;
+# each receives 85 seconds to exit after TERM and is killed at 90 seconds.
+set -euo pipefail
+
+readonly apt_config=/etc/apt/apt.conf.d/99buzz-ci-bounds
+readonly max_attempts=2
+readonly retry_delay_seconds=5
+
+cleanup() {
+  sudo rm -f "$apt_config"
+}
+trap cleanup EXIT
+
+sudo tee "$apt_config" >/dev/null <<'APT_CONFIG'
+Acquire::Retries "0";
+Acquire::http::Timeout "15";
+Acquire::https::Timeout "15";
+DPkg::Lock::Timeout "15";
+APT_CONFIG
+
+export DEBIAN_FRONTEND=noninteractive
+for attempt in $(seq 1 "$max_attempts"); do
+  echo "System dependency install attempt ${attempt}/${max_attempts}"
+  set +e
+  timeout --signal=TERM --kill-after=5s 85s "$@"
+  status=$?
+  set -e
+  if [ "$status" -eq 0 ]; then
+    exit 0
+  fi
+
+  if [ "$status" -ne 124 ]; then
+    echo "System dependency installation failed (status ${status}); not retrying a non-timeout failure" >&2
+    exit "$status"
+  fi
+
+  if [ "$attempt" -eq "$max_attempts" ]; then
+    echo "System dependency installation timed out after ${max_attempts} bounded attempts" >&2
+    exit "$status"
+  fi
+
+  echo "System dependency install attempt ${attempt} timed out; retrying in ${retry_delay_seconds}s" >&2
+  sleep "$retry_delay_seconds"
+done