From 9bf4cec671a1a0164de0a12afd88fd5f22d7eafa Mon Sep 17 00:00:00 2001 From: Wes Date: Wed, 19 Aug 2026 10:52:28 -0600 Subject: [PATCH] ci: bound desktop apt dependency installs Co-authored-by: Mordecai <8859d29d23052964630ecc632cf2ff0ac51934d1addd905f4888cce26a7443c2@buzz.block.builderlab.xyz> Signed-off-by: Wes --- .github/workflows/ci.yml | 44 ++++++++++------------ lefthook.yml | 3 +- scripts/install-desktop-system-deps-ci.sh | 45 +++++++++++++++++++++++ 3 files changed, 66 insertions(+), 26 deletions(-) create mode 100755 scripts/install-desktop-system-deps-ci.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a832c0a0af..d52d4dd4bb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -55,6 +55,7 @@ jobs: - 'scripts/normative-corpus.json' - 'desktop/**' - '!desktop/src-tauri/**' + - 'scripts/install-desktop-system-deps-ci.sh' - 'pnpm-lock.yaml' desktop-rust: - 'desktop/src-tauri/**' @@ -152,30 +153,23 @@ jobs: workspaces: desktop/src-tauri save-if: ${{ github.event_name != 'pull_request' }} - name: Install Tauri dependencies (Linux) - env: - DEBIAN_FRONTEND: noninteractive run: | - sudo apt-get update \ - -o Acquire::Retries=3 \ - -o Acquire::http::Timeout=30 \ - -o Acquire::https::Timeout=30 - sudo apt-get install -y --no-install-recommends \ - -o Acquire::Retries=3 \ - -o Acquire::http::Timeout=30 \ - -o Acquire::https::Timeout=30 \ - -o DPkg::Lock::Timeout=120 \ - build-essential \ - curl \ - file \ - libasound2-dev \ - libayatana-appindicator3-dev \ - libgtk-3-dev \ - librsvg2-dev \ - libssl-dev \ - libwebkit2gtk-4.1-dev \ - libxdo-dev \ - patchelf \ - wget + scripts/install-desktop-system-deps-ci.sh bash -c ' + sudo apt-get update + sudo apt-get install -y --no-install-recommends \ + build-essential \ + curl \ + file \ + libasound2-dev \ + libayatana-appindicator3-dev \ + libgtk-3-dev \ + librsvg2-dev \ + libssl-dev \ + libwebkit2gtk-4.1-dev \ + libxdo-dev \ + patchelf \ + wget + ' - name: Get pnpm store directory id: pnpm-cache run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT" @@ -264,7 +258,7 @@ jobs: if: steps.playwright-cache.outputs.cache-hit != 'true' run: cd desktop && pnpm exec playwright install chromium - name: Install Playwright system dependencies - run: cd desktop && pnpm exec playwright install-deps chromium + run: scripts/install-desktop-system-deps-ci.sh pnpm -C desktop exec playwright install-deps chromium - name: Save Playwright browser cache if: steps.playwright-cache.outputs.cache-hit != 'true' && github.event_name == 'push' && matrix.shard == 1 uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 @@ -447,7 +441,7 @@ jobs: if: steps.playwright-cache.outputs.cache-hit != 'true' run: cd desktop && pnpm exec playwright install chromium - name: Install Playwright system dependencies - run: cd desktop && pnpm exec playwright install-deps chromium + run: scripts/install-desktop-system-deps-ci.sh pnpm -C desktop exec playwright install-deps chromium - name: Save Playwright browser cache if: steps.playwright-cache.outputs.cache-hit != 'true' && github.event_name == 'push' && matrix.shard == 1 uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5 diff --git a/lefthook.yml b/lefthook.yml index b2b9f18894..eb30324b28 100644 --- a/lefthook.yml +++ b/lefthook.yml @@ -1,7 +1,8 @@ # Glob patterns below mirror the `changes` job's dorny/paths-filter groups in # .github/workflows/ci.yml — keep the two in sync. Deliberate deviations: # - The `.github/workflows/ci.yml` path CI adds to its `rust`/`mobile` filters -# is omitted; a CI-workflow-only edit doesn't need a local test run. +# and the desktop CI system-dependency helper are omitted; CI-only edits +# don't need a local application test run. # - `desktop-check`/`desktop-typecheck`/`desktop-test` don't trigger on `rust` # changes, though CI's Desktop Core job does. Those commands are pure TS # (biome + tsc + node:test) with no Rust dependency, so the extra trigger diff --git a/scripts/install-desktop-system-deps-ci.sh b/scripts/install-desktop-system-deps-ci.sh new file mode 100755 index 0000000000..e550e39cc5 --- /dev/null +++ b/scripts/install-desktop-system-deps-ci.sh @@ -0,0 +1,45 @@ +#!/usr/bin/env bash +# Bound apt-backed CI dependency installation. The command gets two attempts; +# each receives 85 seconds to exit after TERM and is killed at 90 seconds. +set -euo pipefail + +readonly apt_config=/etc/apt/apt.conf.d/99buzz-ci-bounds +readonly max_attempts=2 +readonly retry_delay_seconds=5 + +cleanup() { + sudo rm -f "$apt_config" +} +trap cleanup EXIT + +sudo tee "$apt_config" >/dev/null <<'APT_CONFIG' +Acquire::Retries "0"; +Acquire::http::Timeout "15"; +Acquire::https::Timeout "15"; +DPkg::Lock::Timeout "15"; +APT_CONFIG + +export DEBIAN_FRONTEND=noninteractive +for attempt in $(seq 1 "$max_attempts"); do + echo "System dependency install attempt ${attempt}/${max_attempts}" + set +e + timeout --signal=TERM --kill-after=5s 85s "$@" + status=$? + set -e + if [ "$status" -eq 0 ]; then + exit 0 + fi + + if [ "$status" -ne 124 ]; then + echo "System dependency installation failed (status ${status}); not retrying a non-timeout failure" >&2 + exit "$status" + fi + + if [ "$attempt" -eq "$max_attempts" ]; then + echo "System dependency installation timed out after ${max_attempts} bounded attempts" >&2 + exit "$status" + fi + + echo "System dependency install attempt ${attempt} timed out; retrying in ${retry_delay_seconds}s" >&2 + sleep "$retry_delay_seconds" +done