Repository navigation
CI: fix ci-deps-canary nightly, add apt-install.sh for unification and robustness - #11629
padelsbach wants to merge 4 commits into
Conversation
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Zero-value validation and the Falcon job’s insufficient timeout budget undermine the intended robustness.
Review effort: Balanced
Findings: 2
Open (2)
What changed in this PR
Centralizes robust apt installation behavior for CI workflows and composite actions.
Changes:
- Adds a reusable apt installer with retries, timeouts, and vendor-source handling.
- Migrates CI jobs and dependency-bundle generation to the shared script.
- Expands SBOM dependencies and avoids amd64 bundles on non-x64 runners.
| File | Description |
|---|---|
.github/scripts/apt-install.sh |
Adds the shared apt installation utility. |
.github/scripts/download-deb-closure.sh |
Uses the shared utility for bundle downloads. |
.github/actions/install-apt-deps/action.yml |
Delegates apt fallback and adds architecture gating. |
.github/actions/ccache-setup/action.yml |
Reuses the shared installer for ccache. |
.github/workflows/sbom.yml |
Uses bundled apt dependencies for SBOM tooling. |
.github/workflows/falcon-interop.yml |
Migrates Falcon jobs to the apt action. |
.github/workflows/cross-library.yml |
Bootstraps and uses the installer in containers. |
.github/workflows/cross-library/README.md |
Documents the new bootstrap process. |
.github/workflows/ci-deps-image.yml |
Uses the installer when producing dependency bundles. |
.github/workflows/afalg.yml |
Uses best-effort shared installation for kernel modules. |
.github/ci-deps/packages-ubuntu-24.04-full.txt |
Adds SBOM build dependencies to the full bundle. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
0ee5c5b to
a4fd12a
Compare
|
jenkins retest this please (timeout to be fixed in https://github.com/wolfSSL/testing/pull/1053) |
padelsbach
changed the title
|
jenkins retest this please |
e600078 to
b2c459d
Compare
night1rider
left a comment
night1rider
left a comment
There was a problem hiding this comment.
Two things AI found I thought should be looked at.
| # Bundle exact (=) deps even if installed, as older images may differ. | ||
| ARCHIVES=/var/cache/apt/archives | ||
| export LC_ALL=C # sort and comm must agree on the order | ||
| pinned() { | ||
| for deb in "$ARCHIVES"/*.deb; do | ||
| dpkg-deb -f "$deb" Pre-Depends Depends | ||
| done | sed 's/^[^ ]*: //' | tr ',' '\n' \ | ||
| | sed -nE 's/^ *([^ :(|]+)(:[^ ]+)? *\(= *([^ )]+)\) *$/\1=\3/p' | sort -u | ||
| } | ||
| bundled() { | ||
| for deb in "$ARCHIVES"/*.deb; do | ||
| dpkg-deb -f "$deb" Package Version | sed 's/^[^ ]*: //' | paste -sd= | ||
| done | sort -u | ||
| } | ||
| declare -A tried=() | ||
| while :; do | ||
| need=() | ||
| while read -r pin; do | ||
| [ -n "${tried[$pin]:-}" ] || need+=("$pin") | ||
| done < <(comm -23 <(pinned) <(bundled)) | ||
| [ "${#need[@]}" -gt 0 ] || break | ||
| echo "Pinned (${#need[@]}): ${need[*]}" | ||
| for pin in "${need[@]}"; do | ||
| tried[$pin]=1 | ||
| "$APT_INSTALL" --tries 5 --no-update --warn-only --download-only \ | ||
| --reinstall "$pin" || skipped=$((skipped+1)) | ||
| done | ||
| done |
There was a problem hiding this comment.
The PR now bundles a package when a bundled .deb asks for its exact version, so gcc-14-base goes in. But installed packages that pin the old gcc-14-base (libgcc-s1, libstdc++6) have to be upgraded with it, and they are not bundled. On an older runner image the offline install still fails the same way it does without the PR, and the job goes back to the mirror. Should the loop also bundle installed packages that pin a bundled one?
What I ran: I built the bundle for build-essential libtool python3-yaml in ubuntu:24.04 with the script from master and from the PR. Then I installed each one offline (--network none, same apt options as install-apt-deps) into two consumers: the stock image, and the same image with only gcc-14-base, libgcc-s1 and libstdc++6 rolled back to the noble release version. The PR bundle installed fine on the stock image and failed on the older one with exit 100, the same as the master bundle. Adding libgcc-s1 and libstdc++6 to the loop's list fixed it.
There was a problem hiding this comment.
Good catch. Updated to parse out the exact version and use it
| # Update gets half of each attempt (20s..90s, apt's 3 x 30s ladder). | ||
| PER=$(( ${{ inputs.budget-seconds }} / ${{ inputs.retries }} )) | ||
| UPD=$((PER / 2)) | ||
| [ "$UPD" -le 90 ] || UPD=90 | ||
| [ "$UPD" -ge 20 ] || UPD=20 | ||
| INS=$((PER - UPD)) | ||
| [ "$INS" -ge 40 ] || INS=40 |
There was a problem hiding this comment.
The old loop split what was left of budget-seconds over the attempts still to come, so a fast failure handed its time to the retry. The PR splits the budget evenly up front. With the defaults, a retry after a fast apt-get update failure now gets 210s for install instead of about 505s. Was this change meant, and is 210s enough for the biggest package sets?
What I ran: I ran the step's run: block from master and from the PR with the default inputs (600s, 2 tries). sudo, timeout and sleep were stubs, so the stub timeout printed each limit and faked the run time. With no early failure both gave install 210s. With the first update failing at once and an install that needs 300s, master gave it 510s and passed, and the PR gave it 210s and failed with exit 124. The real figure on master is about 505s, because the stubbed sleep 5 takes no time here.
There was a problem hiding this comment.
Updated to split the budget
Description
Fixes a failure in the CI image build where an apt package would be omitted from the bundle if it was already present on the host machine. Failure occurred sporadically as GH migrates Ubuntu versions, and the fix applies to any version.
Example: https://github.com/wolfSSL/wolfssl/actions/runs/39548467943
Also, unify several copypasta apt install loops into
apt-install.sh. Handles timeouts for robustness in a uniform way.Testing
CI
Checklist