fix(ci): harden Ubuntu Lighthouse and Playwright browser setup against apt mirror flakiness

[BigSimmo]

Summary

This PR permanently resolves Ubuntu runner flakiness during Lighthouse test runs and Playwright browser installations (such as the failure observed on PR #2184).

Root Cause

GitHub-hosted Ubuntu runners default to azure.archive.ubuntu.com. During Setup pinned Chromium, Playwright runs npx playwright install-deps which calls apt-get update. When the Azure mirror experiences rate-limiting, connection drops, or sync issues (Ign: lines), the step hangs or fails. Additionally, setup-lighthouse-chromium lacked per-attempt timeouts and retries.

Changes

1. Apt Mirror Redirection & Resilience Configuration:
   • Automatically rewrites azure.archive.ubuntu.com to the official canonical archive.ubuntu.com in /etc/apt/sources.list and /etc/apt/sources.list.d/*.sources.
   • Provisions /etc/apt/apt.conf.d/99flaky-mirror-resilience with Acquire::Retries "3" and fast 30s timeouts (Acquire::http::Timeout "30", Acquire::https::Timeout "30").
2. Bounded Timeouts & Retries in CI Actions:
   • Wraps browser and dependency installations in .github/actions/setup-lighthouse-chromium/action.yml, .github/actions/setup-ui-e2e/action.yml, and .github/workflows/ci.yml in a bounded loop (timeout 180, 3 attempts, 5s backoff).
3. CI Cache Safety Contract Tests:
   • Added unit test assertions in tests/ci-cache-safety.test.ts to enforce mirror sanitization, timeout bounds, and retry loops across all browser setup actions on every PR.

Verification

• npm run test:ci-workflows (15/15 suites passed, 317 tests)
• npm run check:github-actions (passed)
• npm run check:ci-scope (passed)
• git diff --check (clean)

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your current included review allowance is based on your included PR review attempts over the past 7 days.

Next review available in:40 minutes

Limit details: You’ve used the included review currently available. Your 85 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 70a1b9a1-e588-4b56-acb3-bb58e5f8314b

📥 Commits

Reviewing files that changed from the base of the PR and between bfbea24 and 29b56ad.

📒 Files selected for processing (4)

• .github/actions/setup-lighthouse-chromium/action.yml
• .github/actions/setup-ui-e2e/action.yml
• .github/workflows/ci.yml
• tests/ci-cache-safety.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Lighthouse budget — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — main-side: the same job also failed on the latest completed main CI run.

Compared with main CI run #12589 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.