Harden shared CI against transient failures

[sjmiller609]

summary

• retry checkout and SDK lint validation after transient network or dependency-download failures
• derive test bridge names from uniquely leased subnets to prevent cross-process bridge collisions without reducing parallelism
• recover and restage the host-provisioned Windows image and backing fixtures into /ci on every test run

tests

• go test ./lib/instances -run ^TestBridgeNameForTestSubnet$ -count=1
• git diff --check

---

Note

Medium Risk
CI-only and test-infra changes: retries and fixture copies are low-impact, but renaming Linux test bridges affects isolation of concurrent network tests on shared runners.

Overview
Hardens shared CI against transient checkout/lint failures, missing Windows VM images, and colliding test network bridges.

Checkout in test.yml now retries once on failure. SDK lint in stlc-generate.yml retries up to three times. Each Linux test run restages host-provisioned Windows qcow2/raw fixtures into /ci/windows when they are present.

Test Linux bridges are named from the leased subnet (hm + octets) instead of a seed/seq combo, so parallel processes no longer share a bridge name.

^{Reviewed by Cursor Bugbot for commit f33dca0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

-->

✱ stlc build

⚡ gocode · compare

Your SDK build resulted in a merge conflict between your custom code and the newly generated changes. Run stlc build --continue after resolving conflicts.

generate ⚡ → bootstrap ✅ → format ✅

116 files generated

✅ pythoncode · compare

Your SDK build was successful.

generate ✅ → bootstrap ✅ → format ✅

230 files generated at 681b411

⚡ typescriptcode · compare

Your SDK build resulted in a merge conflict between your custom code and the newly generated changes. Run stlc build --continue after resolving conflicts.

generate ⚡ → bootstrap ✅ → format ✅

138 files generated

Diagnostics: ❗ 1 error, 💡 5 note

Level	Code	Message	Targets
❗ error	Python/RequestParamShadowsDefault	Renamed param `timeout` because it shadowed a request option. (resource) instances > (method) wait > (params) default > (param) timeout > (schema)	python
💡 note	Pagination/NotConfigured	Confirm your API does not return paginated results. #/pagination	python, go, typescript
💡 note	Model/Recommended	We recommend you use a model for `#/components/schemas/InstanceGPU` #/components/schemas/InstanceGPU	python, go, typescript
💡 note	Schema/EnumHasOneMember	Confirm intentional use of `enum` with single member. (resource) health > (model) HealthCheckResponse > (schema) > (property) status	go
💡 note	Schema/EnumHasOneMember	Confirm intentional use of `enum` with single member. (resource) instances > (model) restart_status > (schema) > (property) last_reason	go
💡 note	Method/BodyRootParamUnnamed	Confirm `body` is an appropriate name for this method's request parameters. #/paths//volumes/from-archive/post/requestBody/content/application/gzip/schema	go, python, typescript

Build metadata

Build	bd_76BdRHNh-elfin-snag
Timestamp	2026-08-21T22:24:42.352Z
stlc	8413509
Spec hash	0f15511e31a6
Config hash	55e15f6f4434

---

This comment is auto-generated by stlc and is kept up to date as you push.
If you push new commits, re-run this workflow to update this comment.
Last updated: 2026-08-21 22:25:04 UTC

[sjmiller609]

this looks like it's just trying two options but that would only decrease but not resolve the issue

[cursor]

Orphan bridges can block subnets

Medium Severity

Bridge names are now a fixed function of the leased subnet, but subnet selection only skips leases and overlapping routes. An orphan hm* bridge with no lease and no route still maps to the same name on the next lease of that subnet, so createBridge can fail when the interface already exists without the expected address. The old seed-based names avoided reusing that interface name.

Additional Locations (2)

• lib/instances/test_network_config_test.go#L484-L519
• lib/instances/test_network_config_test.go#L448-L458

^{Reviewed by Cursor Bugbot for commit 7e3924e. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 6258e21. Configure here.}