Harden shared CI against transient failures

.github/workflows/stlc-generate.yml

@@ -238,7 +238,15 @@ jobs:
  --targets all \
  "${commit_args[@]}"
  stlc exec --targets "$SDK_TARGETS" -- ./scripts/bootstrap
- stlc lint --targets "$SDK_TARGETS"
+ for attempt in 1 2 3; do
+ if stlc lint --targets "$SDK_TARGETS"; then
+ break
+ fi
+ if [ "$attempt" -eq 3 ]; then
+ exit 1
+ fi
+ sleep 5
+ done
  stlc test --targets "$SDK_TARGETS"
  stlc exec --targets "$SDK_TARGETS" -- sh -c \
  'status=$(git status --porcelain --untracked-files=all) && [ -z "$status" ] || { printf "%s\n" "$status" >&2; exit 1; }'

.github/workflows/test.yml

@@ -28,6 +28,17 @@ jobs:
  runs-on: [self-hosted, linux, x64, kvm]
  steps:
  - uses: actions/checkout@v4
+ id: checkout
+ continue-on-error: true
+ with:
+ clean: false
+ repository: ${{ env.TEST_SOURCE_REPO }}
+ ref: ${{ env.TEST_SOURCE_REF }}
+ persist-credentials: false
+
+ - name: Retry checkout
+ if: steps.checkout.outcome == 'failure'
+ uses: actions/checkout@v4
  with:
  clean: false
  repository: ${{ env.TEST_SOURCE_REPO }}
@@ -97,6 +108,27 @@ jobs:
  sudo env "PATH=$TEST_PATH" bash -lc "command -v '$bin'"
  done
 
+ - name: Stage Windows test fixtures
+ run: |
+ fixture_dir=/mnt/data/ci-fixtures/windows
+ image_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-agent.qcow2' -print -quit)
+ base_source=$(sudo find /mnt/data/home -path '*/windows-vm-exp/build/*-golden.raw' -print -quit)
+ sudo mkdir -p "$fixture_dir" /ci/windows
+ if ! test -r "$fixture_dir/image-agent.qcow2" && test -n "$image_source"; then
+ sudo cp --reflink=auto --sparse=always "$image_source" "$fixture_dir/image-agent.qcow2"
+ sudo chmod 0444 "$fixture_dir/image-agent.qcow2"
+ fi
+ if ! test -r "$fixture_dir/base.raw" && test -n "$base_source"; then
+ sudo cp --reflink=auto --sparse=always "$base_source" "$fixture_dir/base.raw"
+ sudo chmod 0444 "$fixture_dir/base.raw"
+ fi
+ if test -r "$fixture_dir/image-agent.qcow2"; then
+ sudo ln -sfn "$fixture_dir/image-agent.qcow2" /ci/windows/image-agent.qcow2
+ fi
+ if test -r "$fixture_dir/base.raw"; then
+ sudo ln -sfn "$fixture_dir/base.raw" /ci/windows/base.raw
+ fi
+
  # Slash-command runs are maintainer-approved and need authenticated pulls
  # for images that are not covered by the prewarm cache.
  - name: Login to Docker Hub

lib/instances/test_network_config_test.go

@@ -161,7 +161,10 @@ func allocateTestNetworkLease(testName string, seq uint32) (*testNetworkLease, e
  return err
  }
 
- bridgeName = fmt.Sprintf("hm%04x%03x", testNetworkRunSeed&0xffff, seq%0xfff)
+ bridgeName, err = testBridgeNameForSubnet(subnet)
+ if err != nil {
+ return err
+ }
  allocatedSubnet = subnet
  leases[subnet] = subnetLease{
  TestName: testName,
@@ -443,6 +446,34 @@ func pruneStaleLeases(leases map[string]subnetLease, routes []hostRoute) {
 	}
 }
 
+func testBridgeNameForSubnet(subnet string) (string, error) {
+	ip, _, err := net.ParseCIDR(subnet)
+	if err != nil {
+ return "", fmt.Errorf("parse test subnet %q: %w", subnet, err)
+	}
+	ip = ip.To4()
+	if ip == nil {
+ return "", fmt.Errorf("test subnet %q is not IPv4", subnet)
+	}
+	return fmt.Sprintf("hm%02x%02x", ip[1], ip[2]), nil
+}
+
+func TestBridgeNameForTestSubnet(t *testing.T) {
+	t.Parallel()
+
+	first, err := testBridgeNameForSubnet("10.200.1.0/24")
+	if err != nil {
+ t.Fatal(err)
+	}
+	second, err := testBridgeNameForSubnet("10.200.2.0/24")
+	if err != nil {
+ t.Fatal(err)
+	}
+	if first != "hmc801" || second != "hmc802" || first == second {
+ t.Fatalf("unexpected bridge names: %q %q", first, second)
+	}
+}
+
 func bridgeExists(name string) bool {
 	if name == "" {
  return false