fix(ci): apt-archive cache restore was silently failing on every run

[qnbs]

User description

Summary

Real CI evidence from main's post-#402-merge Build job: the cache restore genuinely found the key (Cache hit for: apt-playwright-chromium-deps-v1) but tar extraction then failed with Permission denied on every single.deb file, immediately followed by Cache not found for input keys — actions/cache's restore step runs as the unprivileged runner user, but /var/cache/apt/archives is root-owned by default.

This means every apt-cache added in #398, across all 7 sites (6 in ci.yml, 1 in cef-learning-harness.yml), has been silently degrading to a full cache miss on every single run since it was introduced — undermining the whole point of that fix, and very plausibly contributing to several of today's apt-mirror-timeout failures that were attributed purely to external Azure-mirror throughput (which is real, but this bug meant the cache was never actually mitigating it as intended).

Fix

chmod the archive directory world-writable (via sudo, matching how the actual apt-get install steps already need sudo) immediately before each cache-restore step, so tar's unprivileged extraction can actually write into it.

Test plan

• CI on this PR — the "Make apt archive cache dir writable" step runs before each cache-restore step; a subsequent run against a populated cache should show an actual successful restore (Cache Size: ~X MB followed by no permission errors), not another silent "Cache not found" after a reported hit
• No regression to the actual apt-get install steps themselves (they already run as root via sudo, unaffected by this)

🤖 Generated with Claude Code

Summary by Sourcery

Enable reliable apt package cache restoration across CI workflows.

Bug Fixes:

• Fix apt package cache restores across CI workflows so populated caches no longer fail extraction due to archive-directory permissions.

CI:

• Prepare the apt archive directory before cache restoration in Tauri, Playwright, Storybook, end-to-end, and CEF harness jobs.

---

CodeAnt-AI Description

Restore apt package caching across CI jobs

What Changed

• CI jobs now prepare the apt archive directory before restoring cached packages, allowing valid cache entries to be extracted successfully
• Applies to Tauri, Playwright, Storybook, end-to-end, and CEF harness workflows

Impact

✅ Fewer repeated apt package downloads
✅ Fewer CI failures caused by apt mirror timeouts
✅ Working cache restores instead of silent cache misses

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

Summary by CodeRabbit

• Bug Fixes
  • Improved CI and automated test reliability by preparing APT package cache directories before restoring cached packages.
  • Prevented permission-related failures during Rust, build, end-to-end, Storybook, visual regression, and learning harness workflows.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	2e2c7eb	Aug 19, 2026 · 16:09	16:10

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[sourcery-ai]

Sorry @qnbs, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
worldscript-studio	Ready	Preview	Aug 19, 2026 4:15pm

[sourcery-ai]

Reviewer's Guide

Ensure GitHub Actions apt archive cache restores succeed by making the apt cache directory writable to the unprivileged runner user before each actions/cache restore that targets /var/cache/apt/archives in CI workflows.

Sequence diagram for fixed apt archive cache restore in CI

sequenceDiagram
participant runner
participant sudo
participant apt_cache_dir
participant actions_cache
participant apt_get
runner->>sudo: run_mkdir_p_var_cache_apt_archives_partial
sudo-->>apt_cache_dir: mkdir /var/cache/apt/archives/partial
runner->>sudo: run_chmod_R_777_var_cache_apt_archives
sudo-->>apt_cache_dir: chmod -R 777 /var/cache/apt/archives
runner->>actions_cache: actions_cache_restore
actions_cache->>apt_cache_dir: tar_extract_cached_debs
alt [apt_cache_dir writable]
actions_cache-->>runner: cache_restored_successfully
else [apt_cache_dir not writable]
actions_cache-->>runner: cache_not_found_after_permission_denied
end
runner->>apt_get: apt_get_install_with_deps
apt_get-->>apt_cache_dir: read_debs_from_cache

Loading

File-Level Changes

Change	Details	Files
Add a pre-cache step that makes /var/cache/apt/archives writable so actions/cache restore tar extraction can succeed.	Insert a sudo mkdir/chmod step immediately before each apt archive cache restore in the main CI workflow. Apply the same sudo mkdir/chmod pre-cache step in the cef-learning-harness workflow. Document in comments that actions/cache runs as the runner user and previously failed with permission denied on root-owned apt archives, causing silent cache misses.	.github/workflows/ci.yml .github/workflows/cef-learning-harness.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codeant-ai]

🏁 CodeAnt Quality Gate Results

Commit:142c086c
Scan Time: 2026-08-19 16:15:51 UTC

✅ Overall Status: PASSED

Quality Gate Details

Quality Gate	Status	Details
Secrets	✅ PASSED	0 secrets found
Duplicate Code	✅ PASSED	0.0% duplicated
SAST	✅ PASSED	No security issues
Bugs	✅ PASSED	Rating S: No bugs
IAC	✅ PASSED	Rating S: No issues

View Full Results

[amazon-q-developer]

Security Concern: Overly Permissive Permissions

This PR correctly identifies and fixes the root cause of the apt cache restore failures (permission denied on /var/cache/apt/archives). However, all 7 instances use chmod 777, which grants world-writable permissions.

Issue

chmod 777 is more permissive than necessary. Since actions/cache runs as the runner user, changing ownership to runner:runner with chmod 755 would be sufficient and more secure. The current approach allows any user/process on the runner to modify cached packages, creating a potential attack vector if other workflow steps run untrusted code.

Recommendation

Replace all instances of:

sudo chmod -R 777 /var/cache/apt/archives

With:

sudo chown -R runner:runner /var/cache/apt/archives && sudo chmod -R 755 /var/cache/apt/archives

This maintains the fix's effectiveness while following the principle of least privilege.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: f7214b22-0108-4784-b161-711012481ed6

📥 Commits

Reviewing files that changed from the base of the PR and between 7c6deae and 2e2c7eb.

📒 Files selected for processing (2)

• .github/workflows/cef-learning-harness.yml
• .github/workflows/ci.yml

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

---

📝 Walkthrough

Walkthrough

The CI workflows now create the APT archive cache directory and make it writable before cached packages are restored. The setup applies to the CEF learning harness and six CI jobs.

Changes

APT cache setup

Layer / File(s)	Summary
Prepare writable APT caches .github/workflows/cef-learning-harness.yml, .github/workflows/ci.yml	The affected jobs create /var/cache/apt/archives/partial and grant the runner user write access before APT cache restoration.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk:🔵 Low · up to 2e2c7

The change restores CI package-cache extraction but currently grants world-writable permissions to the archive directory and cached packages, creating a bounded security risk in CI. The PR is mergeable with explicit owner follow-up to use narrower directory and file permissions.

Possibly related PRs

• qnbs/WorldScript-Studio#398: Adds the CI APT caching that this change prepares for restoration.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the fix for silently failing APT archive cache restoration in CI.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/apt-cache-permission-denied

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!