From eea9e9df36e75c66a16b45db69137e601b4dcc75 Mon Sep 17 00:00:00 2001 From: Lukas Wuttke Date: Thu, 20 Aug 2026 11:09:50 +0200 Subject: [PATCH] fix(534): drop the unretried apt-get from a required check `Installer (shell)` is a REQUIRED status check on develop, and its first action was an `apt-get` with no retry and no time bound of its own. A slow package mirror therefore consumed the whole 10-minute job budget before any shell was parsed, and blocked every PR in the repo while doing it. MEASURED, not theorised. cli#533 is a workflow-only diff that cannot touch installer behaviour, and it failed FOUR consecutive times: job 96126585157 Installer (shell) failure 10m16s 15:34 Set up job 15:34 Run actions/checkout 15:34 shellcheck + dash parse <- 10 minutes here, then killed 15:44 Post Run actions/checkout Nothing after the `apt-get` line ever ran. And the annotation read `The job has exceeded the maximum execution time of 10m0s` on a job called `Installer (shell)`, so whoever sees it reasonably concludes the installer is hanging. Nothing points at apt. NOT REPO-WIDE, which is worth stating because the ticket first implied it: #530 and #526 pass the same check. It reproduced on one head, four times. THE FIX REMOVES THE DEPENDENCY RATHER THAN HARDENING IT. Both tools are already on `ubuntu-latest`: * shellcheck is preinstalled -- tracebloc/.github's own `quality / shellcheck` job, a REQUIRED check in 16 repos, calls `shellcheck --version` with no install at all. The org has depended on that fleet-wide for as long as that job existed. * dash IS Ubuntu's /bin/sh, an essential package. A retry-with-timeout around apt would have been the smaller diff and the worse fix: a step that installs nothing cannot stall on a mirror, and no wrapper can say that. `shellcheck --version | head -2` is kept as the first line, matching what the org's own shellcheck job does -- so the version in use is in the log, and an absent binary fails on line one with an obvious message instead of somewhere further down. THIS PR'S OWN RUN IS THE PROOF, and that is deliberate: if either tool were missing the step fails loudly here, before merge. Better than any claim in the comment. Verified locally too: shellcheck --shell=sh --severity=error scripts/install.sh clean, dash -n scripts/install.sh clean. Closes #534. Co-Authored-By: Claude Opus 5 --- .github/workflows/build.yml | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index ed2b8750..29f65106 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -48,8 +48,32 @@ jobs: steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: shellcheck + dash parse + # NO `apt-get` (cli#534). Both tools are already on `ubuntu-latest`: + # `shellcheck` is preinstalled -- tracebloc/.github's own `quality / shellcheck` + # job, a REQUIRED check in 16 repos, calls `shellcheck --version` with no + # install at all -- and `dash` IS Ubuntu's `/bin/sh`, an essential package. + # + # WHY IT HAD TO GO, and it is not tidiness. This step is the first thing in a + # REQUIRED check, and `apt-get` here had no retry and no time bound of its own, + # so a slow package mirror consumed the whole 10-minute job budget before any + # shell was parsed. Measured on cli#533 -- a workflow-only diff that cannot + # touch installer behaviour -- which failed FOUR consecutive times: + # + # job 96126585157 Installer (shell) failure 10m16s + # 15:34 shellcheck + dash parse <- 10 minutes here, then killed + # + # Nothing after the `apt-get` line ever ran, and the annotation said + # `Installer (shell)` exceeded 10m -- pointing whoever reads it at the + # installer rather than at package fetching. + # + # Removing the dependency beats hardening it: a step that installs nothing + # cannot stall on a mirror, and no retry/timeout wrapper can say that. + # + # THIS PR'S OWN RUN IS THE PROOF. If either tool were absent the step fails + # loudly on the first line, here, before merge -- which is a better check than + # any claim in this comment. run: | - sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck dash + shellcheck --version | head -2 shellcheck --shell=sh --severity=error scripts/install.sh shellcheck --shell=bash --severity=error scripts/check-style.sh shellcheck --shell=bash --severity=error scripts/check-tool-pins.sh