Repository navigation
ci: pin apt hosts through DNS over HTTPS when the runner can't resolve them - #175
Merged
Merged
Conversation
…n't resolve it Since 2026-11-11 ~14:40 UTC GitHub's Ubuntu runners cannot resolve azure.archive.ubuntu.com, so 'playwright install --with-deps' and the runner image's apt-get retry for minutes and fail every CI run (bugpatrol#174 failed three attempts the same way). The Ubuntu archive serves the same paths under that host name, so scripts/apt-mirror-fallback.sh maps the name to archive.ubuntu.com in /etc/hosts for the job, and docker build gets the same mapping through --add-host. It does nothing while the mirror resolves, and the runner Dockerfile is untouched, so the image digest and baselines don't change. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Nebula AI Agent <277912164+nebula-ai-agent[bot]@users.noreply.github.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
The first fallback mapped the Azure mirror to archive.ubuntu.com, but on the runners archive.ubuntu.com does not resolve either (#175's first run exited 2 in getent), so the ubuntu.com names are gone from the runner's resolver as a whole. Look each apt host up through Cloudflare's or Google's DNS over HTTPS instead and pin the answer, and pass every pin to docker build. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: Nebula AI Agent <277912164+nebula-ai-agent[bot]@users.noreply.github.com>
joaquim-verges
changed the title
joaquim-verges
added
the
mergepatrol
Nebula AI Agent
Contributor
|
Merged as dab7c7b. |
merge-loop
Bot
removed
the
mergepatrol
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Since about 14:40 UTC on 2026-11-11, GitHub's Ubuntu runners can't resolve the
ubuntu.comapt hosts:azure.archive.ubuntu.com, and alsoarchive.ubuntu.com(this PR's first run proved that). Every apt step retries for minutes and then fails:playwright install --with-depsinchecksanddeterminism / flake-check, and the runner image'sapt-getindeterminism / runner-image. That turns the requiredbuildcheck red on any PR. #174 failed three attempts in a row this way, andrelease.ymlhas the same step, so a release would fail too.Change
scripts/apt-mirror-fallback.shchecks each apt host (azure.archive.ubuntu.com,archive.ubuntu.com,security.ubuntu.com). If a host doesn't resolve on the runner, it looks the host up through Cloudflare's DNS over HTTPS (falling back to Google's) and pins the answer in/etc/hostsfor that job. It also exports the pins as--add-hostflags fordocker build, because the Playwright base image names the same mirror. While the names resolve, it does nothing.ci.yml,determinism.ymlandrelease.yml.images/runner/Dockerfileis unchanged, so the image digest and baselines aren't invalidated.Verification
getentstubbed to fail, the script pins all three hosts from DNS over HTTPS and emits the--add-hostlist.🤖 Generated with Claude Code