From eba420c0c714fe9d48a334a78195878c3840d681 Mon Sep 17 00:00:00 2001
From: Ryanmello07 <67509637+Ryanmello07@users.noreply.github.com>
Date: Thu, 20 Aug 2026 23:02:51 -0700
Subject: [PATCH] ci: bound every job, and stop apt waiting forever on a
 stalled mirror

Two runs of this workflow burned to GitHub's 6-hour default timeout without
producing a result. Neither failed: both hung inside apt, which by default
waits indefinitely on a mirror connection that has gone quiet. One lost an
hour on `apt-get install zip`, the other six hours split across dependency
installs. Different packages, same cause, so the fix is applied at the
transport rather than at each call site.

Two layers, because either alone leaves a hole:

1. `timeout-minutes` on every job. Without it a stall is only noticed six
   hours later, by which point the run is worthless and the queue has been
   held. The values are roughly 3x the observed wall time of each job, so a
   slow-but-healthy run is never killed.

2. `UR_APT_OPTS` in the workflow env, threaded through every apt invocation:
   `Acquire::Retries=3` covers the transient 503s the Azure mirrors serve
   under load, and the http/https `Timeout=30` options are what actually
   convert a silent stall into a fast, legible failure. `No-Cache=true`
   keeps a proxy from serving a stale index that then 404s on download.

No dependency versions change and no step is added or removed; this is
entirely about how the existing steps fail.
---
 .github/workflows/build.yml | 30 +++++++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d0cc42c..4eacb37 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -35,11 +35,25 @@ env:
   UR_CONNECT_REF: main
   UR_ZIG_VERSION: "0.14.1"
   DEBIAN_FRONTEND: noninteractive
+  # Layer 2 of the anti-hang fix (layer 1 is timeout-minutes on every job).
+  # apt's DEFAULT is to wait forever on a stalled mirror connection: two runs
+  # died that way -- one an hour on `apt-get install zip`, one six hours split
+  # across the AppImage and Flatpak dependency steps. Different packages, same
+  # cause, so this is bounded at the transport rather than per call site.
+  # Retries covers the transient 503s the azure mirrors serve under load.
+  UR_APT_OPTS: >-
+    -o Acquire::Retries=3
+    -o Acquire::http::Timeout=30
+    -o Acquire::https::Timeout=30
+    -o Acquire::http::No-Cache=true
 
 jobs:
   build-sdk:
     name: SDK (cgo shared objects)
     runs-on: ubuntu-latest
+    # Bounded on purpose: an apt mirror stall used to hang this job
+    # until GitHub's 6h default killed it. Fail in minutes instead.
+    timeout-minutes: 45
     steps:
       - name: Check out the SDK
         uses: actions/checkout@v4
@@ -62,7 +76,7 @@ jobs:
           cache-dependency-path: sdk/cgo/go.sum
 
       - name: Install zip
-        run: sudo apt-get update && sudo apt-get install -y zip
+        run: sudo apt-get $UR_APT_OPTS update && sudo apt-get $UR_APT_OPTS install -y zip
 
       # The Makefile's LINUX_*_CC default to `zig cc -target <arch>-linux-gnu.2.35`,
       # which is what holds the glibc floor the daemon job then asserts.
@@ -104,13 +118,16 @@ jobs:
   daemon:
     name: Daemon + tests (glibc floor)
     runs-on: ubuntu-latest
+    # Bounded on purpose: an apt mirror stall used to hang this job
+    # until GitHub's 6h default killed it. Fail in minutes instead.
+    timeout-minutes: 40
     needs: build-sdk
     container: ubuntu:22.04
     steps:
       - name: Install build dependencies
         run: |
-          apt-get update
-          apt-get install -y --no-install-recommends \
+          apt-get $UR_APT_OPTS update
+          apt-get $UR_APT_OPTS install -y --no-install-recommends \
             build-essential meson ninja-build pkg-config gettext \
             libglib2.0-dev nlohmann-json3-dev ca-certificates git binutils
 
@@ -143,6 +160,9 @@ jobs:
   gui:
     name: GUI (GTK4 + libadwaita + libsecret)
     runs-on: ubuntu-latest
+    # Bounded on purpose: an apt mirror stall used to hang this job
+    # until GitHub's 6h default killed it. Fail in minutes instead.
+    timeout-minutes: 40
     needs: build-sdk
     steps:
       - uses: actions/checkout@v4
@@ -154,8 +174,8 @@ jobs:
 
       - name: Install the GUI stack
         run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends \
+          sudo apt-get $UR_APT_OPTS update
+          sudo apt-get $UR_APT_OPTS install -y --no-install-recommends \
             build-essential meson ninja-build pkg-config gettext \
             libglib2.0-dev nlohmann-json3-dev \
             libgtkmm-4.0-dev libadwaita-1-dev libsecret-1-dev