From dc18936048356af4b1f76f35d07c1ffac8925642 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sat, 31 Oct 2026 20:29:31 -0400
Subject: [PATCH] fix(ci): bound runner isolation's apt calls so a stall fails,
 not hangs

setup-runner-isolation ran `apt-get update` and `install` with no timeout.
Since 2026-10-31T22:51Z every pr-verify and pr-review-main job that runs it
has sat in "Isolate the runner" until its job timeout, so no verify verdict
lands. Each apt call now runs under `timeout 180` with Acquire and dpkg-lock
timeouts, and an image that already ships bwrap and socat skips apt. A run
that still cannot install fails closed, as before, and the lost-run
reconciler re-runs it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/actions/setup-runner-isolation/action.yml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/actions/setup-runner-isolation/action.yml b/.github/actions/setup-runner-isolation/action.yml
index 4067e364579..42600e89dc4 100644
--- a/.github/actions/setup-runner-isolation/action.yml
+++ b/.github/actions/setup-runner-isolation/action.yml
@@ -23,10 +23,18 @@ runs:
       if: inputs.install-subprocess-isolation == 'true'
       shell: bash
       run: |
+        # Each apt call is bounded, so a stalled mirror or held lock fails this
+        # step in minutes instead of holding the job to its timeout; a run that
+        # cannot install fails closed below. An image that already ships both
+        # tools skips apt.
+        apt=(-o Acquire::Retries=2 -o Acquire::http::Timeout=30 -o Acquire::https::Timeout=30 -o DPkg::Lock::Timeout=60)
         for i in 1 2 3; do
-          sudo apt-get update -qq &&
-            sudo apt-get install -y --no-install-recommends bubblewrap socat && break
-          echo "apt-get attempt $i failed, retrying..."
+          if command -v bwrap >/dev/null && command -v socat >/dev/null; then
+            break
+          fi
+          timeout 180 sudo apt-get "${apt[@]}" update -qq &&
+            timeout 180 sudo apt-get "${apt[@]}" install -y --no-install-recommends bubblewrap socat && break
+          echo "apt-get attempt $i failed or timed out, retrying..."
           sleep 5
         done
         # Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor.