enhancement(ci): cache libsasl2 packages to avoid flaky apt - #26156
enhancement(ci): cache libsasl2 packages to avoid flaky apt#26156thomasqueirozb wants to merge 4 commits into
Conversation
thomasqueirozb
added
the
no-changelog
github-actions
Bot
added
the
domain: ci
thomasqueirozb
added
no-changelog
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f13286d942
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
pront
left a comment
pront
left a comment
There was a problem hiding this comment.
We should do something like the warm-cache.yaml but for deps (for now libsasl2). The schedule should be different though. I will leave out the details to you and come back to review later.
| echo "Installing libsasl2 from cached packages" | ||
| if ! install_from_cache; then | ||
| echo "Cached packages could not be installed, falling back to apt" | ||
| timeout 30m sudo apt-get update |
There was a problem hiding this comment.
I suggest adding something like this early in the composite action:
sudo tee /etc/apt/apt.conf.d/99-vector-ci >/dev/null <<'EOF'
Acquire::Retries "3";
Acquire::http::Timeout "30";
Acquire::https::Timeout "30";
DPkg::Lock::Timeout "60";
EOF
This way we can delete repeated ad-hoc timeouts.
There was a problem hiding this comment.
Acquire::Retries "3" is the default apt config value. We should never hit DPkg::Lock::Timeout "60"; on CI though. RE Acquire::http::Timeout "30"; and Acquire::https::Timeout "30"; both are per-connection idle timeouts, not a cap on total download time and also they're the apt defaults. The timeout 30m here is doing a separate job that cannot be replaced by these flags
There was a problem hiding this comment.
We can at least do something like:
apt_get_with_timeout() {
timeout 30m sudo apt-get "$@"
}
There was a problem hiding this comment.
Summary
- Added an
apt_get_with_timeouthelper that consistently applies the existing 30-minute timeout andsudo apt-getinvocation. .github/actions/setup/action.ymlL220-L224 - Updated the cached-package recovery, package-index update, and package-download paths to use the shared helper, removing repeated ad hoc timeout commands. .github/actions/setup/action.ymlL244-L261
- Committed the change as
07019f6(ci: centralize apt timeout handling). - Prepared pull-request metadata with the title “ci: centralize apt timeout handling for libsasl2” and a body based on the repository PR template.
- Preserved the pre-existing, unrelated deletion of
rust-toolchain.toml; it was not included in the commit.
Testing
- ✅
ruby -e 'require "yaml"; YAML.load_file(".github/actions/setup/action.yml", aliases: true); puts "YAML parsed"' - ✅
python3 - <<'PY' ... PY— verified the repeated direct timeout commands were removed and all libsasl2 APT operations use the helper. - ✅
git diff --check - ✅
git show --stat --oneline HEAD ⚠️ gh pr list --head "$(git branch --show-current)" --state open --json number,url— GitHub CLI authentication is unavailable in the environment.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 44ef2ccf2e
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Can't wait for the next one! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 28bbc600e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - name: Delete stale libsasl2 cache | ||
| run: | | ||
| set -euo pipefail | ||
| ids=$(gh api --method GET "repos/${{ github.repository }}/actions/caches" -f key="Linux-libsasl2-" -f per_page=100 --jq '.actions_caches[].id') |
There was a problem hiding this comment.
On both scheduled and manual runs, this clean GitHub-hosted runner has no stored gh credentials, and the job never exposes github.token as GH_TOKEN or GITHUB_TOKEN; therefore the first gh api invocation exits for lack of authentication and the setup step never re-warms the cache. gh help environment confirms that GH_TOKEN/GITHUB_TOKEN supplies authentication, so pass the job token through the step's env in addition to granting actions: write.
Useful? React with 👍 / 👎.
| if compgen -G "$DEBS_DIR"/*.deb > /dev/null; then | ||
| echo "Installing libsasl2 from cached packages" |
There was a problem hiding this comment.
When this cache-hit branch runs on a release builder with missing or outdated apt indexes, setup no longer executes the apt-get update that the previous implementation always performed. The build-linux-cross job in .github/workflows/publish.yml then immediately runs apt-get install for the cross-compilation tools at line 168 without updating first, so releases can fail with unavailable-package or stale-index download errors even though libsasl2 installation succeeded; update the indexes in that workflow or retain the refresh before later apt consumers.
Useful? React with 👍 / 👎.
2 participants
Summary
Cache the libsasl2 .deb packages in the CI setup action so installing them no longer depends on a flaky
apt-get update. On cache hit, installs viadpkg -ifrom the cached packages; on miss, downloads the full dependency closure viaapt-get download.References
NA
Vector configuration
NA
How did you test this PR?
Verified the install logic in an Ubuntu 24.04 container (cache-miss, cache-hit offline, version-guard idempotency) and end-to-end on real GitHub runners in vectordotdev/ci-sandbox (cache miss -> save, cache hit -> restore, key rotation -> restore-keys fallback).
Also re-ran clippy to grab a cached version of libsasl2. Run: https://github.com/vectordotdev/vector/actions/runs/32284131167/job/96197673338?pr=26156
Is this a breaking change?
Does this PR include user facing changes?
no-changeloglabel to this PR.Contributor Guidelines
@vectordotdev/vectorto reach out to us regarding this PR.pre-pushhook (template) or run the following locally before pushing:make fmtmake check-clippy(auto-fix withmake clippy-fix)make testgit merge origin masterandgit push.Cargo.lock), pleaserun
make build-licensesto regenerate the license inventory and commit the changes (if any). More details on the dd-rust-license-tool.