From 239f0a30a1dfd09b7a270a0c4c34e894e9c5727b Mon Sep 17 00:00:00 2001
From: abrichr <richard.abrich@mldsai.com>
Date: Wed, 19 Aug 2026 15:50:38 -0400
Subject: [PATCH] ci: bound the apt install and prefer the canonical Ubuntu
 archive

The hosted runner resolves its Ubuntu mirror through /etc/apt/apt-mirrors.txt,
which points at azure.archive.ubuntu.com. That mirror fails intermittently and
apt spends minutes of retries before it falls back, so an unbounded package
step can consume a whole run: in openadapt-flow a TeX install ran 3h11m and hit
the run limit, and in openadapt-capture a test job ran over an hour on main.

headed-pixel-campaign has a 15-minute job budget but the X11 fixture step had
no bound of its own, so one hung apt call could spend all 15 minutes and the
campaign -- the point of the job -- would never run. Bound the step to 5
minutes and prefer the canonical archive.

Five minutes is a wide margin: the equivalent apt step in openadapt-capture
takes 19s, and 5 minutes still covers three update attempts plus 30s of backoff
while leaving at least 10 of the 15 job minutes for `uv sync` and the campaign.

The package list, the `command -v` guard that skips apt when the tools already
exist, and the trailing tkinter check are unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/complex-visual.yml | 32 +++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/complex-visual.yml b/.github/workflows/complex-visual.yml
index 759cb61..5c0906d 100644
--- a/.github/workflows/complex-visual.yml
+++ b/.github/workflows/complex-visual.yml
@@ -36,11 +36,41 @@ jobs:
         run: uv sync --locked --extra dev --no-sources
 
       - name: Ensure local X11 fixture tools
+        # The job budget is 15 minutes and the campaign itself is the point of
+        # it. Without a step bound, one hung apt call consumes all 15 and the
+        # real work never runs. The equivalent apt step in openadapt-capture
+        # takes 19s, so 5 minutes covers three update attempts plus 30s of
+        # backoff with wide margin, and leaves at least 10 minutes for the
+        # dependency install and the campaign.
+        timeout-minutes: 5
         run: |
+          set -uo pipefail
           if ! command -v Xvfb >/dev/null || ! command -v xvfb-run >/dev/null; then
-            sudo apt-get update
+            # The hosted runner resolves its Ubuntu mirror through
+            # /etc/apt/apt-mirrors.txt, which points at azure.archive.ubuntu.com.
+            # That mirror fails intermittently, and each failure costs minutes of
+            # apt retries. Prefer the canonical archive. Best-effort: an absent
+            # or already-canonical file changes nothing.
+            sudo sed -i \
+              's|http://azure.archive.ubuntu.com/ubuntu|http://archive.ubuntu.com/ubuntu|g' \
+              /etc/apt/apt-mirrors.txt 2>/dev/null || true
+            update_ok=""
+            for attempt in 1 2 3; do
+              if sudo apt-get update; then
+                update_ok=1
+                break
+              fi
+              echo "::warning::apt-get update failed (attempt ${attempt}/3); retrying"
+              sleep $((attempt * 10))
+            done
+            if [ -z "$update_ok" ]; then
+              echo "::error::apt-get update failed three times; the Ubuntu mirror is unreachable"
+              exit 1
+            fi
+            set -e
             sudo apt-get install --yes xvfb xauth
           fi
+          set -e
           python -c 'import tkinter'
 
       - name: Create dedicated actor identity