ci: dependabot config, scanning, and a fix for hanging Linux jobs - #425
Merged
Conversation
Linux jobs intermittently stalled in "Install Linux dependencies" and ran until the job timeout. The hosted runner mirrorlist points apt at azure.archive.ubuntu.com, which is regularly unreachable; apt falls back to archive.ubuntu.com and can trickle bytes indefinitely. Nothing failed the step: it had no timeout-minutes and apt had no acquire timeout. Two runs were stuck this way at once, on different Node versions (26 and 24), which rules out anything version specific. - add timeout-minutes: 20 to the three Linux setup steps - run apt under `timeout` with explicit Acquire timeouts and retries, and retry `apt-get update` up to three times - drop gcc-10/g++-10 from the test workflow: ~48 MB out of noble universe via the same flaky mirror, and binding.gyp only pins that toolchain when it finds it on PATH, so the default gcc covers the -std=c++20 it asks for. prebuild.yml keeps the pin for ABI compatibility of published binaries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
"Create test databases" failed intermittently with: Sqlcmd: Error: Microsoft ODBC Driver 18 for SQL Server : Login failed for user 'sa'. potatoqualitee/mssqlsuite reports success after a fixed 10s sleep plus a `docker ps` check. On a slow first boot that lands while the container is still running its upgrade steps - the log for the failing job shows it was literally still at "Starting up database 'model_msdb'" when the action declared the server accessible, and sqlcmd was rejected 0.6s later. Replace the fixed sleep with a poll for a login that actually succeeds, up to two minutes, dumping container logs if it never does. The Windows job had the same fixed-sleep guess, so it gets the same treatment. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The apt hardening stopped Linux jobs hanging, but a leg that draws a bad runner still crawls: one Node 24 job spent 16m25s in this step while its siblings finished the same step in 88 seconds. It got there by burning `timeout 300` retries against a mirror that was not serving. The remaining dependency on that mirror is small. Once gcc-10 was dropped, the only packages still coming from the ubuntu archive are unixodbc-dev and about five deps - roughly 350 KB, all from main. Everything else comes from packages.microsoft.com, which is fast in every run we have logs for. So the step was dragging 11 MB of package indexes across a broken mirror in order to install 350 KB. Refresh only the Microsoft repo and let the ubuntu packages resolve from the lists the runner image already ships (a healthy run shows these as "Hit:" lines). Only if that install fails do we pay for a full apt-get update, with the existing retry loop behind it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rolls up the CI/supply-chain work on this branch, plus a fix for the Linux job hangs seen on the dependabot PRs.
The hang
Linux test jobs intermittently stalled in
Install Linux dependenciesand ran until the 6 hour job limit. Two runs were stuck at once on different Node versions (26 on #414, 24 on #422), which rules out anything version specific.The hosted runner mirrorlist points apt at
azure.archive.ubuntu.com. When that is unreachable apt falls back toarchive.ubuntu.com, which can trickle bytes indefinitely. Nothing failed the step: it had notimeout-minutes, and apt had no acquire timeout. Even healthy runs spent 5-12 minutes here, and the successful legs still fell back toarchive.ubuntu.comfor the actual.debs.Changes
timeout-minutes: 20on the three Linux setup steps, so a stall fails fast instead of burning a runner for hourstimeoutwith explicitAcquire::*::TimeoutandAcquire::Retries, andapt-get updateretries up to three times. The outertimeoutis the part that matters -- apt's own timeouts only fire on a stalled socket, not on a slow tricklegcc-10/g++-10dropped fromtest.yml. They pull ~48 MB out of noble universe via the same flaky mirror, andbinding.gyponly pins that toolchain when it finds it onPATH, so the default gcc covers the-std=c++20it asks for.prebuild.ymlkeeps the pin, where the older toolchain matters for ABI compatibility of published binariesAlso on this branch: dependabot config, npm audit workflow, CodeQL, and pinned overrides for 12 dev-only advisories.
Validation
This PR's own Linux jobs exercise the fixed workflow, since
pull_requestruns use the workflow file from the head branch.🤖 Generated with Claude Code