Harden two transient CI build and test flakes - #727
Merged
Conversation
…e build (stage build, shellcheck, and hadolint pass; the retry branch itself is unexercised; CI build-image hardening)
… (count=20 targeted run plus full testkit and repo suites pass; test-only fixture-safety fix)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Owner
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
This was referenced Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Both issues below are pre-existing, transient CI flakes (they cleared on rerun), not regressions. This lane is about to become a required merge gate, so both are worth hardening now.
The Go tarball download in the container-smoke build's apt-broker-builder stage (runtime/container/Dockerfile) used a node one-liner fetch with no retry. A single transient network blip failed the whole image build. It now retries up to 5 times with backoff, cleaning the partial download between attempts, mirroring the retry-loop shape the Debian-snapshot fetch already uses elsewhere in the same file. The sha256 integrity check still runs only after a completed download, and only after a final failed attempt does the build fail hard. Versions, SHAs, and URLs are unchanged. internal/metadatautil/pinnedinputs_docker.go carries a literal copy of this stage for pin review, so it moved in lockstep.
TestVerifyReleaseOutputsRejectsSymlinkedAssetsDir intermittently failed with ETXTBSY ("text file busy") when exec'ing a freshly written driver script. The race window was that a fixture script's exec bit was set at file-creation time (mode 0o755) rather than after the write was fully closed, so the executable bit and an open writable file description could momentarily coexist on the inode. internal/testkit's shared writeExecutable helper now writes at 0o644, lets the writer close, then chmods to 0o755, guaranteeing the write closes before the file becomes executable and before it is exec'd. Four call sites in internal/testkit/release_outputs_verify_test.go that built their own driver/stub scripts inline now route through this helper instead of duplicating the old write-with-mode pattern.