[amv146]

Problem

Fork nightly runs 43048613384 and 43049395137 failed while installing Chromium with --with-deps: Ubuntu's Azure APT mirror repeatedly failed DNS resolution. Browser tests should reuse the pinned browser and avoid downloading system packages already present on the runner.

Validation also exposed inherited CI and Mobile Fingerprint jobs queued indefinitely on Blacksmith runner labels without an assigned runner.

Change

Use upstream's exact Playwright-version/OS/architecture Chromium cache key in the fork PR and nightly jobs, install the headless shell only on cache misses, and run install-deps chromium only when ldd finds missing libraries. Missing browsers, inspection errors, and installation failures still fail the job.

Reuse upstream's prioritized HTTPS APT mirrors and 15-second timeouts before browser/system installs and WSL archive dependencies. Extend the existing source rewrite to cover GitHub-hosted Ubuntu's mirror+file:/etc/apt/apt-mirrors.txt; the reusable Linux desktop workflow already invokes this action.

Add shell-executing regression fixtures and run them in the existing nightly checks. Route all 11 CI/Mobile Fingerprint job definitions to standard ubuntu-24.04 or macos-26 runners only when github.repository == 'amv146/t3code'; every other repository retains its original Blacksmith labels. Provision the same resilient APT mirrors before the newly hosted browser dependency checks.

Merge current fork main without rewriting history. Preserve all test commands, quality gates, shard counts, timeouts, release eligibility/cadence, publication guards, and conflict-only repair routing.

Scope and approval

The fork owner requested this focused repair and authorized the PR. It fixes a reproduced dependency-install failure using the existing upstream approach; it does not propose a product feature or change upstream workflows. Target repository is amv146/t3code, not pingdotgg/t3code. The separate upstream merge conflict in manual retry 43090369259 is outside this PR.

The owner explicitly approved extending this PR to route fork checks to GitHub-hosted runners while preserving upstream's runner choices and all quality gates. No paid runner service or review was activated.

Verification

• node --test .github\scripts\fork-nightly.test.cjs .github\scripts\fork-dependencies.test.cjs — passed, 9 tests. Both new regressions failed before the fix. Fixtures execute the actual shell blocks against isolated sources/browser caches, covering existing libraries, missing libraries, absent browsers, ldd errors, and install failures.
• actionlint .github\workflows\ci.yml .github\workflows\mobile-fingerprint-check.yml .github\workflows\fork-nightly.yml .github\workflows\fork-pr.yml .github\workflows\release-desktop.yml — passed using the cached actionlint 1.7.12 executable.
• A focused Node assertion against origin/main — passed: all 11 job definitions select the matching hosted OS only for the fork; reversing runner expressions and the two fork-guarded APT setup steps reproduces the original workflow files byte-for-byte, preserving upstream runners and every check.
• git --no-pager diff --check — passed.
• vp run check:changed origin/main — blocked before checks could run: the project-local vite-plus package is missing. Offline dependency restore lacked package metadata; normal restore failed with HTTP 404 from the configured corporate registry for @pierre/patches. No registry settings or quality gates were bypassed.

Hosted verification at head 7a0d4e874c88efe64cbb8d310b26eca95392fc74:

• Fork PR validation run 43094859145 — completed successfully on ubuntu-24.04.
• node apps/web/node_modules/playwright/cli.js install --only-shell chromium — passed on a cold cache; Chrome Headless Shell downloaded and the cache was saved under playwright-chromium-shell-Linux-X64-1.64.1. The missing-library check passed without running install-deps.
• vp run check:changed 8a9c8e9b3c5b09f5bc0cb66c8cabf68b15d593fd — passed format, lint, adjacent Vitest checks, and both dependency regression tests.
• CodeRabbit's automatic review of this head completed successfully with no actionable findings.

Final hosted verification at head 5e499cfc7a26d51d9485bd8aa363f7bec4f720c6, including the runner routing and merge of fork main a97596391e96541557bf8bdd05f3c9592264966b:

• CI run 43118825408 — passed, including the final Check gate, all eight server shards, both web shards, build/typecheck, lint, package tests, Rust, release smoke, and native static analysis. Linux jobs ran on ubuntu-24.04; native analysis ran on macos-26.
• Fork PR run 43118825521 — passed. The pinned Chromium cache was restored, the browser download step was skipped, the shared-library check succeeded, and vp run check:changed a97596391e96541557bf8bdd05f3c9592264966b passed.
• Latest Mobile Fingerprint run 43118935249 — passed on the same head, superseding an earlier attempt cancelled by a PR metadata edit.
• CodeRabbit's review of this exact head — passed with no actionable findings.
• Thread-transfer measurements — passed every enforced ceiling; no successful main baseline was available, so this run establishes the initial measurement.

Merged into the fork as 4b70fcb093831e4cac2ec0e696ac7c1ce7c6bb9a. The automatic nightly run 43120402330 started after merge; release publication is not yet verified. Actual APT fallback during a mirror outage remains unverified. This is a workflow-only change; no UI evidence is applicable.

Model: GPT-6.1 Sol (gpt-6.1-sol). Harness: GitHub Copilot through T3 Code's acpRegistry.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The workflows configure APT mirrors, cache Playwright Chromium by runner and Playwright version, and install Chromium system dependencies when needed. CI and mobile fingerprint workflows select runners by repository. Tests cover mirror rewrites and browser dependency outcomes.

Changes: Fork workflow dependency setup

Layer / File(s)	Summary
Configure APT mirrors .github/actions/setup-apt-mirrors/action.yml, .github/scripts/fork-dependencies.test.cjs, .github/workflows/fork-pr.yml, .github/workflows/fork-nightly.yml, .github/workflows/ci.yml	The setup action rewrites Ubuntu sources and mirror+file entries to the Blacksmith mirror. Fork and CI jobs invoke the action before relevant package installation steps. Tests check source rewrites, preservation of unrelated sources, and rerun behavior.
Cache Chromium and check dependencies .github/workflows/fork-pr.yml, .github/workflows/fork-nightly.yml, .github/scripts/fork-dependencies.test.cjs	The fork workflows cache Chromium by runner OS, architecture, and Playwright version. They install it on a cache miss and install system dependencies when ldd reports missing libraries. Tests cover cache and dependency outcomes, failure statuses, and workflow test execution.

CI runner selection

Layer / File(s)	Summary
Select runners by repository .github/workflows/ci.yml, .github/workflows/mobile-fingerprint-check.yml	For amv146/t3code, CI and mobile fingerprint jobs use GitHub-hosted runners. Other repositories retain the specified Blacksmith runners.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Suggested reviewers: juliusmarminge, t3dotgg

Merge Risk: Minimal · up to 5e499

The change reroutes fork CI to GitHub-hosted runners, adds APT mirror failover, and caches Chromium. No concrete merge-blocking defect was identified. Job timings on the smaller runners remain unmeasured.

Architecture risk: Low · up to 5e499

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/actions/setup-apt-mirrors/action.yml: The comment now says the action replaces GitHub and Blacksmith mirror lists, in addition to direct sources.
• observed — Modified behavior in .github/actions/setup-apt-mirrors/action.yml: The rewrite now also redirects mirror+file:/etc/apt/apt-mirrors.txt entries to the Blacksmith mirror list; existing matching archive and security Ubuntu URLs continue to be redirected there.
• observed — Modified behavior in .github/scripts/fork-dependencies.test.cjs: Adds temporary-directory fixture and Bash execution helpers; fixture directories are removed after each test.
• observed — Modified behavior in .github/scripts/fork-dependencies.test.cjs: Adds an APT mirror test that runs the setup action against fixture sources, checks Ubuntu entries and mirror-list URIs are rewritten while unrelated and existing Blacksmith sources remain unchanged, and verifies a second run succeeds.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title "fix(ci): reuse Chromium and fail over Ubuntu mirrors" is a conventional commit title that names the two main changes in the changeset: a Chromium cache with conditional install and dependen…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description follows the repository template. It states the problem, the change, the scope and approval, and the verification performed. The problem section cites failed fork nightly runs caused by…

Full details: Title check

Explanation

The title "fix(ci): reuse Chromium and fail over Ubuntu mirrors" is a conventional commit title that names the two main changes in the changeset: a Chromium cache with conditional install and dependency checks, and prioritized APT mirror setup with a source rewrite. It is specific and matches the PR objectives. It does not cover every detail, such as the regression tests or the runner-selection changes in ci.yml, which is acceptable.

Full details: Description check

Explanation

The description follows the repository template. It states the problem, the change, the scope and approval, and the verification performed. The problem section cites failed fork nightly runs caused by Ubuntu Azure APT mirror DNS failures. The change section lists the cache key, the conditional install, the APT mirror routing, the new regression fixtures, and the runner routing. The scope section links the owner's authorization and states that no upstream workflow is changed. The verification section lists commands, pass and fail results, a hosted run, and items left unverified. Gaps remain. The Problem section keeps the template placeholder comment and does not state expected behavior. The Scope section does not link a triaged issue or a discussion with an approval comment. It relies on an owner authorization statement instead. The verification section says a fresh hosted run is pending for the current head, so the current head is not yet verified. The description also does not clearly state the model and harness in the template's expected form, though it does provide them. These gaps are not critical. The description is mostly complete.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: amv146/t3code
• Branch: fork/upstream-ci-dependency-resilience
• File: .coderabbit.config.ts
• Commit: 5e499cf
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: d337b2f5-d312-49db-ac62-ff6b49a60fd9

Commits

Reviewing files that changed from the base of the PR and between 7a0d4e8 and 5e499cf.

Files selected for processing: 2

• .github/workflows/ci.yml
• .github/workflows/mobile-fingerprint-check.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

ℹ️ No successful main baseline artifact is available yet. This run establishes the initial measurement.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Codex	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Codex	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Codex	Live turn WebSocket decoded	—	21.5 KiB	—	24.4 KiB	✅
Codex	Live turn messages	—	1	—	8	✅
Claude	Total thread wire	—	5.0 KiB	—	6.8 KiB	✅
Claude	Thread snapshot wire	—	3.8 KiB	—	4.9 KiB	✅
Claude	Live turn WebSocket wire	—	1.2 KiB	—	2.0 KiB	✅
Claude	Live turn WebSocket decoded	—	21.9 KiB	—	24.4 KiB	✅
Claude	Live turn messages	—	1	—	8	✅

Baseline: unavailable · PR result: 5e499cf · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 108.5 KiB
• Claude decoded thread snapshot: 108.8 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.