[TakGN]

Why

The Claude review on ipni/workers#36 failed before Claude ran. In "Install sandbox dependencies", the runner couldn't resolve security.ubuntu.com, and each of the three apt-get update && apt-get install bubblewrap socat rounds failed:

W: Failed to fetch .../dists/resolute-security/InRelease  Temporary failure resolving 'security.ubuntu.com'
E: Failed to fetch .../socat_1.8.1.1-1ubuntu0.1_amd64v3.deb  Temporary failure resolving 'security.ubuntu.com'

Those three rounds took 11 minutes, and the only thing posted on the PR was "Claude review failed to run". bwrap was already on the runner; only socat was missing.

What changes

In the "Install sandbox dependencies" step:

• It installs only the tools that are missing, and calls apt not at all when both are present.
• It first tries the package lists the image already has. Only if that fails does it run apt-get update once and try again.
• apt gets fetch retries and timeouts (Acquire::Retries=2, Acquire::http(s)::Timeout=20, DPkg::Lock::Timeout=60), and the step gets timeout-minutes: 6.
• If the tools still can't be installed, the step fails with an ::error:: that names them and says the mirrors may be unreachable.

The tools are still required. When the install fails, the review still fails, just faster and with a clearer reason.

Checked

• actionlint (with shellcheck) is clean on the changed workflow.
• I ran the step's script against a stubbed sudo apt-get:
  • both tools present: no apt calls;
  • install works from the existing lists: one install;
  • install needs fresh lists: install, update, install;
  • mirrors unreachable: install, update, install, then exit 1 with the error.
• Not yet run on a real runner. The next review in any opted-in repo exercises it.

🤖 Generated with Claude Code