fix(ci): bound pinned Pi tool installation

.github/actions/ci-cli-coverage-shard/action.yaml

@@ -60,26 +60,7 @@ runs:
         RIPGREP_VERSION: "14.1.0-1"
       run: |
         set -euo pipefail
-        apt_network_options=(
-          -o Acquire::Retries=2
-          -o Acquire::http::Timeout=20
-          -o Acquire::https::Timeout=20
-        )
-        for attempt in 1 2 3; do
-          if sudo timeout --signal=TERM --kill-after=10s 120s apt-get \
-            "${apt_network_options[@]}" update \
-            -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" \
-            -o Dir::Etc::sourceparts="-"; then
-            break
-          fi
-          if [ "$attempt" -eq 3 ]; then
-            echo "::error::Could not update pinned Pi search-tool package indexes after three bounded attempts"
-            exit 1
-          fi
-          echo "::warning::Retrying pinned Pi search-tool package index update (attempt $((attempt + 1))/3)"
-        done
-        sudo timeout --signal=TERM --kill-after=10s 180s apt-get \
-          "${apt_network_options[@]}" install -y --no-install-recommends \
+        bash "$GITHUB_ACTION_PATH/../ci-install-pinned-ubuntu-packages.sh" --retry-transient-update \
           "fd-find=${FD_FIND_VERSION}" \
           "ripgrep=${RIPGREP_VERSION}"
 

.github/actions/ci-install-pinned-ubuntu-packages.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+set -euo pipefail
+
+update_attempts=1
+update_timeout=300s
+install_timeout=300s
+acquire_timeout=30
+if [ "${1:-}" = --retry-transient-update ]; then
+  update_attempts=3
+  update_timeout=120s
+  install_timeout=180s
+  acquire_timeout=20
+  shift
+fi
+
+if [ "$#" -eq 0 ]; then
+  echo "::error title=Missing APT packages::Provide pinned package=version specifications." >&2
+  exit 2
+fi
+for package_spec in "$@"; do
+  if [[ ! "$package_spec" =~ ^[A-Za-z0-9][A-Za-z0-9.+-]*(:[A-Za-z0-9][A-Za-z0-9.+-]*)?=[^[:space:]=]+$ ]]; then
+    echo "::error title=Unpinned APT package::Expected package=version." >&2
+    exit 2
+  fi
+done
+
+ubuntu_sources=/etc/apt/sources.list.d/ubuntu.sources
+if ! sudo test -f "$ubuntu_sources" || ! sudo test -r "$ubuntu_sources"; then
+  echo "::error title=Missing Ubuntu APT source::Expected readable $ubuntu_sources." >&2
+  exit 1
+fi
+if [ -z "${RUNNER_TEMP:-}" ] || [ ! -d "$RUNNER_TEMP" ]; then
+  echo "::error title=Missing runner temporary directory::RUNNER_TEMP must be a directory." >&2
+  exit 1
+fi
+
+runner_temp_mode="$(stat -c '%a' "$RUNNER_TEMP")"
+apt_lists="$(mktemp -d "$RUNNER_TEMP/nemoclaw-apt-lists.XXXXXXXX")"
+cleanup() {
+  local status=$?
+  trap - EXIT
+  sudo rm -rf -- "$apt_lists" || status=1
+  sudo chmod "$runner_temp_mode" "$RUNNER_TEMP" || status=1
+  exit "$status"
+}
+trap cleanup EXIT
+
+# APT's _apt user needs traversal into the isolated package-list directory.
+sudo chmod o+x "$RUNNER_TEMP"
+sudo chmod 0755 "$apt_lists"
+sudo install -d -o _apt -g root -m 0700 "$apt_lists/partial"
+
+apt_options=(
+  -o "Dir::Etc::sourcelist=$ubuntu_sources"
+  -o "Dir::Etc::sourceparts=-"
+  -o "Dir::State::lists=$apt_lists"
+  -o "Acquire::http::Timeout=$acquire_timeout"
+  -o "Acquire::https::Timeout=$acquire_timeout"
+)
+if [ "$update_attempts" -gt 1 ]; then
+  apt_options+=(-o "Acquire::Retries=2")
+fi
+
+run_apt() {
+  local operation="$1"
+  local duration="$2"
+  local attempt="$3"
+  local total="$4"
+  shift 4
+  local log status
+  log="$(mktemp "$RUNNER_TEMP/nemoclaw-apt-${operation}.XXXXXXXX")"
+  echo "Installing pinned Pi tools: APT $operation started (attempt $attempt/$total)."
+  if { sudo timeout -k 10s "$duration" apt-get "${apt_options[@]}" "$@"; } >"$log" 2>&1; then
+    rm -f -- "$log"
+    echo "Installing pinned Pi tools: APT $operation completed."
+    return 0
+  else
+    status=$?
+  fi
+  if [ "$status" -eq 124 ]; then
+    if [ "$operation" = update ] && [ "$attempt" -lt "$total" ]; then
+      echo "::warning title=APT update timed out::Ubuntu package update exceeded $duration on attempt $attempt/$total; retrying the idempotent metadata update." >&2
+    else
+      echo "::error title=APT $operation timed out::Ubuntu package $operation exceeded $duration on attempt $attempt/$total." >&2
+    fi
+  elif [ "$status" -eq 137 ]; then
+    echo "::error title=APT $operation was force-killed::Ubuntu package $operation exited with status 137 on attempt $attempt/$total; it may have exceeded $duration and been killed by timeout." >&2
+  else
+    echo "::error title=APT $operation failed::Ubuntu package $operation exited with status $status on attempt $attempt/$total." >&2
+  fi
+  tail -c 8192 "$log" | tail -n 60 >&2
+  rm -f -- "$log"
+  return "$status"
+}
+
+for ((attempt = 1; attempt <= update_attempts; attempt++)); do
+  if run_apt update "$update_timeout" "$attempt" "$update_attempts" update; then
+    break
+  else
+    status=$?
+  fi
+  if [ "$status" -ne 124 ] || [ "$attempt" -eq "$update_attempts" ]; then
+    exit "$status"
+  fi
+done
+run_apt install "$install_timeout" 1 1 install -y --no-install-recommends "$@"

.github/workflows/pr-review-advisor.yaml

@@ -217,10 +217,8 @@ jobs:
       - name: Install locked runtime
         run: |
           set -euo pipefail
-          sudo apt-get update -qq \
-            -o Dir::Etc::sourcelist="sources.list.d/ubuntu.sources" \
-            -o Dir::Etc::sourceparts="-"
-          sudo apt-get install -y --no-install-recommends "fd-find=${FD_FIND_VERSION}" "ripgrep=${RIPGREP_VERSION}"
+          bash "$ADVISOR_DIR/.github/actions/ci-install-pinned-ubuntu-packages.sh" \
+            "fd-find=${FD_FIND_VERSION}" "ripgrep=${RIPGREP_VERSION}"
           test "$(dpkg-query -W -f='${Version}' fd-find)" = "$FD_FIND_VERSION"
           test "$(dpkg-query -W -f='${Version}' ripgrep)" = "$RIPGREP_VERSION"
           (cd "$ADVISOR_DIR" && npm ci --ignore-scripts --no-audit --no-fund)

.github/workflows/pr.yaml

@@ -582,6 +582,8 @@ jobs:
       - name: Checkout trusted CI actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          # PR shards run the base action. The revised action and sibling installer
+          # first run together after both land on main.
           ref: ${{ github.event.pull_request.base.sha }}
           path: .trusted-ci-actions
           persist-credentials: false
@@ -590,6 +592,7 @@ jobs:
             .github/actions/ci-build-typecheck
             .github/actions/ci-compile-artifacts
             .github/actions/ci-cli-coverage-shard
+            .github/actions/ci-install-pinned-ubuntu-packages.sh
             .github/actions/ci-cli-coverage-merge
             .github/actions/ci-plugin-coverage
             .github/actions/ci-installer-integration