ci: harden apt refreshes

Author: { "message": "Bad credentials", "documentation_url": "https://docs.github.com/rest", "status": "401"}

.github/actions/setup/action.yml

@@ -24,8 +24,19 @@ runs:
     - name: Install OpenSSH client
       shell: bash
       run: |
-        sudo apt-get update
-        sudo apt-get install -y openssh-client
+        for attempt in 1 2 3; do
+          sudo rm -rf /var/lib/apt/lists/*
+          if sudo apt-get -o Acquire::Retries=3 -o Acquire::By-Hash=force update; then
+            break
+          fi
+          if [[ "$attempt" == "3" ]]; then
+            echo "apt-get update failed after retries" >&2
+            exit 1
+          fi
+          echo "apt-get update attempt ${attempt} failed; retrying..." >&2
+          sleep $((attempt * 2))
+        done
+        sudo apt-get -o Acquire::Retries=3 install -y openssh-client
     - name: Install node-gyp
       shell: bash
       run: npm install -g node-gyp

packages/api/Dockerfile

@@ -9,7 +9,22 @@ ENV BUN_INSTALL=/opt/bun
 ENV PATH=/opt/bun/bin:$PATH
 WORKDIR /workspace
 
-RUN apt-get update && apt-get install -y --no-install-recommends \
+RUN set -eu; \
+  sed -i 's|http://archive.ubuntu.com/ubuntu|http://azure.archive.ubuntu.com/ubuntu|g' \
+    /etc/apt/sources.list /etc/apt/sources.list.d/ubuntu.sources 2>/dev/null || true; \
+  for attempt in 1 2 3; do \
+    rm -rf /var/lib/apt/lists/*; \
+    if apt-get -o Acquire::Retries=3 -o Acquire::By-Hash=force update; then \
+      break; \
+    fi; \
+    if [ "$attempt" = "3" ]; then \
+      echo "apt-get update failed after retries" >&2; \
+      exit 1; \
+    fi; \
+    echo "apt-get update attempt ${attempt} failed; retrying..." >&2; \
+    sleep $((attempt * 2)); \
+  done; \
+  apt-get -o Acquire::Retries=3 install -y --no-install-recommends \
     ca-certificates curl git docker.io docker-compose-v2 openssh-client sshpass python3 make g++ unzip \
  && rm -rf /var/lib/apt/lists/*
 

packages/app/src/lib/core/templates/dockerfile.ts

@@ -11,7 +11,7 @@ ENV NVM_DIR=/usr/local/nvm
 RUN set -eu; \
   for attempt in 1 2 3 4 5; do \
     rm -rf /var/lib/apt/lists/*; \
-    if apt-get -o Acquire::Retries=3 update; then \
+    if apt-get -o Acquire::Retries=3 -o Acquire::By-Hash=force update; then \
       break; \
     fi; \
     if [ "$attempt" = "5" ]; then \

packages/lib/src/core/templates/dockerfile.ts

@@ -10,7 +10,7 @@ ENV NVM_DIR=/usr/local/nvm
 RUN set -eu; \
   for attempt in 1 2 3 4 5; do \
     rm -rf /var/lib/apt/lists/*; \
-    if apt-get -o Acquire::Retries=3 update; then \
+    if apt-get -o Acquire::Retries=3 -o Acquire::By-Hash=force update; then \
       break; \
     fi; \
     if [ "$attempt" = "5" ]; then \