Description

Problem: Ubuntu apt mirror desync failures account for 26% (~17 runs) of the 64 Setup Environment CI failures on main over 30 days (Mar 16 – Apr 16, 2026). The failure signature is apt-get update failing with File has unexpected size ... Mirror sync in progress? when Ubuntu mirrors are mid-sync. Additionally, dpkg lock contention on Cirrus self-hosted runners caused ~2% (~1 run) of failures.

All failures are 100% transient network/infrastructure issues — zero are caused by missing packages, version conflicts, or configuration errors. See INFRA-3580 for the full root cause analysis.

Solution:

1. setup-e2e-env/action.yml — Wrap apt-get update + apt-get install in nick-fields/retry (3 attempts, 30s wait, 3min timeout per attempt), matching the existing repo pattern already used 3 times in the same file. Add -o DPkg::Lock::Timeout=120 to handle dpkg lock contention on Cirrus runners. Add on_retry_command: sudo apt-get clean to clear cached/corrupt package lists before each retry.

2. create-release-draft.yml — Remove unnecessary apt update && apt install gh. GitHub CLI (gh) is pre-installed on all ubuntu-latest runner images (v2.89.0 on both Ubuntu 22.04 and 24.04 per actions/runner-images).

Data-backed design decisions:

• Full "Set up E2E environment" composite action takes 99-160s (median 139s) across 15 samples from 5 recent runs. The apt step alone is ~5-15s in the happy path.
• timeout_minutes: 3 per attempt — apt takes 5-15s normally; even with a 120s dpkg lock wait the worst case is ~135s. 3 min is 12-36x the happy path while avoiding a 5-min wait on true hangs.
• retry_wait_seconds: 30 gives mirrors time to finish syncing (typically resolves in <60s).
• on_retry_command: sudo apt-get clean clears cached/corrupt package lists before each retry so apt-get update fetches fresh data from mirrors.
• DPkg::Lock::Timeout=120 has zero cost when no lock contention exists (the normal case). Needed because Android E2E runs on Cirrus self-hosted runners (ghcr.io/cirruslabs/ubuntu-runner-amd64:24.04-lg) where background unattended-upgrades or apt-daily can hold the dpkg lock.

Changelog

CHANGELOG entry: null

Related issues

Fixes: INFRA-3580 (partial — addresses Ubuntu apt mirror desync and dpkg lock contention sub-causes)

Manual testing steps

Feature: CI resilience for apt package installation

  Scenario: Android E2E setup completes successfully with retry logic
    Given a PR triggers Android E2E smoke tests on CI

    When the setup-e2e-env composite action runs on a Cirrus Linux runner
    Then the "Install required emulator dependencies" step uses nick-fields/retry
    And apt-get commands include DPkg::Lock::Timeout=120
    And transient apt mirror failures are retried up to 3 times with 30s wait

  Scenario: Release draft workflow no longer depends on apt
    Given a release tag triggers the create-release-draft workflow

    When the "Setup GitHub CLI" step runs
    Then it only runs gh auth login (no apt install)
    And the pre-installed gh CLI on ubuntu-latest is used directly

Screenshots/Recordings

N/A — CI workflow changes only, no UI impact.

Before

N/A

After

N/A

Pre-merge author checklist

• I've followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards. (N/A — CI workflow YAML only, no application code changes)
• I've completed the PR template to the best of my ability
• I've included tests if applicable (N/A — CI workflow configuration, validated by CI run on this PR)
• I've documented my code using JSDoc format if applicable (N/A — CI workflow YAML, no code)
• I've applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.