[botandbang]

What and why

locallibrary / budgets on #468 spent 11 min 58 s fetching 23.6 MB from Ubuntu's Azure mirror at 32.9 kB/s, for libasound2-dev and valgrind, in a 15-minute job. It's the same stall as LOC-231, and that job has run on every Rust pull request since #462. Almost every other Rust job runs apt-get for ALSA too, so they're exposed the same way, with less to fetch. taiki-e/install-action has only cargo-valgrind, a wrapper that still needs Valgrind, and these packages have to come from somewhere, so the fix is to fetch them once.

Added

• .github/actions/apt-packages. It restores ~/apt-packages from the Actions cache, keyed on $ImageVersion and the package list. On a miss it runs apt-get update and apt-get install --download-only into that folder and saves it. Then it installs with dpkg -i, with no apt-get on a hit.
• The action's path in the locallibrary filter in ci.yml, so a change to it runs the jobs that use it.

Changed

• All 14 apt-get steps use the action: release-budgets, seven in locallibrary-ci.yml, one in locallibrary-bench.yml, four in locallibrary-scheduled.yml and one in mix-report.yml.

Removed

Nothing.

The key has the runner image in it because the image fixes what's already installed. That's what lets dpkg -i skip resolving anything: the files in the folder are what apt-get chose on that same image.

Why not awalsh128/cache-apt-pkgs-action

It's the maintained action for this, and I read it at v1.6.3 (553a35bb8). A cache hit does skip the mirror, but two things rule it out:

• Pinning it doesn't pin what it runs. On a miss it runs curl of apt-fast's master branch through bash, in a job that has sudo. A commit SHA in our workflow leaves that script free to change, and zizmor can't see it.
• Its cache key doesn't include the runner image. It restores files with tar over /, so a new image can get files built for an older one. Valgrind is where that bites: libc6-dbg has to match the image's libc6, and its version isn't one we name. The version input could carry the image, but that takes a step at every call site.

Lesser points: it doesn't register what it restores with dpkg, and runs install scripts only on request, which its README says isn't guaranteed to work. It runs a prebuilt apt_query binary from its repository each time. Its last release was 2026-06-30, v1 is in maintenance mode and its README asks for co-maintainers. I didn't run it on Ubuntu 26.04, and found no issue about it there.

If it drops the curl and adds the image to its key, it's worth swapping in: the call sites only pass packages.

What still reaches the mirror

A new image misses the cache, so the first job per package list on each image still asks the mirror, and can still stall. Pull requests read main's cache but write their own, so the jobs on main are what fill it for everyone.

How it was tested

On ubuntu:26.04 with Python and Perl added, as the runner has them: the download step fetched libasound2-dev valgrind (53 files, 37 MB), then a new container with --network none installed them with dpkg -i. Valgrind 3.26.0 and alsa/asoundlib.h were there and dpkg --audit was clean. On the bare image, without Python, dpkg -i failed on python3-minimal's pre-dependency, so a package list that brings in Python on an image without it would fail here. The runner has it.

tools/policy.sh passes 52 of 52, and actionlint and zizmor have no findings. This pull request's run exercises the miss path. Rerunning a job on it exercises the hit path.

[github-actions]

Coverage Report for apps/localtoolbox

Status	Category	Percentage	Covered / Total
🟢	Lines	100% (🎯 100%) 🟰 ±0 pp	4430 / 4430
🟢	Statements	100% (🎯 100%) 🟰 ±0 pp	6009 / 6009
🟢	Functions	100% (🎯 100%) 🟰 ±0 pp	1759 / 1759
🟢	Branches	98.59% (🎯 50%) 🟰 ±0 pp	2875 / 2916

File Coverage

No changed files found.

Generated in workflow #429 for commit d3cdbea by the Vitest Coverage Report Action

Size

Compared with main. KiB are 1,024 bytes.

	This pull request	main	Change
Packaged (localtoolbox.zip)	359 KiB	359 KiB	-6 B (-0%)
Unpacked (dist/)	806.4 KiB	806.4 KiB	0 B (0%)

[github-actions]

Coverage Report for apps/web

Status	Category	Percentage	Covered / Total
🟢	Lines	99.55% (🎯 99%) 🟰 ±0 pp	10519 / 10566
🟢	Statements	99.37% (🎯 99%) ⬆️ +0.01 pp	16058 / 16159
🟢	Functions	99.37% (🎯 99%) ⬆️ +0.02 pp	4288 / 4315
🟢	Branches	94.86% (🎯 94%) 🟰 ±0 pp	7830 / 8254

File Coverage

No changed files found.

Generated in workflow #429 for commit d3cdbea by the Vitest Coverage Report Action

Size

Compared with main. KiB are 1,024 bytes.

	This pull request	main	Change
Client JavaScript	772.6 KiB	772.6 KiB	0 B (0%)
Client JavaScript, brotli	259.7 KiB	259.7 KiB	0 B (0%)
Client CSS	94.5 KiB	94.5 KiB	0 B (0%)
Client CSS, brotli	13.6 KiB	13.6 KiB	0 B (0%)

[github-actions]

Rust coverage

From run 429. Both are held to the thresholds in .cargo/config.toml.

Tests	Lines	Functions	Regions
All	98.1% (88960/90682)	97.55% (14499/14863)	96.76% (197239/203842)
Hegel property tests alone	97.08% (88033/90682)	96.56% (14351/14863)	95.63% (194935/203842)