fix(ci): isolate apt package metadata

[cjagwani]

Outcome

APT package refresh and installation in CLI coverage and the trusted Advisor runtime now use the same official Ubuntu source and an isolated package-list directory. Ambient third-party indexes on hosted runners can no longer influence the pinned tool installation.

Reason

PR #11324 restricted apt-get update, fixing the shared Chrome repository hash failure, but its subsequent apt-get install could still consult cached indexes from unrelated runner sources. The completed PR Review Advisor run identified that incomplete trust boundary after #11324 merged.

Related issues

Relates to #10791

Follow-up to #11324

Changes

• Create a dedicated APT lists directory under RUNNER_TEMP for both affected workflow owners.
• Apply the official Ubuntu source, disabled source-parts discovery, and isolated lists directory to both update and install.
• Extend the shared workflow contract test to execute through installation and assert all three APT invocations for both owners.

Verification

• npx vitest run test/automation/pull-requests/pr-workflow-contract.test.ts --project integration — 42 tests passed on current main.
• npm run check:diff — passed after generating the checkout's ignored build artifacts normally.
• Documentation impact review — no docs changes required; this is internal hosted-runner plumbing.
• GitHub commit verification — 98cac24d9eb96da5061024f572363f82db601eb7 is Verified (reason: valid).
• Gitleaks in npm run check:diff — passed; the diff contains no secrets, API keys, or credentials.

Review notes

This changes sensitive workflow paths. It is the smallest follow-up for the package-origin finding reported by all relevant specialists in Advisor run 34408930398 and still requires independent maintainer review.

---

Signed-off-by: Charan Jagwani cjagwani@nvidia.com

Summary by CodeRabbit

• Bug Fixes

  • Improved reliability of automated Ubuntu package installation by isolating temporary package-list data.
  • Kept package sources restricted and package versions pinned for consistent setup behavior.

• Tests

  • Expanded workflow validation to verify package installation arguments, source isolation, and failure handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 9ad8df77-3491-48d4-b606-d219da587613

📥 Commits

Reviewing files that changed from the base of the PR and between 801fb0c and 98cac24.

📒 Files selected for processing (3)

• .github/actions/ci-cli-coverage-shard/action.yaml
• .github/workflows/pr-review-advisor.yaml
• test/automation/pull-requests/pr-workflow-contract.test.ts

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

APT package installation in two workflows now uses temporary package-list state and explicit Ubuntu source configuration. The contract test validates the isolated update and pinned package installation commands.

Changes

APT installation isolation

Layer / File(s)	Summary
Isolated installation and contract validation .github/actions/ci-cli-coverage-shard/action.yaml, .github/workflows/pr-review-advisor.yaml, test/automation/pull-requests/pr-workflow-contract.test.ts	Both workflows use temporary APT list directories and explicit Ubuntu source settings for update and installation. The contract test records sudo calls and checks the isolated directory, pinned versions, and no-recommends installation arguments.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 98cac

The workflows now isolate APT metadata while retaining pinned tool installation, with contract coverage for both refresh and install commands. No current merge-blocking risk remains.

Suggested reviewers: cv, apurvvkumaria, prekshivyas

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: isolating APT package metadata in CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/ci-apt-package-isolation

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall line coverage in commit 98cac24 in the codex/ci-apt-package... branch remains at 96%, unchanged from commit 9b2514c in the main branch.

TypeScript / code-coverage/cli

The overall line coverage in commit 98cac24 in the codex/ci-apt-package... branch remains at 83%, unchanged from commit 801fb0c in the main branch.

Show a line coverage summary of the most impacted files.

File	main 801fb0c	codex/ci-apt-package... 98cac24	+/-
src/lib/actions...-diagnostics.ts	81%	67%	-14%
src/lib/state/o...config-merge.ts	92%	85%	-7%
src/lib/inferen...anaged-state.ts	85%	82%	-3%
src/lib/actions...ess-recovery.ts	84%	82%	-2%
src/lib/actions...eway-restart.ts	94%	92%	-2%
src/lib/onboard...uild-context.ts	75%	75%	0%
src/lib/actions...ard-recovery.ts	84%	85%	+1%
src/lib/actions...ard-recovery.ts	95%	97%	+2%
src/lib/actions...e-validation.ts	84%	88%	+4%
src/lib/actions...ridge-output.ts	89%	95%	+6%

---

_{Updated September 09, 2026 22:31 UTC}

[cjagwani]

Closing to consolidate this work into #11319. The isolated APT-list cache detail and regression evidence have been shared there.