From 931cb40395403c77b0d59cfb696f268591b107d4 Mon Sep 17 00:00:00 2001
From: Johnathan Corgan <johnathan@corganlabs.com>
Date: Tue, 25 Aug 2026 14:48:26 +0100
Subject: [PATCH] Retry and shrink the apk-tools fetch in the OpenWrt package
 workflow

The .apk jobs build apk-tools v3 from source, and did it with a bare full
clone of gitlab.alpinelinux.org with no retry. That host took down the
whole OpenWrt Package run on master 5896021 twice in a row: attempt 1
died on both architectures with "fatal: early EOF / fetch-pack: invalid
index-pack output", attempt 2 on aarch64 with a connect timeout after
135 seconds. Nothing in our tree was at fault either time, and every
branch's .apk job carries the same single point of failure.

Fetch only the pinned commit at depth 1 and retry it three times with a
backoff, falling back to the old full clone once. The by-SHA fetch needs
uploadpack.allowReachableSHA1InWant, which the server allows today; the
fallback covers that policy changing. Exhausting every attempt now fails
with an ::error:: naming the commit and the repo rather than a bare git
exit code.
---
 .github/workflows/package-openwrt.yml | 30 +++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/package-openwrt.yml b/.github/workflows/package-openwrt.yml
index 6de57606..918a7abd 100644
--- a/.github/workflows/package-openwrt.yml
+++ b/.github/workflows/package-openwrt.yml
@@ -718,9 +718,35 @@ jobs:
           sudo apt-get install -y --no-install-recommends \
             git ca-certificates build-essential meson ninja-build pkg-config \
             zlib1g-dev libssl-dev libzstd-dev liblzma-dev lua5.4-dev scdoc
-          git clone --quiet https://gitlab.alpinelinux.org/alpine/apk-tools.git /tmp/apk-tools
+          # The upstream host has failed this step twice in one run (early EOF,
+          # then a connect timeout), so fetch only the pinned commit and retry.
+          # The by-SHA fetch needs uploadpack.allowReachableSHA1InWant, which
+          # the server has today; the full clone stays as the fallback in case
+          # that policy changes.
+          APK_TOOLS_REPO=https://gitlab.alpinelinux.org/alpine/apk-tools.git
+          fetch_pinned() {
+            rm -rf /tmp/apk-tools
+            git init --quiet /tmp/apk-tools \
+              && git -C /tmp/apk-tools remote add origin "$APK_TOOLS_REPO" \
+              && git -C /tmp/apk-tools fetch --quiet --depth 1 origin "${APK_TOOLS_COMMIT}" \
+              && git -C /tmp/apk-tools checkout --quiet FETCH_HEAD
+          }
+          clone_full() {
+            rm -rf /tmp/apk-tools
+            git clone --quiet "$APK_TOOLS_REPO" /tmp/apk-tools \
+              && git -C /tmp/apk-tools checkout --quiet "${APK_TOOLS_COMMIT}"
+          }
+          got_source=
+          for method in fetch_pinned fetch_pinned fetch_pinned clone_full; do
+            if "$method"; then got_source=$method; break; fi
+            echo "apk-tools $method failed; retrying after backoff" >&2
+            sleep 20
+          done
+          if [ -z "$got_source" ]; then
+            echo "::error::could not obtain apk-tools ${APK_TOOLS_COMMIT} from $APK_TOOLS_REPO"
+            exit 1
+          fi
           cd /tmp/apk-tools
-          git checkout --quiet "${APK_TOOLS_COMMIT}"
           meson setup build
           ninja -C build src/apk
           APK_BIN=/tmp/apk-tools/build/src/apk