From c6168a31fab714929193aa2e0d9197b1fd07d01e Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Wed, 29 Jul 2026 04:54:12 +0000 Subject: [PATCH] Retry the container root CA seeding instead of failing on one Windows Update timeout --- .github/workflows/clean-machine-install-ci.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.github/workflows/clean-machine-install-ci.yml b/.github/workflows/clean-machine-install-ci.yml index 6cc469c74c..08af140b58 100644 --- a/.github/workflows/clean-machine-install-ci.yml +++ b/.github/workflows/clean-machine-install-ci.yml @@ -1509,10 +1509,20 @@ jobs: - name: Seed the container's trusted root CA store shell: pwsh run: | - docker exec virgin cmd /c "certutil -generateSSTFromWU C:\roots.sst && certutil -addstore -f Root C:\roots.sst" ` - *>&1 | Select-Object -Last 15 + # -generateSSTFromWU pulls each root from ctldl.windowsupdate.com, and that + # host times out often enough to be the leg's main flake (staging run + # 30423072537 died on WinHttp 12002 while the sibling row seeded fine). + # Retry, but never tolerate a total failure: without the roots, Node's + # urllib download later fails with CERTIFICATE_VERIFY_FAILED. + for ($i = 1; $i -le 3; $i++) { + docker exec virgin cmd /c "certutil -generateSSTFromWU C:\roots.sst && certutil -addstore -f Root C:\roots.sst" ` + *>&1 | Select-Object -Last 15 + if ($LASTEXITCODE -eq 0) { break } + Write-Host "::warning::root CA seeding attempt $i failed; retrying" + Start-Sleep -Seconds 15 + } if ($LASTEXITCODE -ne 0) { - Write-Host '::error::could not seed the container root CA store; Python-side HTTPS will fail' + Write-Host '::error::could not seed the container root CA store after 3 attempts; Python-side HTTPS will fail' exit 1 }