Issue report

Title: checks.yml: harden the apt install step and enable the Go module cache

• Affects: main
• Part of: Reduce Flaky Tests #773
• Jobs: Run static checks 1/112 (apt 403), Run Unit tests 1/112 (proxy.golang.org stream error)

What version of MicroCeph are you using ?

Both failures ran on RGW stack branches (#887 on 2026-09-24 and #886 on 2026-09-29) that are based on main at 745aad7. .github/workflows/checks.yml and .github/actions/govulncheck/action.yml are unchanged at 5df62e1.

What are the steps to reproduce this issue ?

1. Push a branch or open a pull request so the Checks workflow runs both jobs on ubuntu-24.04.
2. Intermittently, Install dependencies fails in apt-get update, or Run Unit tests fails while downloading Go modules. Neither failure is deterministic.

What happens (observed behaviour) ?

Two separate failures, both low frequency and both outside the repository's own code. First, apt-get update exits 100 because packages.microsoft.com answered 403 Forbidden, although every Ubuntu and dqlite PPA index had downloaded. The workflow never adds that repository, so it comes from the runner image (inferred). The step has no retry. A re-run passed (https://github.com/canonical/microceph/actions/runs/36048860355/job/108231184661).

Second, make check-unit hit stream error: stream ID 145; INTERNAL_ERROR on one module download from proxy.golang.org. GOPROXY falls back to direct only on 404 or 410, so a stream error fails the job. The module cache that would avoid most downloads is switched off: actions/setup-go@v5 looks for go.sum at the repository root, but it lives in microceph/, so every run logs a "Restore cache failed" warning. A cache restored from main would probably have avoided this failure (inferred). There is no re-run of this job.

Rates: 1/112 for each job on the RGW stack branches (#881 to #893) at the base above, 0/72 on the earlier stack base, 0/32 on squid branches and 0/4 on other pull request branches. The stack was ruled out: both steps run before any repository code and are identical on main. The stack only adds volume, 76 Checks and Tests runs in about two minutes on 2026-09-29.

What were you expecting to happen ?

An outage on an unrelated apt repository or a transient proxy error does not fail the Checks workflow, and Go modules are restored from the cache.

Relevant logs, error output, etc.

• apt 403 (2026-09-24, lines 211-212 and 243-245): https://github.com/canonical/microceph/actions/runs/36048860355/job/107799072819
• Go proxy (2026-09-29, warning at line 329, errors at lines 429-438): https://github.com/canonical/microceph/actions/runs/36614123719/job/109562662013
• Same warning in a passing job (line 316): https://github.com/canonical/microceph/actions/runs/36614109154/job/109562613246
• Code:

  microceph/.github/workflows/checks.yml

  Lines 17 to 26 in 5df62e1

  	- name: Install dependencies
  	run: |
  	sudo add-apt-repository ppa:dqlite/dev -y --no-update
  	sudo apt-get update
  	sudo apt-get install -y libdqlite1.17-dev
  	- name: Install Go (1.25)
  	uses: actions/setup-go@v5
  	with:
  	go-version: 1.25.x

  ,

  microceph/.github/workflows/checks.yml

  Lines 54 to 63 in 5df62e1

  	- name: Install dependencies
  	run: |
  	sudo add-apt-repository ppa:dqlite/dev -y --no-update
  	sudo apt-get update
  	sudo apt-get install -y libdqlite1.17-dev
  	- name: Install Go (1.25)
  	uses: actions/setup-go@v5
  	with:
  	go-version: 1.25.x

  ,

  microceph/.github/actions/govulncheck/action.yml

  Lines 38 to 48 in 5df62e1

  	- name: Install cgo dependencies (libdqlite)
  	shell: bash
  	run: |
  	sudo add-apt-repository ppa:dqlite/dev -y --no-update
  	sudo apt-get update
  	sudo apt-get install -y libdqlite1.17-dev
  	- name: Install Go
  	uses: actions/setup-go@v5
  	with:
  	go-version: ${{ inputs.go-version }}

Err:6 https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease
  403  Forbidden [IP: 13.107.246.66 443]
E: The repository 'https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease' is no longer signed.
##[error]Process completed with exit code 100.

##[warning]Restore cache failed: Dependencies file is not found in /home/runner/work/microceph/microceph. Supported file pattern: go.sum
##[error]../../../../go/pkg/mod/github.com/spf13/afero@v1.15.0/util.go:29:2: golang.org/x/text@v0.34.0: read "https://proxy.golang.org/golang.org/x/text/@v/v0.34.0.zip": stream error: stream ID 145; INTERNAL_ERROR; received from peer
make: *** [Makefile:21: check-unit] Error 1: 2 != 0

Additional comments.

Low priority. Proposed fix, all in the workflow files: (a) in both Install dependencies steps and in the govulncheck action, either remove the unrelated runner repository before updating (sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/microsoft-prod.sources || true; these file names are a guess and not checked against the runner image) or wrap the apt commands in a three-attempt loop with a 15 second sleep, keeping add-apt-repository inside the loop because it calls the Launchpad API. (b) Add cache-dependency-path: microceph/go.sum to both actions/setup-go@v5 steps in checks.yml and to the one in the govulncheck action (using its working-directory input there). The cache change is one added line per actions/setup-go@v5 step and may also make both jobs faster. (c) Optionally run go mod download in a three-attempt loop before make check-unit. The retry loop is untested against a persistent 403, so removing the repository is the safer choice for (a).