From bef4ae9fc7ecd37be4e633736556f4a0e9d61417 Mon Sep 17 00:00:00 2001 From: John McCall Date: Fri, 4 Sep 2026 22:44:22 -0400 Subject: [PATCH 1/6] ci(windows): retry WSL apt-get install on transient mirror hash mismatch Split the WSL package install out of Vampire/setup-wsl's one-shot additional-packages so we can retry apt-get update/install (with Acquire::Retries) instead of failing the whole job on a transient archive.ubuntu.com mirror hash mismatch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ansible-test-windows.yml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml index 34b12011..f45275f4 100644 --- a/.github/workflows/ansible-test-windows.yml +++ b/.github/workflows/ansible-test-windows.yml @@ -121,11 +121,21 @@ jobs: update: "false" use-cache: "true" wsl-version: 1 - additional-packages: | - git - ${{ matrix.python }} - python3-pip - openssh-client + + # archive.ubuntu.com/security.ubuntu.com occasionally serve a Packages file that doesn't + # match the just-fetched InRelease hash (mirror mid-sync). Retrying almost always succeeds, + # so do our own apt-get here instead of relying on setup-wsl's one-shot additional-packages. + - name: Install WSL packages (with retry) # zizmor: ignore[template-injection] -- matrix.python is a controlled enum value (python3) + run: | + echo 'Acquire::Retries "3";' | sudo tee /etc/apt/apt.conf.d/80-retries > /dev/null + for attempt in 1 2 3; do + if sudo apt-get update && sudo apt-get install -y git ${{ matrix.python }} python3-pip openssh-client; then + exit 0 + fi + echo "apt-get failed (attempt $attempt), retrying..." + sleep 10 + done + exit 1 - name: Get Linux workspace path shell: pwsh From eee04b604def339a3d97756038ffd0a189c7997d Mon Sep 17 00:00:00 2001 From: John McCall Date: Fri, 4 Sep 2026 22:47:57 -0400 Subject: [PATCH 2/6] ci(windows): probe windows-2025 runner via temporary matrix include Add a single windows-2025 job (continue-on-error) alongside the existing windows-2022 matrix to empirically validate WinRM/WSL/SQL Server install compatibility before deciding on a full migration. Temporary, to be removed once results are gathered. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ansible-test-windows.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml index f45275f4..ed02b6ef 100644 --- a/.github/workflows/ansible-test-windows.yml +++ b/.github/workflows/ansible-test-windows.yml @@ -43,10 +43,12 @@ jobs: integration: runs-on: ${{ matrix.os }} - name: I (Ⓐ${{ matrix.ansible }}+win-2022|grp${{ matrix.group }}) + name: I (Ⓐ${{ matrix.ansible }}+${{ matrix.os }}|grp${{ matrix.group }}) # Historically ~17m avg, ~21m max; guard against hung WSL/SQL Server setup timeout-minutes: 45 - continue-on-error: ${{ matrix.ansible == 'devel' }} + # TEMPORARY: exploring a windows-2025 migration; that leg is allowed to fail without + # blocking the rollup while we validate it. Remove once decided either way. + continue-on-error: ${{ matrix.ansible == 'devel' || matrix.os == 'windows-2025' }} strategy: fail-fast: false matrix: @@ -65,6 +67,13 @@ jobs: - "1" - "2" #- '3' + # TEMPORARY: single probe job to see what breaks on windows-2025. Remove once decided. + include: + - os: windows-2025 + wsl: Ubuntu-24.04 + ansible: stable-2.21 + python: python3 + group: "1" defaults: run: shell: wsl-bash {0} From 053a45c48116cdaeb1357ca432fc605719fb760d Mon Sep 17 00:00:00 2001 From: John McCall Date: Fri, 4 Sep 2026 22:51:48 -0400 Subject: [PATCH 3/6] ci(windows): remove no-longer-needed MongoDB disable step Both windows-2022 and windows-2025 runner images ship MongoDB Stopped/Disabled by default now, so this defensive step is dead weight. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ansible-test-windows.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml index ed02b6ef..4d7e1301 100644 --- a/.github/workflows/ansible-test-windows.yml +++ b/.github/workflows/ansible-test-windows.yml @@ -115,11 +115,6 @@ jobs: run: | winrm quickconfig -force - - name: Why is MongoDB running? Disable it. - shell: powershell - run: | - Get-Service -Name MongoDB | Where-Object Status -eq 'Running' | Stop-Service -Force - - name: Add a hosts entry # zizmor: ignore[misfeature] -- Windows-specific cmd required for hosts file modification shell: cmd run: echo 127.0.0.1 sqlserver >> "%WinDir%\System32\Drivers\etc\hosts" From 40150abdc3e8a7fa384d3f9fed24b0523a990f6a Mon Sep 17 00:00:00 2001 From: John McCall Date: Fri, 4 Sep 2026 23:01:47 -0400 Subject: [PATCH 4/6] ci(windows): migrate integration matrix from windows-2022 to windows-2025 Early results from a windows-2025 probe job (WinRM, WSL1, mssqlsuite SQL Server install) show no compatibility issues, so switch the whole matrix over instead of running both. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ansible-test-windows.yml | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml index 4d7e1301..a216932e 100644 --- a/.github/workflows/ansible-test-windows.yml +++ b/.github/workflows/ansible-test-windows.yml @@ -43,17 +43,15 @@ jobs: integration: runs-on: ${{ matrix.os }} - name: I (Ⓐ${{ matrix.ansible }}+${{ matrix.os }}|grp${{ matrix.group }}) + name: I (Ⓐ${{ matrix.ansible }}+win-2025|grp${{ matrix.group }}) # Historically ~17m avg, ~21m max; guard against hung WSL/SQL Server setup timeout-minutes: 45 - # TEMPORARY: exploring a windows-2025 migration; that leg is allowed to fail without - # blocking the rollup while we validate it. Remove once decided either way. - continue-on-error: ${{ matrix.ansible == 'devel' || matrix.os == 'windows-2025' }} + continue-on-error: ${{ matrix.ansible == 'devel' }} strategy: fail-fast: false matrix: os: - - windows-2022 + - windows-2025 wsl: - Ubuntu-24.04 ansible: @@ -67,13 +65,6 @@ jobs: - "1" - "2" #- '3' - # TEMPORARY: single probe job to see what breaks on windows-2025. Remove once decided. - include: - - os: windows-2025 - wsl: Ubuntu-24.04 - ansible: stable-2.21 - python: python3 - group: "1" defaults: run: shell: wsl-bash {0} From 879225639833229ba4c4711da0018da663ef6778 Mon Sep 17 00:00:00 2001 From: John McCall Date: Fri, 4 Sep 2026 23:12:38 -0400 Subject: [PATCH 5/6] ci(windows): remove redundant winrm quickconfig step ConfigureRemotingForAnsible.ps1 (run immediately before) already starts the WinRM service, sets it to auto-start, creates the HTTP/HTTPS listeners, opens the required firewall rules, and self-tests both transports. The separate 'winrm quickconfig -force' step ran against an already-fully-configured WinRM and did nothing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ansible-test-windows.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml index a216932e..d36ed7bf 100644 --- a/.github/workflows/ansible-test-windows.yml +++ b/.github/workflows/ansible-test-windows.yml @@ -101,11 +101,6 @@ jobs: $sb = [ScriptBlock]::Create((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/38e50c9f819a045ea4d40068f83e78adbfaf2e68/examples/scripts/ConfigureRemotingForAnsible.ps1')) & $sb -Verbose -ForceNewSSLCert 4>&1 - - name: Enable winrm - shell: powershell - run: | - winrm quickconfig -force - - name: Add a hosts entry # zizmor: ignore[misfeature] -- Windows-specific cmd required for hosts file modification shell: cmd run: echo 127.0.0.1 sqlserver >> "%WinDir%\System32\Drivers\etc\hosts" From 8a4180e2160ea94f977de6195c399ff3496d0cb7 Mon Sep 17 00:00:00 2001 From: John McCall Date: Fri, 4 Sep 2026 23:20:35 -0400 Subject: [PATCH 6/6] ci(windows): repoint ConfigureRemotingForAnsible.ps1 to ansible-documentation The script moved from ansible/ansible to ansible/ansible-documentation. Pin to a current commit there and link the devel URL for future updates. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/ansible-test-windows.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ansible-test-windows.yml b/.github/workflows/ansible-test-windows.yml index d36ed7bf..9bd44493 100644 --- a/.github/workflows/ansible-test-windows.yml +++ b/.github/workflows/ansible-test-windows.yml @@ -98,7 +98,9 @@ jobs: - name: Set up the runner for PowerShell remoting shell: powershell run: | - $sb = [ScriptBlock]::Create((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible/38e50c9f819a045ea4d40068f83e78adbfaf2e68/examples/scripts/ConfigureRemotingForAnsible.ps1')) + # Pinned to a commit in the current home of this script; latest version at + # https://github.com/ansible/ansible-documentation/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1 + $sb = [ScriptBlock]::Create((New-Object System.Net.Webclient).DownloadString('https://raw.githubusercontent.com/ansible/ansible-documentation/b8cf495929aa200a11abc7468d1fb6cd9c0e1613/examples/scripts/ConfigureRemotingForAnsible.ps1')) & $sb -Verbose -ForceNewSSLCert 4>&1 - name: Add a hosts entry # zizmor: ignore[misfeature] -- Windows-specific cmd required for hosts file modification