CI: Fix ARM64 apt-get dep11 metadata failures

ARM64 CI builds fail when apt update returns exit code 100 due to dep11
metadata size mismatches during Ubuntu mirror synchronization.

The fix uses '|| true' to prevent the exit code from failing the action,
then manually checks for critical package index failures (Packages/Sources/
Release/InRelease). Non-critical dep11 metadata failures are ignored.
Package installation uses apt-get with --fix-missing for robustness.

Also fixes stale build configuration bug where 'make clean' doesn't
regenerate build/.config, causing JIT extension tests to fail with
'map_file() (null) failed' errors. Changed to 'make distclean' for
proper configuration reset between test runs.

Author: jserv

.github/workflows/main.yml

@@ -238,7 +238,7 @@ jobs:
                        ENABLE_Zicsr ENABLE_Zifencei \
                        ENABLE_MOP_FUSION ENABLE_BLOCK_CHAINING; do
               echo "JIT test with ${ext}=0"
-              if ! (make ENABLE_JIT=1 clean && make ${ext}=0 ENABLE_JIT=1 check $PARALLEL); then
+              if ! (make distclean && make ${ext}=0 ENABLE_JIT=1 check $PARALLEL); then
                 echo "ERROR: JIT test failed with ${ext}=0"
                 exit 1
               fi
@@ -343,39 +343,77 @@ jobs:
         # No 'sudo' is available
         install: |
           # Retry apt update with exponential backoff for mirror sync issues
-          # Note: dep11 (AppStream metadata) failures are non-critical for build tools
-          set -o pipefail
+          # dep11 = AppStream metadata (GUI app discovery, non-critical for CLI builds)
+          # Critical files: Packages, Sources, Release, InRelease (binary/source indices)
+          set +e  # Don't exit on apt update failure, we'll handle it manually
+          APT_SUCCESS=0
           for i in 1 2 3; do
-            if apt update -qq --allow-releaseinfo-change 2>&1 | tee /tmp/apt-update.log; then
-              APT_EXIT=0
+            echo "=== apt update attempt $i/3 ==="
+            # Force success even with dep11 failures (we check for critical failures below)
+            apt update --allow-releaseinfo-change 2>&1 | tee /tmp/apt-update.log || true
+            APT_EXIT=${PIPESTATUS[0]:-$?}  # Capture apt update exit code, not tee
+
+            # Check for critical package index failures (ignore dep11 metadata)
+            # dep11 files like Components-arm64.yml.gz are non-critical (AppStream metadata)
+            # Core package indices (Packages/Sources/Release/InRelease) MUST succeed
+            if grep -q -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log 2>/dev/null; then
+              # Critical failure detected
+              echo "ERROR: Critical package index files failed to download"
+              grep -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log | head -5
+              if [ $i -lt 3 ]; then
+                delay=$((i * 30))
+                echo "Retrying in ${delay}s... (attempt $((i + 1))/3)"
+                sleep $delay
+              else
+                echo "FATAL: Core package indices unavailable after 3 attempts"
+                cat /tmp/apt-update.log
+                exit 1
+              fi
             else
-              APT_EXIT=$?
-            fi
-            # Check for critical failures (package indices), ignore dep11 metadata
-            # Include InRelease which is the combined Release+Release.gpg file
-            if [ $APT_EXIT -eq 0 ] && ! grep -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log; then
-              echo "apt update succeeded (core package lists available)"
+              # Success: core package indices available (dep11 failures OK)
+              APT_SUCCESS=1
+              if [ $APT_EXIT -eq 0 ]; then
+                echo "✓ apt update succeeded (all package lists available)"
+              else
+                echo "✓ apt update completed with warnings (exit=$APT_EXIT)"
+                echo "  Core package indices: AVAILABLE"
+                if grep -q "dep11" /tmp/apt-update.log 2>/dev/null; then
+                  echo "  dep11 metadata: INCOMPLETE (non-critical, GUI app metadata)"
+                  echo "  Ignoring dep11 failures - build dependencies will install correctly"
+                fi
+              fi
               break
             fi
-            if [ $i -lt 3 ]; then
-              delay=$((i * 30))
-              echo "apt update attempt $i: errors detected (exit=$APT_EXIT), waiting ${delay}s..."
-              sleep $delay
-            else
-              echo "Warning: Proceeding after 3 attempts - some package lists may be incomplete"
-            fi
           done
-          # Install packages - exit 0 even if dep11 metadata is incomplete
-          apt install -yqq make git curl wget clang libsdl2-dev libsdl2-mixer-dev lsb-release software-properties-common gnupg bc 2>&1 | tee /tmp/apt-install.log || true
-          # Verify critical packages were installed
+
+          # Verify we succeeded in at least one attempt
+          if [ $APT_SUCCESS -ne 1 ]; then
+            echo "FATAL: apt update failed after all retry attempts"
+            exit 1
+          fi
+
+          # Install packages (dep11 metadata failures are benign)
+          echo "=== Installing build dependencies ==="
+          # Note: apt-get may still exit 100 due to dep11, but packages install correctly
+          # We verify installation success below, so force success here
+          apt-get install -yqq --fix-missing \
+            make git curl wget clang libsdl2-dev libsdl2-mixer-dev lsb-release software-properties-common gnupg bc || true
+
+          # Verify critical packages were installed successfully
+          echo "=== Verifying critical build tools ==="
+          MISSING_PKGS=""
           for pkg in make git curl clang bc; do
             if ! command -v $pkg >/dev/null 2>&1; then
-              echo "ERROR: Critical package $pkg failed to install!"
-              cat /tmp/apt-install.log
-              exit 1
+              MISSING_PKGS="$MISSING_PKGS $pkg"
             fi
           done
-          echo "All critical build tools installed successfully"
+
+          if [ -n "$MISSING_PKGS" ]; then
+            echo "ERROR: Critical packages failed to install:$MISSING_PKGS"
+            exit 1
+          fi
+
+          echo "✓ All critical build tools installed successfully"
         # FIXME: gcc build fails on Aarch64/Linux hosts
         env: |
           CC: clang-18
@@ -405,9 +443,9 @@ jobs:
           make $PARALLEL
           make check $PARALLEL
           make ENABLE_JIT=1 clean && make ENABLE_JIT=1 check $PARALLEL
-          make ENABLE_JIT=1 clean && make ENABLE_EXT_A=0 ENABLE_JIT=1 check $PARALLEL
-          make ENABLE_JIT=1 clean && make ENABLE_EXT_F=0 ENABLE_JIT=1 check $PARALLEL
-          make ENABLE_JIT=1 clean && make ENABLE_EXT_C=0 ENABLE_JIT=1 check $PARALLEL
+          make distclean && make ENABLE_EXT_A=0 ENABLE_JIT=1 check $PARALLEL
+          make distclean && make ENABLE_EXT_F=0 ENABLE_JIT=1 check $PARALLEL
+          make distclean && make ENABLE_EXT_C=0 ENABLE_JIT=1 check $PARALLEL
           # TSAN on ARM64: Fixed memory layout (0x150000000000 for main, 0x151000000000 for JIT)
           set -o pipefail
           echo "=== TSAN Test 1/3: Interpreter + FULL4G (ARM64) ==="
@@ -601,7 +639,7 @@ jobs:
                         ENABLE_Zicsr ENABLE_Zifencei \
                         ENABLE_MOP_FUSION ENABLE_BLOCK_CHAINING; do
                echo "JIT test with ${ext}=0"
-               if ! (make ENABLE_JIT=1 clean && make ${ext}=0 ENABLE_JIT=1 check $PARALLEL); then
+               if ! (make distclean && make ${ext}=0 ENABLE_JIT=1 check $PARALLEL); then
                  echo "ERROR: JIT test failed with ${ext}=0"
                  exit 1
                fi