CI: Fix ARM64 apt-get dep11 metadata failures

ARM64 CI builds fail when apt update returns exit code 100 due to
dep11 metadata size mismatches during Ubuntu mirror synchronization.

The fix distinguishes between critical package index failures
(Packages/Sources/Release/InRelease) and non-critical dep11 metadata
failures (AppStream GUI application metadata). Builds proceed if core
package indices are available, ignoring dep11 transient sync issues.

Author: jserv

.github/workflows/main.yml

@@ -343,39 +343,74 @@ jobs:
         # No 'sudo' is available
         install: |
           # Retry apt update with exponential backoff for mirror sync issues
-          # Note: dep11 (AppStream metadata) failures are non-critical for build tools
-          set -o pipefail
+          # dep11 = AppStream metadata (GUI app discovery, non-critical for CLI builds)
+          # Critical files: Packages, Sources, Release, InRelease (binary/source indices)
+          set +e  # Don't exit on apt update failure, we'll handle it manually
+          APT_SUCCESS=0
           for i in 1 2 3; do
-            if apt update -qq --allow-releaseinfo-change 2>&1 | tee /tmp/apt-update.log; then
-              APT_EXIT=0
+            echo "=== apt update attempt $i/3 ==="
+            apt update --allow-releaseinfo-change 2>&1 | tee /tmp/apt-update.log
+            APT_EXIT=$?
+
+            # Check for critical package index failures (ignore dep11 metadata)
+            # dep11 files like Components-arm64.yml.gz are non-critical (AppStream metadata)
+            # Core package indices (Packages/Sources/Release/InRelease) MUST succeed
+            if grep -q -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log 2>/dev/null; then
+              # Critical failure detected
+              echo "ERROR: Critical package index files failed to download"
+              grep -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log | head -5
+              if [ $i -lt 3 ]; then
+                delay=$((i * 30))
+                echo "Retrying in ${delay}s... (attempt $((i + 1))/3)"
+                sleep $delay
+              else
+                echo "FATAL: Core package indices unavailable after 3 attempts"
+                cat /tmp/apt-update.log
+                exit 1
+              fi
             else
-              APT_EXIT=$?
-            fi
-            # Check for critical failures (package indices), ignore dep11 metadata
-            # Include InRelease which is the combined Release+Release.gpg file
-            if [ $APT_EXIT -eq 0 ] && ! grep -E "Failed to fetch.*/(Packages|Sources|Release|InRelease)" /tmp/apt-update.log; then
-              echo "apt update succeeded (core package lists available)"
+              # Success: core package indices available (dep11 failures OK)
+              APT_SUCCESS=1
+              if [ $APT_EXIT -eq 0 ]; then
+                echo "✓ apt update succeeded (all package lists available)"
+              else
+                echo "✓ apt update completed with warnings (exit=$APT_EXIT)"
+                echo "  Core package indices: AVAILABLE"
+                if grep -q "dep11" /tmp/apt-update.log 2>/dev/null; then
+                  echo "  dep11 metadata: INCOMPLETE (non-critical, GUI app metadata)"
+                  echo "  Ignoring dep11 failures - build dependencies will install correctly"
+                fi
+              fi
               break
             fi
-            if [ $i -lt 3 ]; then
-              delay=$((i * 30))
-              echo "apt update attempt $i: errors detected (exit=$APT_EXIT), waiting ${delay}s..."
-              sleep $delay
-            else
-              echo "Warning: Proceeding after 3 attempts - some package lists may be incomplete"
-            fi
           done
-          # Install packages - exit 0 even if dep11 metadata is incomplete
-          apt install -yqq make git curl wget clang libsdl2-dev libsdl2-mixer-dev lsb-release software-properties-common gnupg bc 2>&1 | tee /tmp/apt-install.log || true
-          # Verify critical packages were installed
+
+          # Verify we succeeded in at least one attempt
+          if [ $APT_SUCCESS -ne 1 ]; then
+            echo "FATAL: apt update failed after all retry attempts"
+            exit 1
+          fi
+
+          # Install packages (dep11 metadata failures are benign)
+          echo "=== Installing build dependencies ==="
+          set -e  # Re-enable exit on error for package installation
+          apt install -yqq make git curl wget clang libsdl2-dev libsdl2-mixer-dev lsb-release software-properties-common gnupg bc
+
+          # Verify critical packages were installed successfully
+          echo "=== Verifying critical build tools ==="
+          MISSING_PKGS=""
           for pkg in make git curl clang bc; do
             if ! command -v $pkg >/dev/null 2>&1; then
-              echo "ERROR: Critical package $pkg failed to install!"
-              cat /tmp/apt-install.log
-              exit 1
+              MISSING_PKGS="$MISSING_PKGS $pkg"
             fi
           done
-          echo "All critical build tools installed successfully"
+
+          if [ -n "$MISSING_PKGS" ]; then
+            echo "ERROR: Critical packages failed to install:$MISSING_PKGS"
+            exit 1
+          fi
+
+          echo "✓ All critical build tools installed successfully"
         # FIXME: gcc build fails on Aarch64/Linux hosts
         env: |
           CC: clang-18