From a867c9f7f69e27926272a93744daa503641a82ac Mon Sep 17 00:00:00 2001
From: justme <mr.toing@outlook.com>
Date: Wed, 21 Oct 2026 13:40:21 +0800
Subject: [PATCH] ci: pin Linux build RIDs across stages and retry runtime
 fetches [CI]

---
 ci/fetch-quic-test-runtime.sh                       |  4 ++--
 packaging/container/Agent.NativeBuild.Containerfile | 13 ++++++++++++-
 scripts/test-linux-agent-build.py                   |  3 +++
 3 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/ci/fetch-quic-test-runtime.sh b/ci/fetch-quic-test-runtime.sh
index daf0db8..d2e408f 100644
--- a/ci/fetch-quic-test-runtime.sh
+++ b/ci/fetch-quic-test-runtime.sh
@@ -24,7 +24,7 @@ esac
 download() {
   local url="$1" destination="$2"
   if [[ ! -s "$destination" ]]; then
-    curl --fail --silent --show-error --retry 3 "$url" -o "$destination"
+    curl --fail --silent --show-error --retry 3 --retry-all-errors "$url" -o "$destination"
   fi
 }
 
@@ -57,7 +57,7 @@ unpack_cache="$downloads/unpacked"
 mkdir -p "$package_cache" "$unpack_cache"
 
 msquic_index='https://packages.microsoft.com/debian/12/prod/pool/main/libm/libmsquic/'
-msquic_file="$(curl --fail --silent --show-error --retry 3 "$msquic_index" \
+msquic_file="$(curl --fail --silent --show-error --retry 3 --retry-all-errors "$msquic_index" \
   | grep -oE "libmsquic_[0-9]+(\.[0-9]+){1,3}_${deb_arch}\.deb" \
   | sort -Vu | tail -n 1)"
 [[ -n "$msquic_file" ]] || { echo "could not find a stable MsQuic package for $deb_arch" >&2; exit 1; }
diff --git a/packaging/container/Agent.NativeBuild.Containerfile b/packaging/container/Agent.NativeBuild.Containerfile
index 17ca1b3..393beff 100644
--- a/packaging/container/Agent.NativeBuild.Containerfile
+++ b/packaging/container/Agent.NativeBuild.Containerfile
@@ -8,6 +8,8 @@ ARG NODE_RID=linux-musl-arm64
 ARG STATIC_MSQUIC=true
 ENV NUGET_PACKAGES=/root/.nuget/packages
 FROM restore AS managed
+ARG NODE_RID=linux-musl-arm64
+ARG STATIC_MSQUIC=true
 ARG APP_VERSION=0.0.0-dev
 ARG MOSHIRO_TAG=
 ARG MOSHIRO_COMMIT=
@@ -15,13 +17,19 @@ ARG MOSHIRO_BUILT_AT=
 ENV MOSHIRO_TAG=$MOSHIRO_TAG MOSHIRO_COMMIT=$MOSHIRO_COMMIT MOSHIRO_BUILT_AT=$MOSHIRO_BUILT_AT
 # Build the project graph once; both native publishes reuse these managed outputs.
 RUN --mount=type=cache,id=moshiro-nuget,target=/root/.nuget/packages,ro \
-    dotnet build Agent.Native.proj -m:3 -c Release -r "$NODE_RID" --no-restore \
+    test -n "$NODE_RID" \
+    && echo "building managed outputs for $NODE_RID" \
+    && dotnet build Agent.Native.proj -m:3 -c Release -r "$NODE_RID" --no-restore \
       -p:PublishAot=true -p:UseAotAnywhere=true -p:SelfContained=true -p:Version="$APP_VERSION" \
+      -p:RuntimeIdentifier="$NODE_RID" \
       -p:StaticMsQuic="$STATIC_MSQUIC" -p:StaticExecutable="$STATIC_MSQUIC" \
       -p:RuntimeFrameworkVersion=10.0.12 -p:InvariantGlobalization=true \
       -p:UseAppHost=true -p:StripSymbols=true -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts
 
 FROM managed AS build-agent
+ARG NODE_RID=linux-musl-arm64
+ARG STATIC_MSQUIC=true
+ARG APP_VERSION=0.0.0-dev
 RUN --mount=type=cache,id=moshiro-nuget,target=/root/.nuget/packages,ro \
     dotnet publish agent/src/MoShiro.Agent -m:3 -c Release -r "$NODE_RID" \
       --self-contained true --no-build --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
@@ -36,6 +44,9 @@ RUN --mount=type=cache,id=moshiro-nuget,target=/root/.nuget/packages,ro \
        fi
 
 FROM managed AS build-enroll
+ARG NODE_RID=linux-musl-arm64
+ARG STATIC_MSQUIC=true
+ARG APP_VERSION=0.0.0-dev
 RUN --mount=type=cache,id=moshiro-nuget,target=/root/.nuget/packages,ro \
     dotnet publish fleet/tools/fleet-enroll -m:3 -c Release -r "$NODE_RID" \
       --self-contained true --no-build --no-restore -p:PublishAot=true -p:UseAotAnywhere=true \
diff --git a/scripts/test-linux-agent-build.py b/scripts/test-linux-agent-build.py
index 92a1df0..95d639a 100644
--- a/scripts/test-linux-agent-build.py
+++ b/scripts/test-linux-agent-build.py
@@ -65,6 +65,9 @@ class LinuxBuildTests(unittest.TestCase):
             self.assertIn('Targets="Restore" BuildInParallel="false"', traversal)
             self.assertIn('Targets="Build" BuildInParallel="false"', traversal)
             self.assertIn('RuntimeIdentifier=$(RuntimeIdentifier);SelfContained=$(SelfContained)', traversal)
+            containerfile = (first / 'Containerfile').read_text()
+            self.assertIn('test -n "$NODE_RID"', containerfile)
+            self.assertIn('-p:RuntimeIdentifier="$NODE_RID"', containerfile)
 
     def test_retention_removes_only_expired_layers_without_pruning_package_caches(self):
         with tempfile.TemporaryDirectory() as directory: