From 4d81fe64c34311affc719af58602880bd85a6c82 Mon Sep 17 00:00:00 2001
From: Timothy Place <timothyaplace@gmail.com>
Date: Thu, 1 Oct 2026 15:28:14 -0500
Subject: [PATCH 1/2] CI: Arm's own 13.2.Rel1 toolchain tarball on the QEMU
 legs, cached, instead of apt gcc-arm-none-eabi

Ubuntu's gcc-arm-none-eabi pulls the 463 MB libstdc++-arm-none-eabi-newlib
package from the runner's Azure mirror. That fetch stalled past the
15-minute step limit three times on 2026-10-01 (tap/MuTap#81 twice,
tap/MuTap#80 once) after eating two 45-minute legs on tap/MuTap#67. Both
Cortex legs now restore Arm's arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
from the Actions cache, or download it (179 MB from Arm's CDN, curl with
retries, verified against Arm's published sha256) on a miss, and put its
bin on PATH; only qemu-system-arm still comes from apt. It is the same
upstream release Ubuntu noble packages (15:13.2.rel1-2), so the
fingerprint and icount gates on this PR's own run are the check that the
numerics did not move.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDhgJqxUsdmWPKh6pKrV5A
---
 .github/workflows/ci.yml | 92 ++++++++++++++++++++++++++++++++--------
 1 file changed, 74 insertions(+), 18 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19ff7b7..0520ce1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -190,16 +190,44 @@ jobs:
         with:
           submodules: recursive
 
-      # A stalled Ubuntu mirror once ate a leg's whole 45-minute budget twice in a
-      # row while fetching the 463 MB libstdc++-arm-none-eabi-newlib package
-      # (tap/MuTap#67). Fail the fetch fast and retry it instead.
-      - name: Install toolchain and QEMU
+      # Ubuntu's gcc-arm-none-eabi pulls the 463 MB libstdc++-arm-none-eabi-newlib
+      # package from the runner's Azure mirror, which stalled past a 15-minute
+      # step limit three times on 2026-10-01 (and ate two 45-minute legs on
+      # tap/MuTap#67 before that). The toolchain is Arm's own 13.2.Rel1 release
+      # instead — the same upstream version Ubuntu noble packages (15:13.2.rel1-2)
+      # — cached between runs and verified against Arm's published sha256.
+      # Only qemu-system-arm still comes from apt.
+      - name: Restore the Arm GNU toolchain
+        id: arm-toolchain
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: ${{ runner.temp }}/arm-gnu-toolchain
+          key: arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
+
+      - name: Download the Arm GNU toolchain
+        if: steps.arm-toolchain.outputs.cache-hit != 'true'
         timeout-minutes: 15
-        run: >
-          sudo apt-get update -q &&
-          sudo apt-get install -y -q
-          -o Acquire::Retries=5 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60
-          gcc-arm-none-eabi qemu-system-arm
+        env:
+          ARM_GNU: arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
+          ARM_URL: https://developer.arm.com/-/media/Files/downloads/gnu/13.2.rel1/binrel
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          curl -sSfL --retry 5 --retry-all-errors --connect-timeout 30 -o "$ARM_GNU.tar.xz" "$ARM_URL/$ARM_GNU.tar.xz"
+          curl -sSfL --retry 5 --retry-all-errors --connect-timeout 30 -o "$ARM_GNU.tar.xz.sha256asc" "$ARM_URL/$ARM_GNU.tar.xz.sha256asc"
+          sha256sum -c "$ARM_GNU.tar.xz.sha256asc"
+          mkdir -p arm-gnu-toolchain
+          tar -xJf "$ARM_GNU.tar.xz" -C arm-gnu-toolchain --strip-components=1
+          rm "$ARM_GNU.tar.xz" "$ARM_GNU.tar.xz.sha256asc"
+
+      - name: Put the toolchain on PATH and install QEMU
+        timeout-minutes: 15
+        run: |
+          set -euo pipefail
+          echo "$RUNNER_TEMP/arm-gnu-toolchain/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/arm-gnu-toolchain/bin/arm-none-eabi-g++" --version | head -1
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=5 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 qemu-system-arm
 
       - name: Configure
         run: >
@@ -307,16 +335,44 @@ jobs:
         with:
           submodules: recursive
 
-      # A stalled Ubuntu mirror once ate a leg's whole 45-minute budget twice in a
-      # row while fetching the 463 MB libstdc++-arm-none-eabi-newlib package
-      # (tap/MuTap#67). Fail the fetch fast and retry it instead.
-      - name: Install toolchain and QEMU
+      # Ubuntu's gcc-arm-none-eabi pulls the 463 MB libstdc++-arm-none-eabi-newlib
+      # package from the runner's Azure mirror, which stalled past a 15-minute
+      # step limit three times on 2026-10-01 (and ate two 45-minute legs on
+      # tap/MuTap#67 before that). The toolchain is Arm's own 13.2.Rel1 release
+      # instead — the same upstream version Ubuntu noble packages (15:13.2.rel1-2)
+      # — cached between runs and verified against Arm's published sha256.
+      # Only qemu-system-arm still comes from apt.
+      - name: Restore the Arm GNU toolchain
+        id: arm-toolchain
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: ${{ runner.temp }}/arm-gnu-toolchain
+          key: arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
+
+      - name: Download the Arm GNU toolchain
+        if: steps.arm-toolchain.outputs.cache-hit != 'true'
         timeout-minutes: 15
-        run: >
-          sudo apt-get update -q &&
-          sudo apt-get install -y -q
-          -o Acquire::Retries=5 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60
-          gcc-arm-none-eabi qemu-system-arm
+        env:
+          ARM_GNU: arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
+          ARM_URL: https://developer.arm.com/-/media/Files/downloads/gnu/13.2.rel1/binrel
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          curl -sSfL --retry 5 --retry-all-errors --connect-timeout 30 -o "$ARM_GNU.tar.xz" "$ARM_URL/$ARM_GNU.tar.xz"
+          curl -sSfL --retry 5 --retry-all-errors --connect-timeout 30 -o "$ARM_GNU.tar.xz.sha256asc" "$ARM_URL/$ARM_GNU.tar.xz.sha256asc"
+          sha256sum -c "$ARM_GNU.tar.xz.sha256asc"
+          mkdir -p arm-gnu-toolchain
+          tar -xJf "$ARM_GNU.tar.xz" -C arm-gnu-toolchain --strip-components=1
+          rm "$ARM_GNU.tar.xz" "$ARM_GNU.tar.xz.sha256asc"
+
+      - name: Put the toolchain on PATH and install QEMU
+        timeout-minutes: 15
+        run: |
+          set -euo pipefail
+          echo "$RUNNER_TEMP/arm-gnu-toolchain/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/arm-gnu-toolchain/bin/arm-none-eabi-g++" --version | head -1
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=5 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 qemu-system-arm
 
       - name: Configure
         run: >

From 329d388d422550347e0ffc7d6f4ceddf74689bca Mon Sep 17 00:00:00 2001
From: Timothy Place <timothyaplace@gmail.com>
Date: Thu, 1 Oct 2026 17:17:09 -0500
Subject: [PATCH 2/2] CI: the instruction-count ratchet takes the Arm toolchain
 from the same cached tarball

Its own apt install of gcc-arm-none-eabi stalled on the 463 MB
libstdc++-arm-none-eabi-newlib fetch and was cancelled at the job's
60-minute limit on this PR's first run (job 110569401398); the mirror
served the 11 MB qemu-system-arm package in two minutes on the same run.
Same cache key and download step as the Cortex legs; the apt step keeps
qemu-system-arm and the plugin build dependencies, with retries and
timeouts.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DDhgJqxUsdmWPKh6pKrV5A
---
 .github/workflows/ci.yml | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0520ce1..f2520b4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -585,11 +585,41 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Install toolchains and QEMU
-        run: >
-          sudo apt-get update -q &&
-          sudo apt-get install -y -q gcc-arm-none-eabi qemu-system-arm
-          libglib2.0-dev pkg-config ninja-build meson flex bison
+      # The Arm toolchain comes from Arm's tarball, cached, for the reason the
+      # Cortex legs give above (the 463 MB apt package stalls on the mirror);
+      # the baselines were seeded from gcc-arm-none-eabi 13.2.rel1, the same
+      # upstream release, and the ratchet's +/-3 % tolerance is the check.
+      - name: Restore the Arm GNU toolchain
+        id: arm-toolchain
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        with:
+          path: ${{ runner.temp }}/arm-gnu-toolchain
+          key: arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
+
+      - name: Download the Arm GNU toolchain
+        if: steps.arm-toolchain.outputs.cache-hit != 'true'
+        timeout-minutes: 15
+        env:
+          ARM_GNU: arm-gnu-toolchain-13.2.rel1-x86_64-arm-none-eabi
+          ARM_URL: https://developer.arm.com/-/media/Files/downloads/gnu/13.2.rel1/binrel
+        run: |
+          set -euo pipefail
+          cd "$RUNNER_TEMP"
+          curl -sSfL --retry 5 --retry-all-errors --connect-timeout 30 -o "$ARM_GNU.tar.xz" "$ARM_URL/$ARM_GNU.tar.xz"
+          curl -sSfL --retry 5 --retry-all-errors --connect-timeout 30 -o "$ARM_GNU.tar.xz.sha256asc" "$ARM_URL/$ARM_GNU.tar.xz.sha256asc"
+          sha256sum -c "$ARM_GNU.tar.xz.sha256asc"
+          mkdir -p arm-gnu-toolchain
+          tar -xJf "$ARM_GNU.tar.xz" -C arm-gnu-toolchain --strip-components=1
+          rm "$ARM_GNU.tar.xz" "$ARM_GNU.tar.xz.sha256asc"
+
+      - name: Put the toolchain on PATH and install QEMU and the plugin build deps
+        timeout-minutes: 20
+        run: |
+          set -euo pipefail
+          echo "$RUNNER_TEMP/arm-gnu-toolchain/bin" >> "$GITHUB_PATH"
+          "$RUNNER_TEMP/arm-gnu-toolchain/bin/arm-none-eabi-g++" --version | head -1
+          sudo apt-get update -q
+          sudo apt-get install -y -q -o Acquire::Retries=5 -o Acquire::http::Timeout=60 -o Acquire::https::Timeout=60 qemu-system-arm libglib2.0-dev pkg-config ninja-build meson flex bison
 
       - name: Build counting plugin
         run: |