[NopeCharon]

Summary

The Linux distro (tumbleweed) leg of ci-fresh-install ran zypper -n install ... alone. That install refreshes the repositories first, and when the refresh fails it keeps going on stale or empty metadata. The leg then went red with No provider of 'binutils' found, which names a package and not the repository that could not be read.

The leg's setup now runs zypper -n --gpg-auto-import-keys refresh as its own command and retries it once after 15 seconds. The install runs only after a refresh succeeds. If the refresh fails twice, the step ends with zypper's own refresh error and exit status. --gpg-auto-import-keys accepts a repository's new signing key, which -n alone rejects. A rolling image can run into such a key.

Closes #523.

Criteria

• I ran the exact setup string under sh -e in opensuse/tumbleweed:latest (aarch64), the shell GitHub uses for a container step. I checked it against the value the YAML parses to.
  • Failing refresh. I added a repository at an unreachable URL first. Both refreshes fail and the install never starts. The step exits 4, and its last line is "Some of the repositories have not been refreshed because of an error." Before this change, the install would have gone on to the No provider of ... errors.
  • Healthy repositories. "All repositories have been refreshed." prints, then the install proceeds.
• python3 .github/tools/check_workflow_assertions.py passes.
• This workflow runs after a release, daily, and on dispatch, but not on pull requests. Its next scheduled run is the first run in CI.

Intersections

New rule or feature	Invariant it crosses	Test at the crossing
The refresh is a separate gate before the install	Every distro leg installs findutils, binutils and file before mcpp runs	The leg's Install prerequisites step itself: the install line is unchanged
The step's status is the refresh's	Install xlings + mcpp runs only after the prerequisites step succeeds	none needed: the step order is unchanged

Compatibility

This changes only the tumbleweed leg. Before, a refresh failure in any configured repository could slip through if the install still found its packages. Now that failure fails the leg, after one retry, and the error names the repository.

Checks before merging

• bash .github/tools/check_docs_style.sh, check_docs_structure.sh and check_version_pins.sh pass.
• python3 .github/tools/check_workflow_assertions.py passes (a step asserts what its name says).
• No commit on the branch carries an attribution trailer:
  git log origin/main..HEAD -i --grep='Co-Authored-By' prints nothing.
• The squash merge is given an explicit subject and body, so GitHub does not
  compose one from the branch's commits. Suggested subject: ci(fresh-install): the tumbleweed leg refreshes before it installs and stops when the refresh fails.