chore: retry bubblewrap and run fetches after it

No Ubuntu mirror resolved on two runs: the bubblewrap step failed, and
setup-node, npm ci and both fetches were skipped, so the suite failed on
missing data trees and astro. apt now retries each file and the whole
install once more after 30 s, and the four steps that do not need the
sandbox run unless the job is cancelled. The sandbox step still fails
the job, and its tests already skip naming the missing bwrap.

.github/workflows/validate.yml

@@ -267,21 +267,31 @@ jobs:
       # core_probe and the campaign run third-party cores only inside a
       # bubblewrap sandbox and refuse without one. Ubuntu 24.04 blocks the
       # unprivileged user namespaces bwrap needs, so the campaign tests saw
-      # "refused". The last command proves a sandbox starts.
+      # "refused". The last command proves a sandbox starts. On 2026-11-11
+      # two runs could not resolve any Ubuntu mirror: apt retries each file,
+      # and the whole install runs once more after 30 s.
       - name: Give the sandbox tests a working bubblewrap
         run: |
-          sudo apt-get install -y --no-install-recommends bubblewrap
+          apt="sudo apt-get -o Acquire::Retries=5 -o Acquire::http::Timeout=30"
+          get_bwrap() { $apt update && $apt install -y --no-install-recommends bubblewrap; }
+          get_bwrap || { sleep 30; get_bwrap; }
           sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
           bwrap --ro-bind /usr /usr --symlink usr/lib /lib --symlink usr/lib64 /lib64 --symlink usr/bin /bin --proc /proc --dev /dev --unshare-all /bin/true
 
       # The site is built as deploy-site.yml builds it, from the lockfile.
+      # Neither this nor the two fetches below needs bubblewrap: a failed
+      # sandbox step skipped all four, and the suite then failed on missing
+      # data trees and an absent astro instead of on the sandbox alone. The
+      # bubblewrap step still fails the job.
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
+        if: ${{ !cancelled() }}
         with:
           node-version: "24"
           cache: npm
           cache-dependency-path: website/package-lock.json
 
-      - run: npm ci --prefix website
+      - if: ${{ !cancelled() }}
+        run: npm ci --prefix website
 
       # The exporter fidelity cases compare what we hand back against the
       # file each platform publishes, so they need those files. --fetch
@@ -289,12 +299,14 @@ jobs:
       # download, so the cases skipped on every run: --refresh-cache only
       # downloads them.
       - name: Fetch the platforms' own files
+        if: ${{ !cancelled() }}
         run: python scripts/export_native.py --all --refresh-cache
 
       # A pack built without its data directories exits non-zero: it is not
       # the pack a user gets. Tests that build packs need the same trees a
       # release build has, as deploy-site.yml fetches them.
       - name: Fetch the data directories
+        if: ${{ !cancelled() }}
         run: python scripts/refresh_data_dirs.py
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

tests/test_workflow_paths.py

@@ -159,6 +159,24 @@ class ThePullRequestBuildsTheSite(unittest.TestCase):
         # then failed under it: the generator runs whatever came before.
         self.assertEqual(steps[generate].get("if"), "${{ !cancelled() }}")
 
+    def test_a_failed_sandbox_step_skips_nothing_after_it(self):
+        """No Ubuntu mirror resolved on 2026-11-11: the bubblewrap step
+        failed, the steps after it were skipped, and the suite failed on
+        absent data trees and astro. Those steps do not need bubblewrap."""
+        steps = self._workflow("validate.yml")["jobs"]["run-tests"]["steps"]
+        sandbox = next(step for step in steps if "bubblewrap" in str(step.get("name", "")))
+        self.assertNotIn("continue-on-error", sandbox)
+        self.assertNotIn("if", sandbox)
+        self.assertIn("Acquire::Retries=5", sandbox["run"])
+        self.assertIn("sleep 30", sandbox["run"])
+        after = steps[steps.index(sandbox) + 1:]
+        for key in ("actions/setup-node@", "npm ci --prefix website",
+                    "export_native.py --all --refresh-cache", "refresh_data_dirs.py"):
+            step = next(s for s in after
+                        if key in str(s.get("uses", "")) or key in str(s.get("run", "")))
+            with self.subTest(step=key):
+                self.assertEqual(step.get("if"), "${{ !cancelled() }}")
+
     def test_every_site_input_triggers_validation(self):
         deploy = self._workflow("deploy-site.yml")
         validate = self._workflow("validate.yml")