CI: resolve the ghcr .deb bundle against its own apt index

[julek-wolfssl]

The .deb bundle was previously resolved against the live apt archive at
publish time, while consumers resolved against apt lists frozen into the
runner image days earlier. Version drift in between made --no-download
ask for packages the bundle didn't carry, triggering an all-or-nothing
fallback to the mirror — hit by ~25% of PR jobs, and in 16/20 sampled
cases the mirror served zero bytes even though the bundle was complete.

ci-deps-image now ships a dpkg-scanpackages index with each bundle, and
install-apt-deps resolves against only that index as a local file://
repository with its own lists dir, so producer and consumer agree by
construction and only genuinely missing packages fall back to the mirror.

Also:

• Rebuild static bundles daily and on merged package-list changes, instead of weekly
• Give pq-all its own -cross bundle, since crossbuild-essential-* wasn't in any 24.04 list and was fetching 118 MB from the mirror on every run
• Have ccache-setup install from the repository install-apt-deps exports rather than debs staged in /var/cache/apt/archives
• Add check-ci-deps.py to fail a PR whose install-apt-deps call names a package missing from its bundle, a nonexistent tag, or a tag for the wrong Ubuntu release; wired into check-source-text
• Have ci-deps-canary assert the same contract dynamically after every rebuild, with require-bundle turning a fallback into an error
• Switch whitebox-smoke from a bare apt-get to using the bundle

[Copilot]

🟡 Changes recommended

check-ci-deps.py --matrix currently exits successfully even after emitting ::error findings, which can let ci-deps-canary proceed/appear successful despite static contract violations.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the CI “apt .deb bundle” mechanism by making dependency resolution deterministic: workflows now resolve against the bundle’s own apt Packages index (served as a local file: repo with isolated lists), avoiding version drift between producer and consumer and reducing fallback to flaky mirrors.

Changes:

• Build and publish bundle-local apt indexes (Packages / Packages.gz), rebuild static bundles daily and on merged package-list changes, and add a dedicated ubuntu-24.04-cross bundle for pq-all.
• Update install-apt-deps to resolve against only the bundle index (with a require-bundle option) and have ccache-setup install from the exported local bundle repo.
• Add check-ci-deps.py (static contract checker) and ci-deps-canary.yml (dynamic contract checker), and wire the static check into check-source-text.

File summaries

File	Description
.github/workflows/whitebox-smoke.yml	Switch build deps installation to install-apt-deps using the 24.04 bundle.
.github/workflows/pq-all.yml	Point pq-all at the new ubuntu-24.04-cross bundle and update related comments.
.github/workflows/ci-deps-image.yml	Add bundle indexing, rebuild triggers (daily + on package-list changes), and add the ubuntu-24.04-cross build to the matrix.
.github/workflows/ci-deps-canary.yml	New workflow to assert bundle/workflow contract dynamically after rebuilds and daily.
.github/workflows/check-source-text.yml	Run the new bundle contract checker in CI for every PR.
.github/scripts/check-ci-deps.py	New static validator ensuring workflow requests match bundle tags, Ubuntu series, and package lists.
.github/ci-deps/packages-ubuntu-24.04-cross.txt	New package list defining the cross-toolchain bundle contents.
.github/actions/install-apt-deps/action.yml	Resolve installs against the bundle’s own apt index via a local file: repo; add require-bundle to hard-fail on fallback.
.github/actions/ccache-setup/action.yml	Install ccache from the local bundle repo exported by install-apt-deps when available.

Review details

• Files reviewed: 9/9 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-dtls13

• FLASH: .text +448 B (+0.2%, 187,196 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +576 B (+0.1%, 783,780 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +448 B (+0.1%, 302,088 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +448 B (+0.1%, 332,896 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +512 B (+0.2%, 242,639 B / 262,144 B, total: 93% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +448 B (+0.1%, 303,048 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +448 B (+0.2%, 242,639 B / 262,144 B, total: 93% used)

linuxkm-pie

• Data: __patchable_function_entries +40 B (+0.1%, 27,040 B)

linuxkm-standard

• Data: __patchable_function_entries +48 B (+0.1%, 49,848 B)

stm32-sim-stm32h753

• FLASH: .text +24 B (+0.0%, 188,604 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7