[nichenqin]

Summary

 checkout Lab + pinned EE revision
+ select an independent Ubuntu archive before runtime bootstrap
  install Chromium --with-deps
  run the unchanged bug-case plan

Issue ID: T8500
Case ID: Y4527
Defect ID on Case: T8500
The internal acceptance record is maintained in the companion private EE repair packet; no internal URLs, credentials or customer data are added to this public repository.

Requirement and problem

Keep browser provisioning working when the runner cannot resolve its default Ubuntu mirror group. Real Lab and frontend runs failed at system-dependency installation before browser cases. All default candidates share ubuntu.com; replacing Azure with another member alone is not established as sufficient.

Change boundary

• Select Kernel.org's Ubuntu archive first, retaining canonical archive/security fallbacks and APT's native failover. Priority metadata uses a literal tab.
• Only the runner mirror-list file changes when present. Repository suites/components, Ubuntu signing keyring, TLS policy, DNS/hosts, dependency versions, browser gates and case selectors stay unchanged.
• Place this in Lab's own workflow before bootstrap. Historical EE comparison commits must not be required to contain a new provisioning helper.
• Companion private EE PR4527: branch T8500-ci-ubuntu-mirror @ 5cee7c7ceac3ca9089068c48060db09338b8a260, applying the same archive selection before its existing native-package cache. No generated enterprise workflow copies are edited.

Base: main @ e4c31bd
Head: 63a1fe6
Stacked on: none.

Evidence

• Before: Lab provisioning failure, at playwright install --with-deps chromium; frontend provisioning failure, repeated on its failed-job rerun. These are not product assertion verdicts.
• After, installer-level: isolated Ubuntu24 x86_64, Node24.22.2, pnpm12.11.2, Playwright1.57.0. With Ubuntu-domain DNS deliberately still returning EAI_AGAIN, real signed APT metadata, OS dependencies and Chromium downloads completed through Kernel.org; source/keyring hashes were unchanged. A fresh all-mirrors-down provision still failed.
• Local limitation retained: bundled x86_64 Chromium launch failed under ARM/QEMU. Native UI acceptance separately uses the existing Playwright Chromium-type channel: "chrome"; this proves real Chrome-family UI execution, not that the downloaded bundled Chromium binary was launched.
• actionlint .github/workflows/e2e-lab.yml, YAML/Bash validation, and the repository-required full pnpm check passed. No case, registry, checkpoint, test filter or acceptance gate changed. Local fault-injection artifacts are not committed.

Sources: Kernel.org operator and Ubuntu archive, official APT mirror metadata/failover format. Kernel.org is independently operated, not Canonical-owned; changing transport does not replace Ubuntu archive authentication.

CI: required source checks passed (pnpm check and the existing CLA check). Native companion-branch acceptance passed at https://github.com/teableio/teable-e2e-lab/actions/runs/43049939045, using Lab 63a1fe6280fb58752973bcdca0d2d5366aa3d5ef and EE 5cee7c7ceac3ca9089068c48060db09338b8a260. Real dependency/browser setup and the complete plan ran; the downloaded report has passed=true, 262 rows and zero missing/duplicate/unplanned/unknown-verdict/regression/error entries. This is not an A6 main-harness pass and does not merge/deploy the workflow.
Review: 2 independent blank-context reviews, no findings across both repository deltas. They inspected source and real installer evidence without promoting the local QEMU failure to browser-green. Human approval and QA sign-off remain separate; Parker-fi review is requested.

Where to verify / Acceptance

With authorized GitHub CLI, use this Lab source branch and the companion EE repair commit:

gh workflow run e2e-lab.yml --repo teableio/teable-e2e-lab \
  --ref T8500-ci-ubuntu-mirror \
  -f teable_ee_commits=5cee7c7ceac3ca9089068c48060db09338b8a260 \
  -f case_filter=all

Pass: Ubuntu24 native runner actually installs system/browser dependencies and executes the original complete case plan, including browser-driven cases; the report has no missing cells, and required source checks pass. Fail: skipped dependency installation, swallowed APT errors, altered trust/TLS, reduced case scope, missing evidence, or any required failed/pending check. This is a companion-branch harness proof, not a claim that the main harness or A6 head is already green.

Merge Danger

Door: two-way — revert a runner-local mirror-list selection; no product data/schema change.

Blast Radius: provisioning — every selected EE revision in this workflow, including historical commits. Existing Ubuntu authentication and native APT failover remain intact. Normal maintainer approval is required; this PR does not merge or deploy itself.