[JacobStephens2]

Summary

Ubuntu hostnames fail through hosted-runner DNS while public resolvers still answer. This stopped the 0.29.0 WSL smoke job three times, and also blocks musl/Playwright dependency installation on Linux runners.

before Ubuntu dependency setup
  resolve Ubuntu hosts through runner DNS
  if resolution fails:
    use public DNS on this disposable runner
    require Ubuntu hosts to resolve
  run existing dependency setup and required checks

Linux dependency jobs share scripts/release-dns.sh; it refuses to change DNS outside GitHub Actions. Windows WSL setup changes the active adapters' DNS before creating the Linux distribution. Healthy DNS uses the existing resolver. No hardcoded server addresses for Ubuntu, certificate exceptions or skipped checks are added.

The cargo-dist workflow is regenerated through its generator. Its regression test verifies the DNS step precedes dependency installation.

Evidence

• Before: Release workflow 43032347537, attempts 1–3: getaddrinfo EAI_AGAIN releases.ubuntu.com; WSL never reached the binary test. Other release PR runs report the same failure resolving Ubuntu package mirrors.
• Before: system DNS returns SERVFAIL for Ubuntu hosts; dig @1.1.1.1 releases.ubuntu.com A returns addresses, and an HTTPS probe against a returned address succeeds with normal certificate verification.
• After, isolated execution: the actual Linux helper, run with a private resolv.conf mounted inside a read-only bwrap environment, recovers from the failing system resolver and exits 0. With working DNS it exits 0 without changing the resolver. Outside GitHub Actions it refuses a DNS change and exits 1. The host resolver is untouched by these probes.
• python3 -m unittest discover -s scripts -p 'test_*.py': 59 passed.
• python3 scripts/generate-release.py --check: passed.
• bash -n scripts/release-dns.sh and git diff --check: passed.
• Hosted Release validation: passed all builds and ARM/Rocky/WSL smoke checks. Windows logs confirm the fallback activated before the successful WSL2 binary check. Console and site browser checks passed.
• Hosted CI: passed; 4,233 Rust tests passed, 97 skipped (nextest: 1,498.475 seconds), plus Console/site browser checks.
• scripts/affected-tests origin/main was started locally; the redundant Rust run was stopped after the exact-head hosted suite passed, following the repository's CI-reuse guidance.

Merge Danger

Door: two-way

Changes only resolver configuration on disposable CI runners, with no DNS change on the healthy path.

Blast Radius: CI

Ubuntu dependency acquisition for release builds, Console/site browser tests and WSL smoke setup. All binary checks, publication gates and tag/merge ordering remain required.