From 6649a81f0c4b6acf8be8e84a10ca233ebbeb5bfb Mon Sep 17 00:00:00 2001
From: "wugou.cyf" <wugou.cyf@antfin.com>
Date: Thu, 16 Jul 2026 15:33:36 +0800
Subject: [PATCH 1/3] ci: harden ARM64 CUDA package installation

---
 .github/workflows/ci.yml | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fc62fdf7c1..ddc7d1e199 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -355,10 +355,29 @@ jobs:
 
     - name: Install CUDA Toolkit 13.0 (arm64 SBSA)
       run: |
-        wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/sbsa/cuda-keyring_1.1-1_all.deb
+        for source_file in \
+          /etc/apt/sources.list \
+          /etc/apt/sources.list.d/*.list \
+          /etc/apt/sources.list.d/*.sources; do
+          if [[ -f "$source_file" ]]; then
+            sudo sed -i \
+              's|http://ports.ubuntu.com/ubuntu-ports|https://ports.ubuntu.com/ubuntu-ports|g' \
+              "$source_file"
+          fi
+        done
+
+        apt_options=(
+          -o Acquire::ForceIPv4=true
+          -o Acquire::Retries=3
+          -o Acquire::http::Timeout=30
+          -o Acquire::https::Timeout=30
+        )
+
+        wget --inet4-only --tries=3 --timeout=30 \
+          https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/sbsa/cuda-keyring_1.1-1_all.deb
         sudo dpkg -i cuda-keyring_1.1-1_all.deb
-        sudo apt-get update
-        sudo apt-get install -y cuda-toolkit-13-0
+        sudo apt-get "${apt_options[@]}" update
+        sudo apt-get "${apt_options[@]}" install -y cuda-toolkit-13-0
         echo "/usr/local/cuda/bin" >> $GITHUB_PATH
         /usr/local/cuda/bin/nvcc --version
       shell: bash

From 572f77c3da093fda2ed5b101722a95eb393443c6 Mon Sep 17 00:00:00 2001
From: "wugou.cyf" <wugou.cyf@antfin.com>
Date: Thu, 16 Jul 2026 16:13:11 +0800
Subject: [PATCH 2/3] ci: guard Docker builds against disk exhaustion

---
 .github/workflows/ci.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ddc7d1e199..f4a2564654 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -799,16 +799,38 @@ jobs:
       with:
         persist-credentials: false
 
+    - name: Free up disk space
+      run: |
+        echo "Disk usage before cleanup:"
+        df -h
+        docker system df || true
+
+        sudo rm -rf /usr/share/dotnet
+        sudo rm -rf /opt/ghc
+        sudo rm -rf /opt/hostedtoolcache/CodeQL
+        docker system prune --all --force --volumes
+
+        echo "Disk usage after cleanup:"
+        df -h
+        docker system df || true
+
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v2
 
     - name: Build Docker image
       run: |
-        docker build -f docker/mooncake.Dockerfile \
+        docker build --progress=plain -f docker/mooncake.Dockerfile \
           --build-arg PYTHON_VERSION=3.10 \
+          --build-arg CMAKE_BUILD_TYPE=Release \
           --build-arg EP_TORCH_VERSIONS="2.12.1" \
           -t mooncake:from-source .
 
+    - name: Report final disk usage
+      if: always()
+      run: |
+        df -h
+        docker system df || true
+
   spell-check:
     name: Spell Check with Typos
     if: >-

From 3c73857191b209669a1ad9215fca5126d7925265 Mon Sep 17 00:00:00 2001
From: "wugou.cyf" <wugou.cyf@antfin.com>
Date: Thu, 16 Jul 2026 20:21:46 +0800
Subject: [PATCH 3/3] ci: persist ARM64 network hardening

---
 .github/workflows/ci.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f4a2564654..50d886cd10 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -366,18 +366,18 @@ jobs:
           fi
         done
 
-        apt_options=(
-          -o Acquire::ForceIPv4=true
-          -o Acquire::Retries=3
-          -o Acquire::http::Timeout=30
-          -o Acquire::https::Timeout=30
-        )
+        sudo tee /etc/apt/apt.conf.d/99mooncake-ci-network >/dev/null <<'EOF'
+        Acquire::ForceIPv4 "true";
+        Acquire::Retries "3";
+        Acquire::http::Timeout "30";
+        Acquire::https::Timeout "30";
+        EOF
 
         wget --inet4-only --tries=3 --timeout=30 \
           https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/sbsa/cuda-keyring_1.1-1_all.deb
         sudo dpkg -i cuda-keyring_1.1-1_all.deb
-        sudo apt-get "${apt_options[@]}" update
-        sudo apt-get "${apt_options[@]}" install -y cuda-toolkit-13-0
+        sudo apt-get update
+        sudo apt-get install -y cuda-toolkit-13-0
         echo "/usr/local/cuda/bin" >> $GITHUB_PATH
         /usr/local/cuda/bin/nvcc --version
       shell: bash
@@ -808,6 +808,7 @@ jobs:
         sudo rm -rf /usr/share/dotnet
         sudo rm -rf /opt/ghc
         sudo rm -rf /opt/hostedtoolcache/CodeQL
+        sudo rm -rf /usr/local/lib/android
         docker system prune --all --force --volumes
 
         echo "Disk usage after cleanup:"
@@ -821,7 +822,6 @@ jobs:
       run: |
         docker build --progress=plain -f docker/mooncake.Dockerfile \
           --build-arg PYTHON_VERSION=3.10 \
-          --build-arg CMAKE_BUILD_TYPE=Release \
           --build-arg EP_TORCH_VERSIONS="2.12.1" \
           -t mooncake:from-source .