Why does Puppet need two runs to update bash?

Im learning puppet, and Im trying to update bash (no prizes for guessing why).

This is in my site.pp

       file { "/etc/apt/sources.list.d/shellshock.list":
            source  => "puppet:///files/shellshock.list",
            owner   => "root",
            group   => "root",
            mode    => "0644", 
            ensure  => present,
    } 

    ->
exec { "instantRepoUpdate":
        command          => "/usr/bin/aptitude update",
        refreshonly  => true,
}
    ->
    package {"bash": ensure => latest, }

From what Im reading here https://docs.puppetlabs.com/puppet/latest/reference/lang_relationships.html

That should translate to:

Install /etc/apt/sources.list.d/shellshock.list, then run aptitude update, then make sure bash is on the latest version

It does, but only over two runs of the agent. I want it to perform all three actions, in order, in one run.

UPDATE: I've tried adding "require => Exec[.., require => File[..." to the exec and package resources, I get the same result.

Answer

You set refreshonly => true and as such you need to use a notification arrow instead (~>).