fix(ci): drop the runner's Microsoft apt repos before updating

[Grantmartin2002]

Description

This run failed because apt-get update hit a 403 from packages.microsoft.com:

E: Failed to fetch https://packages.microsoft.com/repos/azure-cli/dists/noble/InRelease  403  Forbidden
E: The repository 'https://packages.microsoft.com/ubuntu/24.04/prod noble InRelease' is no longer signed.

The runner image preinstalls both repos. Wails uses neither, so this deletes the two list files before apt-get update instead of leaving CI dependent on an unrelated host. Applied to all 10 apt-get update sites across the 5 workflows.

Fixes #6040

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update

How Has This Been Tested?

CI on this PR exercises the changed steps on every ubuntu leg. rm -f is idempotent, so it is a no-op if the files are ever dropped from the image.

• Windows
• macOS
• Linux

Test Configuration

Not applicable, workflow-only change. Runners are ubuntu-latest, ubuntu-24.04 and ubuntu-22.04.

Checklist:

• (v2 only) I have updated website/src/pages/changelog.mdx with details of this PR (v3 changelog entries are added automatically)
• My code follows the general coding style of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

Summary by CodeRabbit

• Bug Fixes

  • Improved reliability of Linux dependency installation across build, test, and cross-compilation workflows.
  • Prevented unrelated package repositories from interfering with system package updates.
  • Reduced the risk of installation failures across supported Ubuntu environments.

• Chores

  • Standardized dependency setup across automated workflows for more consistent build and test results.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 39ba04a7-9a81-4b6f-96ee-7ca62311dd67

📥 Commits

Reviewing files that changed from the base of the PR and between a8776fa and b3bdfa8.

📒 Files selected for processing (6)

• .github/scripts/prune-runner-apt-sources.sh
• .github/workflows/build-and-test-v3.yml
• .github/workflows/build-and-test.yml
• .github/workflows/build-cross-image.yml
• .github/workflows/cross-compile-test-v3.yml
• .github/workflows/pr-master.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/build-cross-image.yml

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

Walkthrough

The CI workflows now use a shared script to remove unused Microsoft and Azure CLI APT source lists before apt-get update. The script changes sources only on GitHub-hosted runners and exits without changes under act or other environments.

Changes

CI APT cleanup

Layer / File(s)	Summary
Conditional APT source removal .github/scripts/prune-runner-apt-sources.sh	The new script removes microsoft-prod.list and azure-cli.list on GitHub-hosted runners. It exits successfully without changes under act or outside GitHub-hosted runners.
Workflow integration .github/workflows/build-and-test*.yml, .github/workflows/build-cross-image.yml, .github/workflows/cross-compile-test-v3.yml, .github/workflows/pr-master.yml	Ubuntu dependency setup steps invoke the shared script before apt-get update for Go tests, template tests, image builds, cross-compilation tests, and pull request builds.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to b3bdf

This workflow-only change removes unrelated Microsoft apt sources before package updates on hosted Ubuntu runners. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: leaanthony

Poem

A rabbit clears two lists away
Before the indexes start their day
Hosted runners prune with care
Local hops leave sources there
Clean updates guide CI’s way

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main CI change: removing the runner's Microsoft APT repositories before package index updates.
Description check	✅ Passed	The description explains the failure, motivation, affected workflows, implementation, testing scope, issue link, change type, and checklist status. The missing local unit-test and wails doctor details…
Linked Issues check	✅ Passed	The changes satisfy issue #6040 by removing the unused Microsoft and Azure CLI APT source files before apt-get update on GitHub-hosted runners. The shared script also skips self-hosted, local, and act…
Out of Scope Changes check	✅ Passed	All changes are limited to the five CI workflows and the shared APT cleanup script. They directly support the linked issue and stated CI objectives, with no unrelated code or documentation changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

Full details: Description check

Explanation

The description explains the failure, motivation, affected workflows, implementation, testing scope, issue link, change type, and checklist status. The missing local unit-test and wails doctor details are reasonable for a workflow-only change.

Full details: Linked Issues check

Explanation

The changes satisfy issue #6040 by removing the unused Microsoft and Azure CLI APT source files before apt-get update on GitHub-hosted runners. The shared script also skips self-hosted, local, and act environments as required.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (5 skipped: 5 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[leaanthony]

Thanks for tracking this down — the 403 diagnosis is right and dropping the repos is the correct call for CI. One thing before it lands, though.

The sudo rm -f /etc/apt/sources.list.d/... is unconditional, so it also fires when these workflows are run anywhere other than a throwaway GitHub-hosted VM:

• act -P ubuntu-latest=-self-hosted runs steps directly on the host, so this deletes real apt sources from a contributor's machine — anyone with the Azure CLI installed silently loses its repo and its updates.
• With act's default catthehacker/ubuntu:* images the damage is confined to the container, but it persists across --reuse.
• Same exposure on a self-hosted runner, if we ever add one.

Suggestion: gate the removal on actually being on a GitHub-hosted runner. RUNNER_ENVIRONMENT is github-hosted only on GitHub's own runners (self-hosted otherwise), and act sets ACT=true:

#!/usr/bin/env bash
set -euo pipefail

if [ "${ACT:-}" = "true" ] || [ "${RUNNER_ENVIRONMENT:-}" != "github-hosted" ]; then
  echo "Leaving apt sources untouched (ACT=${ACT:-unset}, RUNNER_ENVIRONMENT=${RUNNER_ENVIRONMENT:-unset})."
  exit 0
fi

sudo rm -f /etc/apt/sources.list.d/microsoft-prod.list /etc/apt/sources.list.d/azure-cli.list

That fails closed on purpose: if RUNNER_ENVIRONMENT were ever missing, CI goes back to the visible 403 rather than quietly editing somebody's machine.

Putting it in .github/scripts/prune-runner-apt-sources.sh also collapses the ten copies of the command down to one call site each, so a future apt step can't pick up an unguarded version:

run: |
  # Drop the runner image's unused Microsoft apt repos (no-op off GitHub-hosted runners).
  ./.github/scripts/prune-runner-apt-sources.sh
  sudo apt-get update -qq

Every apt step already runs after actions/checkout, so the script is on disk by then (committed mode 100755).

I've pushed exactly that on top of your commit — cd9a7ad on branch claude/wails-apt-sources-act-7u7iqk — if you'd like to cherry-pick it rather than retype it:

git remote add upstream https://github.com/wailsapp/wails
git fetch upstream claude/wails-apt-sources-act-7u7iqk
git cherry-pick cd9a7ad

All five workflows still parse, and the script was exercised against a stubbed sudo for github-hosted (prunes), self-hosted, unset, and ACT=true (all no-op, exit 0).

Also worth merging master in before the next CI run — the PR is currently behind.

---

Generated by Claude Code

[Grantmartin2002]

Cherry-picked cd9a7ad and merged master in, thanks for the catch.