From c24bc49278e4ee3992d3629faaf3a519c84b495e Mon Sep 17 00:00:00 2001
From: Thales <>
Date: Wed, 24 Jun 2026 20:27:38 +0100
Subject: [PATCH] fix(ci): skip apt when deps present; the runner has no
 passwordless sudo

Root cause of the Linux apt hang: the wsl2 self-hosted runner does not
have passwordless sudo, so 'sudo apt-get' blocks forever at the password
prompt. The previous 'sudo timeout ... apt-get' guard did nothing because
sudo prompts BEFORE the inner timeout can start.

Since the build deps are already installed on the persistent runner, check
each package with dpkg (no sudo) and skip apt entirely when all are present.
Only touch apt if something is genuinely missing, using 'sudo -n' so it
fails fast with a clear message instead of hanging at a prompt.
---
 .github/workflows/linux-release.yml | 39 ++++++++++++++++-------------
 1 file changed, 22 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml
index 085c16ce..fe4e871f 100644
--- a/.github/workflows/linux-release.yml
+++ b/.github/workflows/linux-release.yml
@@ -42,25 +42,30 @@ jobs:
           # Tauri v2 build deps + tooling. webkit2gtk-4.1 matches the tauri = "2"
           # crate; ffmpeg is a runtime dependency, not bundled.
           #
-          # apt is best-effort and hard-capped here: on the persistent self-hosted
-          # runner these packages are usually already installed, and a stuck dpkg
-          # lock (e.g. unattended-upgrades) must not hang the release for 90 min.
-          # `timeout` bounds the wall time; DPkg::Lock::Timeout bounds lock waits;
-          # we then verify the critical library is actually present and fail only
-          # if it is genuinely missing.
-          sudo timeout 420 apt-get update -o DPkg::Lock::Timeout=120 \
-            || echo "apt-get update did not finish in time; continuing"
-          sudo timeout 600 apt-get install -y --no-install-recommends -o DPkg::Lock::Timeout=120 \
-            build-essential curl file wget libssl-dev libxdo-dev \
-            libwebkit2gtk-4.1-dev libgtk-3-dev \
-            libayatana-appindicator3-dev librsvg2-dev \
-            || echo "apt-get install did not finish in time; continuing"
-          if ! pkg-config --exists webkit2gtk-4.1; then
-            echo "ERROR: webkit2gtk-4.1 is not available and apt could not install it." >&2
-            echo "Install the Tauri build deps on the runner, then re-run." >&2
+          # The self-hosted runner does NOT have passwordless sudo, so a bare
+          # `sudo apt-get` hangs forever at the password prompt. These packages are
+          # already installed on the persistent runner, so check first (dpkg needs
+          # no sudo) and skip apt entirely when everything is present. Only if a
+          # package is genuinely missing do we touch apt, via `sudo -n` (fails fast
+          # instead of prompting) so a release never hangs on sudo again.
+          PKGS="build-essential curl file wget libssl-dev libxdo-dev \
+            libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev librsvg2-dev"
+          missing=""
+          for p in $PKGS; do
+            dpkg -s "$p" >/dev/null 2>&1 || missing="$missing $p"
+          done
+          if [ -z "$missing" ]; then
+            echo "All build dependencies already installed; skipping apt."
+            exit 0
+          fi
+          echo "Missing packages:$missing"
+          if ! sudo -n true 2>/dev/null; then
+            echo "ERROR: build deps missing and passwordless sudo is not available." >&2
+            echo "Install on the runner:  sudo apt-get install -y$missing" >&2
             exit 1
           fi
-          echo "Build dependencies present."
+          sudo -n apt-get update -o DPkg::Lock::Timeout=120
+          sudo -n apt-get install -y --no-install-recommends -o DPkg::Lock::Timeout=120 $missing
 
       - name: install uv
         run: |