From a96677cd07e34202d1a1319d485953ab4c4ebd23 Mon Sep 17 00:00:00 2001
From: Thales <>
Date: Wed, 24 Jun 2026 20:03:59 +0100
Subject: [PATCH] fix(ci): make Linux apt step best-effort and hard-capped

The Linux release job hung for 30+ min on 'install build dependencies':
apt-get stalled on the persistent wsl2 runner (likely a dpkg lock held by
unattended-upgrades). The packages are already installed on that runner
from prior runs, so the install itself is a no-op -- the hang is in
apt-get update / lock acquisition.

Bound the apt commands with  and DPkg::Lock::Timeout so a stuck
lock cannot hang the release, set DEBIAN_FRONTEND=noninteractive to avoid
debconf prompts, treat apt as best-effort, then verify webkit2gtk-4.1 is
actually present (fail loudly only if genuinely missing).
---
 .github/workflows/linux-release.yml | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/linux-release.yml b/.github/workflows/linux-release.yml
index 7f10182e..085c16ce 100644
--- a/.github/workflows/linux-release.yml
+++ b/.github/workflows/linux-release.yml
@@ -36,14 +36,31 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
 
       - name: install build dependencies
+        env:
+          DEBIAN_FRONTEND: noninteractive
         run: |
-          sudo apt-get update
           # Tauri v2 build deps + tooling. webkit2gtk-4.1 matches the tauri = "2"
           # crate; ffmpeg is a runtime dependency, not bundled.
-          sudo apt-get install -y --no-install-recommends \
+          #
+          # apt is best-effort and hard-capped here: on the persistent self-hosted
+          # runner these packages are usually already installed, and a stuck dpkg
+          # lock (e.g. unattended-upgrades) must not hang the release for 90 min.
+          # `timeout` bounds the wall time; DPkg::Lock::Timeout bounds lock waits;
+          # we then verify the critical library is actually present and fail only
+          # if it is genuinely missing.
+          sudo timeout 420 apt-get update -o DPkg::Lock::Timeout=120 \
+            || echo "apt-get update did not finish in time; continuing"
+          sudo timeout 600 apt-get install -y --no-install-recommends -o DPkg::Lock::Timeout=120 \
             build-essential curl file wget libssl-dev libxdo-dev \
             libwebkit2gtk-4.1-dev libgtk-3-dev \
-            libayatana-appindicator3-dev librsvg2-dev
+            libayatana-appindicator3-dev librsvg2-dev \
+            || echo "apt-get install did not finish in time; continuing"
+          if ! pkg-config --exists webkit2gtk-4.1; then
+            echo "ERROR: webkit2gtk-4.1 is not available and apt could not install it." >&2
+            echo "Install the Tauri build deps on the runner, then re-run." >&2
+            exit 1
+          fi
+          echo "Build dependencies present."
 
       - name: install uv
         run: |