From 6740f4e978542ef503e7e948b99ebb1ca35b3f25 Mon Sep 17 00:00:00 2001
From: Pierre Warnier <pierre@warnier.net>
Date: Tue, 15 Sep 2026 11:28:37 +0200
Subject: [PATCH] release: make apt non-interactive in the build container

The 0.5.1 pipeline failed on both architectures before building
anything: dist installs the apt dependencies from dist-workspace.toml
with a plain `apt-get install`, no `-y`, and inside the buildpack-deps
container apt asked "Do you want to continue?" and answered itself
"Abort". The step is generated by dist and takes no flags (axodotdev/
cargo-dist#2353); on GitHub's own runners it works only because their
apt is configured to assume yes, which the container's is not. The
same workflow built 0.5.0 eight days earlier on an earlier build of the
same image.

dist's github-build-setup inserts steps into every build job before it
installs dist and its dependencies. The one added here configures apt
the way the runners do and sets DEBIAN_FRONTEND, in the container, so
dist's own line succeeds whatever the image does. Verified by running
the step and then dist's exact apt line, stdin closed, in
buildpack-deps:22.04: libpam0g-dev installs, exit 0.

release.yml regenerated with dist 0.33.0; the diff is the inserted
step.
---
 .github/workflows/build-setup.yml | 13 +++++++++++++
 .github/workflows/release.yml     |  4 ++++
 dist-workspace.toml               |  3 +++
 3 files changed, 20 insertions(+)
 create mode 100644 .github/workflows/build-setup.yml

diff --git a/.github/workflows/build-setup.yml b/.github/workflows/build-setup.yml
new file mode 100644
index 0000000..fb0477a
--- /dev/null
+++ b/.github/workflows/build-setup.yml
@@ -0,0 +1,13 @@
+# Steps dist inserts into each build job before it installs the apt
+# dependencies from dist-workspace.toml and runs `dist build`.
+#
+# dist runs `apt-get install` without `-y`. On GitHub's own runners that is
+# harmless, because their apt is configured to assume yes; inside the
+# buildpack-deps container the builds use, it is not, and apt answered its
+# own "Do you want to continue?" with "Abort" -- which is how the 0.5.1
+# pipeline failed on both architectures. Configure apt the way the runners
+# do, in the container, before dist gets to it.
+- name: Make apt non-interactive in the build container
+  run: |
+    printf 'APT::Get::Assume-Yes "true";\n' > /etc/apt/apt.conf.d/90-assume-yes
+    echo "DEBIAN_FRONTEND=noninteractive" >> "$GITHUB_ENV"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5388a3..48fbeaa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -126,6 +126,10 @@ jobs:
             curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
             echo "$HOME/.cargo/bin" >> $GITHUB_PATH
           fi
+      - name: "Make apt non-interactive in the build container"
+        run: |
+          printf 'APT::Get::Assume-Yes "true";\n' > /etc/apt/apt.conf.d/90-assume-yes
+          echo "DEBIAN_FRONTEND=noninteractive" >> "$GITHUB_ENV"
       - name: Install dist
         run: ${{ matrix.install_dist.run }}
       # Get the dist-manifest
diff --git a/dist-workspace.toml b/dist-workspace.toml
index f888fa7..209cc10 100644
--- a/dist-workspace.toml
+++ b/dist-workspace.toml
@@ -24,6 +24,9 @@ features = ["pam"]
 # alongside the CI workflow. `ci.yml` builds the static musl archive on every
 # pull request, which is the release step that can actually break.
 pr-run-mode = "skip"
+# Steps run in each build job before the apt dependencies below are installed:
+# see the file for why.
+github-build-setup = "build-setup.yml"
 
 # Ship only the multicall binary. `shadow-rs-completions` is a build-time
 # helper behind `required-features = ["completions"]`, so it is not part of a