ci: drop unused Chrome/Microsoft apt sources before apt-get update

.github/scripts/ci-drop-third-party-apt-sources.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+#
+# Drop third-party apt sources that GitHub's ubuntu-* images ship and that we
+# never install from. Those repos (Google Chrome, Microsoft) periodically serve
+# a Packages.gz whose hash does not match the signed Release file, so any
+# `apt-get update` — even one that only wants build-essential — fails the job.
+#
+# Safe on any ubuntu-* runner: every removal is guarded so a change to the
+# runner image layout can never fail the job. Filenames are globbed so a
+# renamed chrome/microsoft list still gets dropped.
+set -euo pipefail
+
+# Unmatched globs must not be treated as literal paths.
+shopt -s nullglob
+
+for src in /etc/apt/sources.list.d/*google*.list /etc/apt/sources.list.d/*google*.sources \
+  /etc/apt/sources.list.d/*microsoft*.list /etc/apt/sources.list.d/*microsoft*.sources; do
+  echo "Removing $src"
+  sudo rm -f "$src" || true
+done

.github/workflows/cross-arch-build.yml

@@ -31,6 +31,7 @@ jobs:
 
       - name: Install system dependencies
         run: |
+          bash .github/scripts/ci-drop-third-party-apt-sources.sh
           sudo apt-get update
           sudo apt-get install -y build-essential
 
@@ -70,6 +71,7 @@ jobs:
 
       - name: Install system dependencies
         run: |
+          bash .github/scripts/ci-drop-third-party-apt-sources.sh
           sudo apt-get update
           sudo apt-get install -y build-essential
 

.github/workflows/rocksdb-unit_tests.yml

@@ -26,6 +26,7 @@ jobs:
 
       - name: Install RocksDB dependencies
         run: |
+          bash .github/scripts/ci-drop-third-party-apt-sources.sh
           sudo apt-get update
           sudo apt-get install -y build-essential pkg-config cmake git zlib1g-dev libbz2-dev libsnappy-dev liblz4-dev libzstd-dev libjemalloc-dev libgflags-dev liburing-dev