From 1edc542b55f61f57686d82ab1830a596127e25d9 Mon Sep 17 00:00:00 2001
From: Emily Hedlund <ehedlund@google.com>
Date: Tue, 31 Mar 2026 14:19:48 -0400
Subject: [PATCH] ci: install bubblewrap on Linux for release workflows
 (#24347)

---
 .github/actions/run-tests/action.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/actions/run-tests/action.yml b/.github/actions/run-tests/action.yml
index 2f5c0de140..42fd78d7e9 100644
--- a/.github/actions/run-tests/action.yml
+++ b/.github/actions/run-tests/action.yml
@@ -18,6 +18,13 @@ runs:
       env:
         JSON_INPUTS: '${{ toJSON(inputs) }}'
       run: 'echo "$JSON_INPUTS"'
+    - name: 'Install system dependencies'
+      if: "runner.os == 'Linux'"
+      run: |
+        sudo apt-get update -qq && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq bubblewrap
+        # Ubuntu 24.04+ requires this to allow bwrap to function in CI
+        sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
+      shell: 'bash'
     - name: 'Run Tests'
       env:
         GEMINI_API_KEY: '${{ inputs.gemini_api_key }}'