From 46d95661cee2f89088cdc3f7d08a54c60c1f84a7 Mon Sep 17 00:00:00 2001
From: Millian Lamiaux <millian.lamiaux@adeo.com>
Date: Mon, 13 Jul 2026 14:15:32 +0200
Subject: [PATCH] =?UTF-8?q?fix(ci):=20remove=20sudo=20from=20docker=20inst?=
 =?UTF-8?q?all=20=E2=80=94=20Gitea=20ubuntu=20runner=20is=20root=20without?=
 =?UTF-8?q?=20sudo?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/admin-web-docker.yml |  4 ++--
 scripts/verify-admin-web-docker.sh     | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/admin-web-docker.yml b/.github/workflows/admin-web-docker.yml
index ec01bc0..c10a200 100644
--- a/.github/workflows/admin-web-docker.yml
+++ b/.github/workflows/admin-web-docker.yml
@@ -30,7 +30,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Install Docker CLI
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq docker.io
+        run: apt-get update -qq && apt-get install -y -qq docker.io
 
       - name: Build admin-web image (no push)
         env:
@@ -118,7 +118,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Install Docker CLI
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq docker.io
+        run: apt-get update -qq && apt-get install -y -qq docker.io
 
       - name: Login to Gitea registry
         # Secret referenced via env (never inline in the run command) so it
diff --git a/scripts/verify-admin-web-docker.sh b/scripts/verify-admin-web-docker.sh
index 0596d92..cd410ad 100755
--- a/scripts/verify-admin-web-docker.sh
+++ b/scripts/verify-admin-web-docker.sh
@@ -472,6 +472,23 @@ check_actions_pinned() {
   fi
 }
 
+# --- workflow: no sudo (runner Gitea ubuntu-latest = root, pas de binaire sudo) -- #
+check_no_sudo() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="workflow contains no 'sudo' (runner Gitea ubuntu-latest is root without sudo)"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local count
+  count=$(grep -Ec '\bsudo\b' "$f" || true)
+  if [[ "$count" -eq 0 ]]; then
+    pass "$label"
+  else
+    fail "$label" "found $count occurrence(s) of 'sudo'"
+  fi
+}
+
 # --- git context --------------------------------------------------- #
 check_git_branch() {
   local label="current branch = feat/admin-web-docker"
@@ -643,6 +660,7 @@ check_push_tags
 check_forbidden_secrets
 check_buildargs_source
 check_actions_pinned
+check_no_sudo
 check_git_branch
 check_git_commit_prefix
 # PR build-validation feature checks