.github/workflows/admin-web-docker.yml

@@ -30,7 +30,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Install Docker CLI
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq docker.io
+        run: apt-get update -qq && apt-get install -y -qq docker.io
 
       - name: Build admin-web image (no push)
         env:
@@ -118,7 +118,7 @@ jobs:
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: Install Docker CLI
-        run: sudo apt-get update -qq && sudo apt-get install -y -qq docker.io
+        run: apt-get update -qq && apt-get install -y -qq docker.io
 
       - name: Login to Gitea registry
         # Secret referenced via env (never inline in the run command) so it

scripts/verify-admin-web-docker.sh

@@ -472,6 +472,23 @@ check_actions_pinned() {
   fi
 }
 
+# --- workflow: no sudo (runner Gitea ubuntu-latest = root, pas de binaire sudo) -- #
+check_no_sudo() {
+  local f=".github/workflows/admin-web-docker.yml"
+  local label="workflow contains no 'sudo' (runner Gitea ubuntu-latest is root without sudo)"
+  if [[ ! -f "$f" ]]; then
+    fail "$label" "file missing"
+    return
+  fi
+  local count
+  count=$(grep -Ec '\bsudo\b' "$f" || true)
+  if [[ "$count" -eq 0 ]]; then
+    pass "$label"
+  else
+    fail "$label" "found $count occurrence(s) of 'sudo'"
+  fi
+}
+
 # --- git context --------------------------------------------------- #
 check_git_branch() {
   local label="current branch = feat/admin-web-docker"
@@ -643,6 +660,7 @@ check_push_tags
 check_forbidden_secrets
 check_buildargs_source
 check_actions_pinned
+check_no_sudo
 check_git_branch
 check_git_commit_prefix
 # PR build-validation feature checks