lint: don't let the runner's Chrome apt source fail the libsecret install

[shreyav]

Summary

The Lint Code & Documentation job runs sudo apt-get update && sudo apt-get install -y libsecret-1-dev before anything else. apt-get update exits non-zero if any configured source fails a hash check — and the ubuntu-latest runner image ships Google's Chrome apt source, which this job never installs from.

When that mirror is mid-republish it serves a Packages.gz that doesn't match its own Release file, and the whole job dies in setup before npm ci or a single lint rule runs. That happened on #919 twice in a row today, ten minutes apart, with the identical hash mismatch both times:

E: Failed to fetch https://dl.google.com/linux/chrome-stable/deb/dists/stable/main/binary-amd64/Packages.gz  Hash Sum mismatch
   Last modification reported: Wed, 09 Sep 2026 09:41:12 +0000
   Release file created at: Wed, 09 Sep 2026 17:16:59 +0000
##[error]Process completed with exit code 100.

Every check that actually exercises the spec on that PR — breaking-change detection, both OpenAPI builds, preview, Mintlify — was green. The lint job was red only because an unrelated third-party mirror had a veto over it.

What changed

One step. The Chrome apt source list is removed before apt-get update:

sudo rm -f /etc/apt/sources.list.d/google-chrome*.list
sudo apt-get update && sudo apt-get install -y libsecret-1-dev

Nothing about what gets installed changes. libsecret-1-dev still installs from Ubuntu's own archive; a mirror this job doesn't use just loses the ability to fail it.

Test plan

• The workflow YAML parses; the job still has six steps and the install step still references libsecret-1-dev.
• This is the standard mitigation for this runner-image behaviour, and it's purely subtractive — it can't make the install pull from anywhere it didn't already.
• Worth knowing for review: .github/workflows/ is not in the Lint workflow's own paths: filter, so the real lint job won't run on this PR; dummy.yml reports the check instead. The actual validation is add the sandbox authorization reversal and expiry simulators to the spec #919 going green once it's rebased onto this.

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
grid-flow-builder	Ignored		Sep 9, 2026 6:41pm UTC
grid-wallet-demo	Ignored		Sep 9, 2026 6:41pm UTC

[greptile-apps]

Greptile Summary

This PR makes the lint workflow resilient to intermittent failures from the unused Google Chrome apt repository.

• Removes matching Chrome source-list files before refreshing apt indexes.
• Continues installing libsecret-1-dev from the configured Ubuntu repositories.
• Leaves dependency installation and contract/documentation lint commands unchanged.

Confidence Score: 5/5

The PR appears safe to merge because the removed apt source is not used elsewhere in the lint job.

The change isolates apt setup from an unrelated Chrome repository while preserving the required libsecret-1-dev installation and all subsequent lint steps.

Important Files Changed

Filename	Overview
.github/workflows/lint.yml	Removes an unused third-party apt source before installing libsecret-1-dev, without affecting later lint-job dependencies.

_{Reviews (1): Last reviewed commit: "lint: don't let the runner's Chrome apt ..." | Re-trigger Greptile}