[AAASM-2327] 🐛 (ci): Add apt-get fallback to before-script-linux for Debian-based cross container

[Chisanan232]

Description

Follow-up to AAASM-2189. That fix's before-script-linux only handles yum + dnf, assuming all manylinux containers are RHEL-family. But ghcr.io/rust-cross/manylinux2014-cross:aarch64 is Debian-based (Ubuntu jammy) and has neither.

v0.0.1-alpha.3 Build manylinux_aarch64 wheel failure:

/.../run-maturin-action.sh: line 24: yum: command not found
/.../run-maturin-action.sh: line 24: dnf: command not found
Error: The process '/usr/bin/docker' failed with exit code 127

Fix

Extend the unzip-install fallback chain:

(command -v unzip >/dev/null) || (
  yum install -y unzip 2>/dev/null
    || dnf install -y unzip 2>/dev/null
    || (apt-get update && apt-get install -y unzip)
)

Applied to both Linux blocks (x86_64 + aarch64).

Local verification in the EXACT container that failed

Inside ghcr.io/rust-cross/manylinux2014-cross:aarch64 (linux/amd64 via Rosetta):

• Confirmed: container is Ubuntu jammy, no yum/dnf
• apt-get install -y unzip succeeds
• Full chain: protoc 32.1 downloads → SHA-256 verifies → libprotoc 32.1 ✓

My reviewer-miss disclosure

I shipped AAASM-2189 with only x86_64 local verification. Should have tested the aarch64 cross-container path too. Pattern to remember: matrix entries with different base images need each base image verified.

Related

• Jira: AAASM-2327
• Parent: AAASM-1202
• Original protoc fix: AAASM-2189 (PR [AAASM-2189] 🐛 (ci): Install protoc in maturin wheel builds (Linux + macOS) #68)

— Claude Code (Opus 4.7, 1M context)

[Chisanan232]

Claude Code review — AAASM-2327

CI state

7 SUCCESS + 6 SKIPPED, 0 failures — mergeable=MERGEABLE, mergeStateStatus=CLEAN. Same expected SKIPPED pattern as PR #70 (Complete Release Validation Process steps skip on PR context).

Scope vs. acceptance criteria

AC	Verified	Status
before-script-linux fallback chain extends `yum		dnf→yum
The chain handles all 3 manylinux container distro families: CentOS 7 (yum), Rocky/Alma 8+ (dnf), Debian-based cross-compile (apt-get)	verified locally	✅
Each manager's error suppressed with 2>/dev/null so fallback continues on missing-tool	confirmed	✅
Local end-to-end verification in the EXACT container that failed in CI (ghcr.io/rust-cross/manylinux2014-cross:aarch64)	unzip installs via apt-get; protoc 32.1 downloads + SHA-256 verifies; libprotoc 32.1 confirmed	✅
actionlint clean	(pre-existing macos-13 warning was unrelated and now also fixed by PR #70)	✅

Reviewer-miss disclosure (also called out in PR body)

The original AAASM-2189 (PR #68) was shipped with only x86_64 local verification. The matrix's other Linux variant (aarch64-unknown-linux-gnu) runs in a Debian-based cross-compile container that I didn't test locally. The PR description owns this miss explicitly and documents the lesson: matrix entries with different base images need each base image verified.

What this gets the alpha-4 dry-run

Job	alpha-3 outcome	alpha-4 forecast
Build manylinux_x86_64 wheel	✅ already worked (AAASM-2189)	✅ no regression
Build manylinux_aarch64 wheel	❌ yum: command not found	✅ apt-get fallback succeeds

Verdict

Ready for human approval and merge. End-to-end CD-side regression avoided by reproducing the exact container locally before pushing.

— Claude Code (Opus 4.7, 1M context)