[nic-6443]

GitHub is moving ubuntu-latest to Ubuntu 26.04 (actions/runner-images#14748), and since the first master run that landed on it every Linux job dies before a single test runs. This adapts CI and the source-install scripts to 26.04 instead of pinning the runner. Because the migration is gradual, every change here also has to keep working on 24.04, and it does.

Here is what broke on 26.04 and what changed:

• libpcre3 / libpcre3-dev are gone. They were only there so lrexlib-pcre (pulled in by jsonschema) could find pcre.h. utils/linux-install-luarocks.sh now points luarocks at the PCRE that ships with APISIX runtime (/usr/local/openresty/pcre) when it exists, and both package lists drop libpcre3*. luarocks bakes that path into the module's rpath, so rex_pcre loads from the CLI (plain LuaJIT) as well as from nginx. Note this applies on every distro that has the runtime's PCRE, so lrexlib-pcre now links against the runtime's PCRE instead of the system one on 24.04 too.
• apt-key no longer exists. utils/install-dependencies.sh writes the OpenResty key to /etc/apt/keyrings (mode 0644) and uses signed-by, for both Ubuntu and Debian. The repository is now fetched over https.
• openresty.org has no 26.04 (resolute) repository yet. On Ubuntu, the script falls back to the noble repository when the current release has no Release file. Only openresty-zlib-dev and openresty-pcre-dev come from it, and both are self-contained under /usr/local/openresty.
• lua-resty-saml 0.2.6 doesn't compile against libxml2 2.12+ with -Werror. Fixed upstream in fix: build against libxml2 2.12 and later api7/lua-resty-saml#65 and released as 0.2.7, which the rockspec now requires.
• sudo is sudo-rs on 26.04, which ignores -E. The test step lost TEST_FILE_SUB_DIR and every shard ran prove -r over all of t/ until the timeout. The step now passes it explicitly.
• Docker 29 refuses clients older than API 1.40 (the runner's floor), and every openwhisk/standalone tag, the newest included, bundles docker 18.06 (API 1.38), so its waitready never returned and the plugin shards hung. The container now runs with DOCKER_API_VERSION=1.40, which the docker calls it spawns inherit, and the image is pinned to the immutable 7ef091c tag instead of 1.0.0 (the backup script now saves the same tag). That build no longer offers the nodejs:14 runtime, so the test actions are created on nodejs:20, its prewarmed default. The daemon itself is left alone.
• actions/setup-python has no 3.9 for 26.04. check-links now uses 3.12.
• ci/free_disk_space.sh silently removed nothing on 26.04: apt refuses the whole removal when one named package (powershell) is unknown. It now only names installed packages.
• The deps cache key didn't include the runner image, so a 24.04 cache could be restored on 26.04 while both images are in rotation. The key now includes ImageOS.

docs/*/install-dependencies.md now lists Ubuntu 26.04.

Every workflow here was run on both ubuntu-26.04 and ubuntu-24.04 with explicit labels before switching back to ubuntu-latest. An earlier revision restarted dockerd to lower its minimum API version instead; t/stream-plugin/prometheus-metrics.t failed in two of those runs (first try and rerun in the same job) and never reproduced afterwards. That restart is gone now.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

5 open issues

• Passing env vars via sudo VAR=... cmd can be rejected depending on sudoers… · New
• The keyring file permissions can be affected by the executing user's umask; if it ends up not… · New
• The OpenResty repository is configured over plain HTTP, which allows MITM tampering of repository… · New
• The OpenResty repository is configured over plain HTTP, which allows MITM tampering of repository… · New
• Shell variables should be quoted to avoid word-splitting/globbing issues. Quote… · New

What changed in this PR

Updates CI and dependency installation scripts to remain compatible as ubuntu-latest migrates to Ubuntu 26.04, without pinning runner images, while preserving compatibility with Ubuntu 24.04.

Changes:

• Adjusted Linux dependency install scripts for removed packages (libpcre3*), apt-key removal, and OpenResty repo availability gaps.
• Hardened CI behavior across runner-image differences (cache key includes ImageOS, disk cleanup behaves correctly, Docker API compatibility workaround).
• Updated docs and dependency versions for 26.04 compatibility (Python 3.12 for link-check, lua-resty-saml 0.2.7).

File	Description
utils/​linux-install-luarocks.sh	Configures luarocks to use runtime-bundled PCRE1 when system PCRE1 is unavailable.
utils/​install-dependencies.sh	Replaces apt-key with keyrings + signed-by, adds OpenResty repo fallback logic, updates apt package list.
ci/​free_disk_space.sh	Makes apt removal robust by removing only packages actually installed on the runner image.
ci/​common.sh	Updates apt dependencies to drop removed libpcre3* packages.
apisix-master-0.rockspec	Bumps lua-resty-saml to a version compatible with newer libxml2 toolchains.
.github/​workflows/​source-install.yml	Adds runner image to cache key to avoid cross-image cache poisoning.
.github/​workflows/​link-check.yml	Moves link-check to Python 3.12 to match available runtimes on 26.04.
.github/​workflows/​cli.yml	Adds runner image to cache key to avoid cross-image cache poisoning.
.github/​workflows/​build.yml	Adds runner image to cache key, adds Docker min API workaround, passes TEST_FILE_SUB_DIR explicitly under sudo.
docs/​en/​latest/​install-dependencies.md	Documents Ubuntu 26.04 as supported.
docs/​zh/​latest/​install-dependencies.md	Documents Ubuntu 26.04 as supported.

_{Review effort: Lite}

[membphis]

LGTM