Disable Ubuntu app-armor in CI to avoid Chromium/Puppeteer bug "No

Usable Sandbox!"

See puppeteer/puppeteer#12818

(cherry picked from commit 9321b59)

.github/actions/setup/action.yml

@@ -30,5 +30,13 @@ runs:
         restore-keys: |
           ${{ runner.os }}-puppeteer-
 
+    - name: Disable AppArmor
+      # Ubuntu >= 23 has AppArmor enabled by default, which breaks Puppeteer.
+      # See https://github.com/puppeteer/puppeteer/issues/12818 "No usable sandbox!"
+      # this is taken from the solution used in Puppeteer's own CI: https://github.com/puppeteer/puppeteer/pull/13196
+      # The alternative is to pin Ubuntu 22 or to use aa-exec to disable AppArmor for commands that need Puppeteer.
+      run: echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns
+      shell: bash
+
     - run: pnpm install ${{ fromJSON('{"false":"--no-lockfile", "true":"--frozen-lockfile"}')[inputs.use_lockfile] }}
       shell: bash