Install Bubblewrap on hosted Ubuntu

[MikeMcQuaid]

• Avoid forcing taps to disable Linux sandboxing on GitHub Actions
• Use Ubuntu's bubblewrap package before the Homebrew fallback
• Keep self-hosted and non-Ubuntu runners on the existing path

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI Codex 5.5 xhigh with local review.

---

[Copilot]

Pull request overview

This PR updates Linux sandbox configuration to prefer installing Ubuntu’s bubblewrap package on GitHub-hosted Ubuntu runners before falling back to Homebrew’s install path.

Changes:

• Adds GitHub Actions hosted Ubuntu detection to Sandbox.configure!.
• Runs sudo apt-get install --yes bubblewrap before Homebrew fallback when appropriate.
• Adds specs for the new apt-based install path and isolates GitHub Actions env vars in related tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Library/Homebrew/extend/os/linux/sandbox.rb	Adds the hosted Ubuntu apt-get Bubblewrap install path before the existing fallback.
Library/Homebrew/test/sandbox_linux_spec.rb	Adds coverage for the new GitHub-hosted Ubuntu install behavior and env isolation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Bo98]

I think the actual problem is that test-bot sets HOMEBREW_DEVELOPER in Ruby but that's too late for HOMEBREW_SANDBOX_LINUX default to kick in so setup_github_actions_sandbox! never runs. brew doctor then fails as that does go through the shell script again and pick up the defaults.

[Bo98]

Does this even pass through env filtering? We have HOMEBREW_GITHUB_HOSTED_RUNNER.