build: run snapcraft from canonical container instead of snap install

The snap-publish workflows have been failing intermittently with
"unable to contact snap store" coming from `sudo snap install snapcraft
--classic`. Both `samuelmeuli/action-snapcraft` and `canonical/action-publish`
use the same install path internally, so neither is a real alternative.

Switch to Canonical's actively-maintained snapcraft-rocks image
(ghcr.io/canonical/snapcraft:8_core24) which has snapcraft 8 pre-installed
and only needs SNAPCRAFT_STORE_CREDENTIALS — no snapd/snap-store handshake
on the runner. promote/upload subcommands and CLI flags are unchanged.

- build-publish-to-snap-on-release.yml: whole job runs in the container
- build.yml: keeps the existing ubuntu-latest job (npm/playwright/electron-builder
  need a normal Ubuntu env), but invokes snapcraft via `docker run` for the
  upload step

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/workflows/build-publish-to-snap-on-release.yml

@@ -8,26 +8,25 @@ on:
 jobs:
   snap-release:
     runs-on: ubuntu-latest
+    # Run snapcraft from Canonical's official container so we don't depend on
+    # `sudo snap install snapcraft --classic` working on the runner — that path
+    # has been a recurring source of "unable to contact snap store" failures.
+    container:
+      image: ghcr.io/canonical/snapcraft:8_core24
     env:
       SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
+      SNAPCRAFT_HAS_TTY: 'true' # Workaround for https://github.com/snapcore/snapcraft/issues/4439
 
     if: '!github.event.release.prerelease'
 
     steps:
-      - name: Install Snapcraft
+      - name: Promote edge → stable
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
-          max_attempts: 3
+          max_attempts: 5
           timeout_minutes: 10
-          retry_wait_seconds: 30
-          command: |
-            if ! command -v snapcraft >/dev/null 2>&1; then
-              sudo snap install snapcraft --classic --channel stable
-            fi
-            snapcraft version
-      - run: yes | snapcraft promote superproductivity --from-channel latest/edge --to-channel latest/stable
-        env: # Workaround for https://github.com/snapcore/snapcraft/issues/4439
-          SNAPCRAFT_HAS_TTY: 'true'
+          retry_wait_seconds: 60
+          command: yes | snapcraft promote superproductivity --from-channel latest/edge --to-channel latest/stable
 #      - uses: actions/setup-node@v3
 #        with:
 #          node-version: 20

.github/workflows/build.yml

@@ -111,18 +111,6 @@ jobs:
       - name: Build Frontend & Electron
         run: npm run build
 
-      - name: Install Snapcraft
-        uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
-        with:
-          max_attempts: 3
-          timeout_minutes: 10
-          retry_wait_seconds: 30
-          command: |
-            if ! command -v snapcraft >/dev/null 2>&1; then
-              sudo snap install snapcraft --classic --channel stable
-            fi
-            snapcraft version
-
       - name: Build/Release Electron app
         uses: johannesjo/action-electron-builder@9ea9e2d991c97668843d57337848e3e2b1ffab3d # v1
         with:
@@ -133,13 +121,26 @@ jobs:
       # rename to possibly fix release issue
       - run: find ./.tmp/app-builds -type f -name '*.snap' -exec sh -c 'x="{}"; mv "$x" ".tmp/app-builds/sp.snap"' \;
       # Release to edge if no tag and to candidate if tag
+      # Uses Canonical's official snapcraft container instead of `sudo snap
+      # install snapcraft --classic` on the runner, which has been a recurring
+      # source of "unable to contact snap store" failures.
       - #otherwise it would be executed twice
         if: false == startsWith(github.ref, 'refs/tags/v')
         uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3
         with:
-          max_attempts: 2
-          timeout_minutes: 11
-          command: snapcraft upload .tmp/app-builds/sp.snap --release edge
+          max_attempts: 3
+          timeout_minutes: 15
+          retry_wait_seconds: 60
+          command: |
+            docker run --rm \
+              -v "$PWD/.tmp/app-builds:/work" \
+              -w /work \
+              -e SNAPCRAFT_STORE_CREDENTIALS \
+              -e SNAPCRAFT_HAS_TTY=true \
+              ghcr.io/canonical/snapcraft:8_core24 \
+              snapcraft upload sp.snap --release edge
+        env:
+          SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_STORE_CREDENTIALS }}
       #      - run: snapcraft push .tmp/app-builds/sp.snap --release candidate
       #        if: startsWith(github.ref, 'refs/tags/v')
   #      - run: snapcraft promote superproductivity --from-channel latest/edge --to-channel latest/candidate --yes