Remove Yarn repository to prevent expired GPG key failures

[Copilot]

Yarn's GPG key (23E7166788B63E1E) expired in early 2024, causing apt-get operations to fail with EXPKEYSIG errors when the repository is present. This image uses npm/npx exclusively.

Changes

• Added cleanup of Yarn repository files after Node.js installation:
  • Remove /etc/apt/sources.list.d/yarn.list
  • Remove /usr/share/keyrings/yarnkey.gpg

RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash - && \
    apt-get install -y --no-install-recommends nodejs && \
    rm -f /etc/apt/sources.list.d/yarn.list /usr/share/keyrings/yarnkey.gpg

The NodeSource setup script may add the Yarn repository. Removing these files immediately prevents subsequent apt operations from failing on the expired key.

Original prompt

on a different CI image I saw the following error. can you check if it is problematic for our image as well

Err:5 https://dl.yarnpkg.com/debian stable InRelease
The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging yarn@dan.cx
Get:9 https://deb.nodesource.com/node_20.x nodistro/main amd64 Packages [13.6 kB]
Reading package lists...
W: GPG error: https://dl.yarnpkg.com/debian stable InRelease: The following signatures were invalid: EXPKEYSIG 23E7166788B63E1E Yarn Packaging yarn@dan.cx
E: The repository 'https://dl.yarnpkg.com/debian stable InRelease' is not signed.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.