Read the PostgreSQL server headers from the repository the image's PostgreSQL comes from

.github/actions/provision-meos/action.yml

@@ -92,6 +92,8 @@ runs:
       env:
         APT_ARCHIVES: ${{ runner.temp }}/apt-sysroot-archives
       run: |
+        # The server headers come from PGDG, where the image's PostgreSQL comes from.
+        bash "$GITHUB_ACTION_PATH/pgdg-source.sh"
         bash "$GITHUB_ACTION_PATH/apt-get.sh" update -qq
         bash "$GITHUB_ACTION_PATH/apt-get.sh" install -y --no-install-recommends \
           ${{ steps.sysroot-keys.outputs.packages }}
@@ -126,8 +128,8 @@ runs:
 
     # Optional: build and install libmeos with all families. Mirrors the green
     # all-families recipe used by the JVM bindings: purge the runner's
-    # preinstalled PostgreSQL and use apt.postgresql.org PG17 so the vendored
-    # pgPointCloud PGXS build finds clang-19.
+    # preinstalled PostgreSQL and use apt.postgresql.org PG17 (the PGDG source the sysroot step
+    # added) so the vendored pgPointCloud PGXS build finds clang-19.
     - name: Remove preinstalled PostgreSQL [prefer apt.postgresql.org]
       if: inputs.build-libmeos == 'true'
       shell: bash
@@ -136,16 +138,6 @@ runs:
         bash "$GITHUB_ACTION_PATH/apt-get.sh" --purge remove postgresql* -y || true
         sudo rm -rf /var/lib/postgresql/ /etc/postgresql/ /var/log/postgresql/ || true
 
-    - name: Add PostgreSQL APT repository (PGDG)
-      if: inputs.build-libmeos == 'true'
-      shell: bash
-      run: |
-        bash "$GITHUB_ACTION_PATH/apt-get.sh" install -y --no-install-recommends \
-          curl ca-certificates gnupg
-        curl https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add -
-        sudo sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ \
-          $(lsb_release -cs)-pgdg main" > /etc/apt/sources.list.d/pgdg.list'
-
     # The two caches of the build path. The packages: libgdal-dev depends on the -dev
     # packages of its drivers (mariadb, poppler, spatialite, xerces) and postgresql-server-dev-17
     # on clang-19 and llvm-19, about 200 MB a runner downloads on every run, so the .deb files

.github/actions/provision-meos/pgdg-source.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+# pgdg-source.sh — add apt.postgresql.org (PGDG), the repository the runner images install their
+# PostgreSQL from, as an APT source. The images remove that source once PostgreSQL is installed,
+# so the archive's server-dev package, which requires the archive's client of the same version,
+# conflicts with the image's PGDG client (postgresql-server-dev-18 on ubuntu-26.04); with the
+# source back, the server headers come from the repository the installed PostgreSQL came from.
+# The key goes into a keyring the source names (`signed-by`), as the images' own installer does:
+# apt-key, which an earlier version of this action used, is gone from apt 3 (Ubuntu 26.04).
+#
+# Usage:
+#   pgdg-source.sh && apt-get.sh update -qq
+set -euo pipefail
+
+keyring=/usr/share/keyrings/postgresql.gpg
+curl -fsSL https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo gpg --dearmor --yes -o "$keyring"
+echo "deb [signed-by=$keyring] https://apt.postgresql.org/pub/repos/apt/ $(lsb_release -cs)-pgdg main" |
+  sudo tee /etc/apt/sources.list.d/pgdg.list >/dev/null

.github/workflows/openapi-validate.yml

@@ -39,6 +39,7 @@ jobs:
       # two regenerate paths produce byte-identical catalogs.
       - name: Install dev headers for libclang sysroot
         run: |
+          bash .github/actions/provision-meos/pgdg-source.sh
           bash .github/actions/provision-meos/apt-get.sh update -qq
           bash .github/actions/provision-meos/apt-get.sh install -y --no-install-recommends \
             clang libclang-dev \