mirror of
https://github.com/systemd/systemd.git
synced 2026-07-23 16:00:06 +00:00
6461eccacb
Set `persist-credentials: false` for actions/checkout. By default, using `actions/checkout` causes a credential to be persisted on disk. Subsequent steps may accidentally publicly persist the credential, e.g. by including it in a publicly accessible artifact via actions/upload-artifact. However, even without this, persisting the credential on disk is non-ideal unless actually needed. Link: https://docs.zizmor.sh/audits/#artipacked
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
---
|
|
# vi: ts=2 sw=2 et:
|
|
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
#
|
|
name: Unit tests
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- v[0-9]+-stable
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ${{ matrix.runner }}
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ matrix.run_phase }}-${{ github.ref }}-${{ matrix.runner }}
|
|
cancel-in-progress: true
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
runner: [ ubuntu-24.04 ]
|
|
run_phase: [GCC, GCC_ASAN_UBSAN, CLANG, CLANG_RELEASE, CLANG_ASAN_UBSAN, CLANG_ASAN_UBSAN_NO_DEPS]
|
|
include:
|
|
- run_phase: GCC
|
|
- run_phase: GCC
|
|
runner: ubuntu-24.04-arm
|
|
- run_phase: GCC
|
|
runner: ubuntu-24.04-ppc64le
|
|
- run_phase: GCC
|
|
runner: ubuntu-24.04-s390x
|
|
- run_phase: CLANG
|
|
- run_phase: CLANG
|
|
runner: ubuntu-24.04-arm
|
|
- run_phase: CLANG
|
|
runner: ubuntu-24.04-ppc64le
|
|
- run_phase: CLANG
|
|
runner: ubuntu-24.04-s390x
|
|
steps:
|
|
- name: Repository checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
with:
|
|
persist-credentials: false
|
|
- name: Install build dependencies
|
|
run: |
|
|
# Drop XDG_* stuff from /etc/environment, so we don't get the user
|
|
# XDG_* variables when running under sudo
|
|
sudo sed -i '/^XDG_/d' /etc/environment
|
|
# Pass only specific env variables through sudo, to avoid having
|
|
# the already existing XDG_* stuff on the "other side"
|
|
sudo --preserve-env=GITHUB_ACTIONS,CI .github/workflows/unit-tests.sh SETUP
|
|
- name: Build & test
|
|
run: sudo --preserve-env=GITHUB_ACTIONS,CI .github/workflows/unit-tests.sh RUN_${{ matrix.run_phase }}
|