github: adapt containerized jobs to be rootless
The containerized jobs in GitHub Actions run as root, giving them special permissions to for example delete files even when the user shouldn't be able to due to file permissions. This limitation keeps us from using containerized jobs for most of our Ubuntu-based jobs as it causes a number of tests to fail. Adapt the jobs to create a separate user that executes the test suite. This follows similar infrastructure that we already have in GitLab CI. Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Patrick Steinhardt committed
Jan 10, 2025 at 12:31 UTC
2a21098b98ae2f9581a91e2e474c397e5cbede12
2 files changed
+5
-3
.github/workflows/main.yml
+4
-2
@@ -371,10 +371,12 @@ jobs:
371
run: apt -q update && apt -q -y install libc6-amd64 lib64stdc++6
372
- uses: actions/checkout@v4
373
- run: ci/install-dependencies.sh
374
- - run: ci/run-build-and-tests.sh
374
+ - run: useradd builder --create-home
375
+ - run: chown -R builder .
376
+ - run: sudo --preserve-env --set-home --user=builder ci/run-build-and-tests.sh
377
- name: print test failures
378
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
377
- run: ci/print-test-failures.sh
379
+ run: sudo --preserve-env --set-home --user=builder ci/print-test-failures.sh
380
- name: Upload failed tests' directories
381
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
382
uses: actions/upload-artifact@v4
ci/install-dependencies.sh
+1
-1
@@ -31,7 +31,7 @@ alpine-*)
31
;;
32
fedora-*|almalinux-*)
33
dnf -yq update >/dev/null &&
34
- dnf -yq install make gcc findutils diffutils perl python3 gettext zlib-devel expat-devel openssl-devel curl-devel pcre2-devel >/dev/null
34
+ dnf -yq install shadow-utils sudo make gcc findutils diffutils perl python3 gettext zlib-devel expat-devel openssl-devel curl-devel pcre2-devel >/dev/null
35
;;
36
ubuntu-*|ubuntu32-*|debian-*)
37
# Required so that apt doesn't wait for user input on certain packages.