commitwork/.github/workflows/container.yml at main · Portll/commitwork · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Container

# Builds container/Dockerfile and runs container/smoke.sh against the image: doctor, then one scan of a
# synthetic repository, red if any lane that ran was not confined. Only when something the image
# installs or confines changes, because each build fetches the base image, the Debian packages and the
# scanners. The image stays in this runner's Docker: nothing is pushed and no registry is logged in to.
on:
  pull_request:
    paths:
      - 'container/**'
      - 'bin/lib/sandbox*.mjs'
      - 'bin/setup.mjs'
      - 'bin/install.sh'
      - 'manifests/install-catalog.json'
      - '.github/workflows/container.yml'
  push:
    branches:
      - main
    paths:
      - 'container/**'
      - 'bin/lib/sandbox*.mjs'
      - 'bin/setup.mjs'
      - 'bin/install.sh'
      - 'manifests/install-catalog.json'
      - '.github/workflows/container.yml'

concurrency:
  group: container-${{ github.event_name }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  image:
    name: Container image builds and confines its lanes
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # From git archive, as container/README.md builds it, so the context is tracked files only.
      - name: Build the image (no push)
        run: git archive --format=tar HEAD | docker buildx build --load -f container/Dockerfile -t commitwork:ci -
      # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor, and that reaches bwrap
      # inside the container too. This job measures the image, not the host policy, so it lifts the
      # restriction and says so.
      - name: Allow unprivileged user namespaces
        run: |
          if [ "$(sysctl -n kernel.apparmor_restrict_unprivileged_userns 2>/dev/null)" = "1" ]; then
            echo "::notice::lifting kernel.apparmor_restrict_unprivileged_userns for this job"
            sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
          fi
      - name: doctor and a synthetic scan, with no lane run unconfined
        run: sh container/smoke.sh commitwork:ci --min 10

      # The scan is the only record of WHY a lane did not run, and smoke.sh removes its work
      # directory on exit. Without this a red job leaves a lane count and nothing to act on.
      - name: Keep the scan when the smoke fails
        if: failure()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: container-smoke-scan
          path: container-smoke-scan.json
          if-no-files-found: warn
          retention-days: 14