Further restriction of child processes capabilities (part 2) #5591
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Analyze (target)" | |
| on: | |
| pull_request_target: | |
| branches: [master] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| cppcheck: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| - name: Perform cppcheck analysis | |
| # v0.0.11 is the latest release but we need a later commit | |
| uses: linuxdeepin/action-cppcheck@e63fb1d3f321e0467737aa9de7f691360fb1b8fb | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| repository: ${{ github.repository }} | |
| pull_request_id: ${{ github.event.pull_request.number }} | |
| allow_approve: false | |
| enable_checks: "warning,unusedFunction,missingInclude" | |
| comment_result: false | |
| covscan: | |
| runs-on: covscan | |
| permissions: | |
| contents: read | |
| timeout-minutes: 1440 | |
| steps: | |
| - name: Checkout target branch | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.base_ref }} | |
| path: target | |
| - name: Checkout pull request branch | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| path: pr | |
| - name: Build source rpm - ${{ github.base_ref }} | |
| id: target | |
| uses: ./target/.github/actions/build-sssd-srpm | |
| with: | |
| working-directory: target | |
| version: ${{ github.base_ref }} | |
| - name: Build source rpm - pr${{ github.event.pull_request.number }} | |
| id: pr | |
| uses: ./target/.github/actions/build-sssd-srpm | |
| with: | |
| working-directory: pr | |
| version: pr${{ github.event.pull_request.number }} | |
| - name: Run covscan | |
| run: | | |
| run-covscan --base-srpm "${{ steps.target.outputs.path }}" --srpm "${{ steps.pr.outputs.path }}" --output-dir logs | |
| - name: Print result | |
| uses: next-actions/print-logs@master | |
| if: always() | |
| with: | |
| working-directory: logs | |
| files: | | |
| added.err | |
| *.err | |
| - name: Upload artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| if-no-files-found: ignore | |
| name: covscan | |
| path: | | |
| ./logs/*.err | |
| result: | |
| name: All tests are successful | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| needs: [cppcheck, covscan] | |
| steps: | |
| - name: Fail on failure | |
| if: ${{ needs.cppcheck.result != 'success' || needs.covscan.result != 'success' }} | |
| run: exit 1 |