starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-10-17 16:02:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

build(ssh): preserve Linux runner ownership

Browse Source 
Co-authored-by: Orca <help@stably.ai>
This commit is contained in:
Jinwoo-H
2026-07-14 20:29:40 -04:00
co-authored by Orca
parent 24153775b2
commit 05b3a4b18a
2 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ssh-relay-runtime-artifacts.yml
+2 -1
View File
@@ -189,8 +189,9 @@ jobs:
if [[ '${{ matrix.tuple }}' == linux-* ]]; then
# Why: package installation is isolated earlier; native compilation itself has no egress.
docker run --rm --network none --read-only --cap-drop all \
--user "$(id -u):$(id -g)" \
--security-opt no-new-privileges --pids-limit 512 --memory 6g --cpus 4 \
--tmpfs /tmp:rw,nosuid,size=1g \
--tmpfs /tmp:rw,nosuid,size=1g,mode=1777 \
--mount "type=bind,src=$GITHUB_WORKSPACE,dst=$GITHUB_WORKSPACE" \
--mount "type=bind,src=$RUNNER_TEMP,dst=$RUNNER_TEMP" \
--workdir "$GITHUB_WORKSPACE" \
config/scripts/ssh-relay-runtime-workflow.test.mjs
+2
View File
@@ -166,7 +166,9 @@ describe('SSH relay runtime artifact workflow', () => {
expect(prepare.run).toContain('config/ssh-relay-runtime-linux-builder.Containerfile')
expect(build.run).toContain("if [[ '${{ matrix.tuple }}' == linux-* ]]")
expect(build.run).toContain('--network none --read-only --cap-drop all')
expect(build.run).toContain('--user "$(id -u):$(id -g)"')
expect(build.run).toContain('--security-opt no-new-privileges')
expect(build.run).toContain('--tmpfs /tmp:rw,nosuid,size=1g,mode=1777')
expect(build.run).toContain('ssh-relay-runtime-linux-build-evidence.mjs')
expect(build.run.indexOf('--network none')).toBeLessThan(
build.run.indexOf('ssh-relay-runtime-linux-build-evidence.mjs')