From 05b3a4b18a54aa06ba5e29eb3edf8bb4e86b4d0e Mon Sep 17 00:00:00 2001 From: Jinwoo-H Date: Tue, 14 Jul 2026 20:29:40 -0400 Subject: [PATCH] build(ssh): preserve Linux runner ownership Co-authored-by: Orca --- .github/workflows/ssh-relay-runtime-artifacts.yml | 3 ++- config/scripts/ssh-relay-runtime-workflow.test.mjs | 2 ++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ssh-relay-runtime-artifacts.yml b/.github/workflows/ssh-relay-runtime-artifacts.yml index feb83e420d3..b004dd4f76c 100644 --- a/.github/workflows/ssh-relay-runtime-artifacts.yml +++ b/.github/workflows/ssh-relay-runtime-artifacts.yml @@ -189,8 +189,9 @@ jobs: if [[ '${{ matrix.tuple }}' == linux-* ]]; then # Why: package installation is isolated earlier; native compilation itself has no egress. docker run --rm --network none --read-only --cap-drop all \ + --user "$(id -u):$(id -g)" \ --security-opt no-new-privileges --pids-limit 512 --memory 6g --cpus 4 \ - --tmpfs /tmp:rw,nosuid,size=1g \ + --tmpfs /tmp:rw,nosuid,size=1g,mode=1777 \ --mount "type=bind,src=$GITHUB_WORKSPACE,dst=$GITHUB_WORKSPACE" \ --mount "type=bind,src=$RUNNER_TEMP,dst=$RUNNER_TEMP" \ --workdir "$GITHUB_WORKSPACE" \ diff --git a/config/scripts/ssh-relay-runtime-workflow.test.mjs b/config/scripts/ssh-relay-runtime-workflow.test.mjs index 481f53960ec..7f583a961c1 100644 --- a/config/scripts/ssh-relay-runtime-workflow.test.mjs +++ b/config/scripts/ssh-relay-runtime-workflow.test.mjs @@ -166,7 +166,9 @@ describe('SSH relay runtime artifact workflow', () => { expect(prepare.run).toContain('config/ssh-relay-runtime-linux-builder.Containerfile') expect(build.run).toContain("if [[ '${{ matrix.tuple }}' == linux-* ]]") expect(build.run).toContain('--network none --read-only --cap-drop all') + expect(build.run).toContain('--user "$(id -u):$(id -g)"') expect(build.run).toContain('--security-opt no-new-privileges') + expect(build.run).toContain('--tmpfs /tmp:rw,nosuid,size=1g,mode=1777') expect(build.run).toContain('ssh-relay-runtime-linux-build-evidence.mjs') expect(build.run.indexOf('--network none')).toBeLessThan( build.run.indexOf('ssh-relay-runtime-linux-build-evidence.mjs')