starred/orca
1
0
Fork 0
mirror of https://github.com/stablyai/orca.git synced 2026-09-21 16:02:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(release): trust Linux floor workspace (#16988)

Browse Source 
* fix(release): trust Linux floor workspace

* test(release): ratchet workspace trust scope
This commit is contained in:
Jinwoo Hong
2026-08-28 01:07:51 -07:00
committed by GitHub
parent c4b39295c1
commit 86b770e448
2 changed files with 21 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release-cut.yml
+3
View File
@@ -1005,6 +1005,9 @@ jobs:
with:
ref: refs/tags/${{ needs.cut.outputs.tag }}
- name: Trust the checked-out workspace in the job container
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Restore skill-sharing test harness from the workflow ref
shell: bash
env:
config/scripts/skill-sharing-release-workflow.test.mjs
+18
View File
@@ -51,6 +51,24 @@ describe('skill-sharing release workflow', () => {
expect(prerequisites.run).toMatch(/apt-get install[^\n]*\bunzip\b/)
})
it('trusts only the checked-out workspace before container git operations', () => {
const linux = workflow.jobs['skill-sharing-linux-floor-release-gate']
const trustWorkspace = stepNamed(linux, 'Trust the checked-out workspace in the job container')
const restoreHarness = stepNamed(
linux,
'Restore skill-sharing test harness from the workflow ref'
)
const safeDirectoryCommands = linux.steps
.filter((step) => typeof step.run === 'string' && step.run.includes('safe.directory'))
.map((step) => step.run)
expect(trustWorkspace.run).toBe('git config --global --add safe.directory "$GITHUB_WORKSPACE"')
expect(linux.steps.indexOf(trustWorkspace)).toBeLessThan(linux.steps.indexOf(restoreHarness))
expect(safeDirectoryCommands).toEqual([
'git config --global --add safe.directory "$GITHUB_WORKSPACE"'
])
})
it('validates immutable tags with the current skill-sharing test harness', () => {
for (const jobName of [
'skill-sharing-release-gate',