mirror of
https://github.com/CHN-beta/nixpkgs.git
synced 2026-01-11 02:10:27 +08:00
a55f7ddced
By consistently checking out nixpkgs into the same location in every
workflow, it's easier to reason about the different workflows at once.
We also use crystal-clear names to make clear, which checkouts are
considered trusted, because they only contain target-branch-code and
which checkouts are untrusted, because they contain code from the head
branch. By naming the checkout directories trusted/untrusted, it's
obvious at the call-site.
One example of where we likely did the wrong thing is the nixpkgs-vet
workflow: Fetching the toolVersion from the untrusted checkout opens the
door for an injection into the download URL, thus code could be
downloaded from anywhere. This is not a problem, because this workflow
does not run with elevated privileges, but it's a scary oversight
nonetheless.
(cherry picked from commit 6720d25429)
32 lines
757 B
YAML
32 lines
757 B
YAML
name: "Check cherry-picks"
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- .github/workflows/check-cherry-picks.yml
|
|
pull_request_target:
|
|
branches:
|
|
- 'release-**'
|
|
- 'staging-**'
|
|
- '!staging-next'
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
check:
|
|
name: cherry-pick-check
|
|
runs-on: ubuntu-24.04-arm
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
with:
|
|
fetch-depth: 0
|
|
filter: blob:none
|
|
path: trusted
|
|
|
|
- name: Check cherry-picks
|
|
env:
|
|
BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
|
|
run: |
|
|
./trusted/maintainers/scripts/check-cherry-picks.sh "$BASE_SHA" "$HEAD_SHA"
|