Harden GitHub Actions workflows #19
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build with objdiff objects for pull requests | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| # Only what actions/checkout needs. On a public repo this grants nothing an | |
| # anonymous clone doesn't already have, and it stops a job that executes | |
| # contributor-authored build scripts from being able to write to the repo. | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Untrusted: pull_request_target runs with the base repo's secrets, and the | |
| # build executes scripts from the PR branch. The pr-build environment holds | |
| # this until a maintainer approves the run, which is tied to the head SHA, so | |
| # every push to the PR is re-approved. | |
| build-objects: | |
| if: github.repository_owner == 'theonlyzac' | |
| runs-on: ubuntu-latest | |
| environment: pr-build | |
| concurrency: | |
| group: build-objects-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| persist-credentials: false | |
| allow-unsafe-pr-checkout: true | |
| - name: Setup build environment | |
| run: scripts/quickstart.sh | |
| - name: Activate virtualenv | |
| run: echo "${{ github.workspace }}/env/bin" >> $GITHUB_PATH | |
| - name: Fetch game executable | |
| run: curl -o disc/SCUS_971.98 "${{ secrets.FILE_URL }}" | |
| - name: Configure and build | |
| run: | | |
| python configure.py --objects | |
| ninja |