From: Colin Walters <walters@verbum.org>
Date: Thu, 26 Aug 2021 13:53:56 +0000 (-0400)
Subject: ci: Run main GH action CI build+test as non-root
X-Git-Tag: archive/raspbian/2022.1-3+rpi1~1^2~20^2^2~8^2
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=fdeee165f6f82b2902fb791e33472e4600845a2b;p=ostree.git

ci: Run main GH action CI build+test as non-root

This is really the standard best practice, matching how
e.g. dpkg/rpm work, as well as most local development
environments (including mine) with e.g. `toolbox`.
---

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index df1b1e07..c17a1c0d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -120,8 +120,11 @@ jobs:
       - name: Install dependencies
         run: ./ci/gh-install.sh ${{ matrix.extra-packages }}
 
+      - name: Add non-root user
+        run: "useradd builder && chown -R -h builder: ."
+
       - name: Build and test
-        run: ./ci/gh-build.sh ${{ matrix.configure-options }}
+        run: runuser -u builder -- ./ci/gh-build.sh ${{ matrix.configure-options }}
         env:
           # GitHub hosted runners currently have 2 CPUs, so run 2
           # parallel make jobs.