From fdeee165f6f82b2902fb791e33472e4600845a2b Mon Sep 17 00:00:00 2001 From: Colin Walters Date: Thu, 26 Aug 2021 09:53:56 -0400 Subject: [PATCH] ci: Run main GH action CI build+test as non-root This is really the standard best practice, matching how e.g. dpkg/rpm work, as well as most local development environments (including mine) with e.g. `toolbox`. --- .github/workflows/tests.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index df1b1e07..c17a1c0d 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -120,8 +120,11 @@ jobs: - name: Install dependencies run: ./ci/gh-install.sh ${{ matrix.extra-packages }} + - name: Add non-root user + run: "useradd builder && chown -R -h builder: ." + - name: Build and test - run: ./ci/gh-build.sh ${{ matrix.configure-options }} + run: runuser -u builder -- ./ci/gh-build.sh ${{ matrix.configure-options }} env: # GitHub hosted runners currently have 2 CPUs, so run 2 # parallel make jobs. -- 2.30.2