Skip to content

Commit a2a06fb

Browse files
Michael Vasseurvmcj
authored andcommitted
Don't store the resulting image for PRs
Moving this out of the security scope of the repository would make that we need to store this for the `github.author`. As we never used this before it's now taken out.
1 parent 1a89f09 commit a2a06fb

File tree

3 files changed

+7
-8
lines changed

3 files changed

+7
-8
lines changed

.github/workflows/build-contributor-container-PR.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
with:
4242
context: docker-contributor
4343
platforms: linux/amd64,linux/arm64
44-
push: true
44+
push: false
4545
tags: ${{ steps.meta.outputs.tags }}
4646
labels: ${{ steps.meta.outputs.labels }}
4747

.github/workflows/build-domjudge-container-PR.yml

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -58,30 +58,29 @@ jobs:
5858
run: |
5959
cd docker
6060
set -x
61-
sh ./build.sh "${{ env.DOMJUDGE_VERSION }}" ${{ github.actor }}
61+
sh ./build.sh "${{ env.DOMJUDGE_VERSION }}"
6262
set +x
6363
64-
- run: docker image list
65-
6664
- name: Build and push
6765
run: |
6866
for IMG in domserver judgehost default-judgehost-chroot; do
6967
echo "::group::$IMG"
7068
IMAGE_NAME="${GITHUB_REPOSITORY_OWNER@L}/$IMG:${{ env.DOMJUDGE_VERSION }}"
7169
docker image tag "$IMAGE_NAME" ghcr.io/${GITHUB_REPOSITORY_OWNER@L}/$IMG:${{ env.PR_TAG }}
7270
docker image tag "$IMAGE_NAME" ${GITHUB_REPOSITORY_OWNER@L}/$IMG:${{ env.PR_TAG }}
73-
docker push ghcr.io/${GITHUB_REPOSITORY_OWNER@L}/$IMG:${{ env.PR_TAG }}
7471
echo "::endgroup::"
7572
done
7673
74+
- run: docker image list
75+
7776
- name: Check for wrong permisions
7877
run: |
7978
docker image list
8079
set -x
8180
for IMG in domserver judgehost; do
82-
files=$(docker run --rm --pull=never "${{ github.repository_owner }}/$IMG:${{ env.PR_TAG }}" find / -xdev -perm -o+w ! -type l ! \( -type d -a -perm -+t \) ! -type c)
81+
files=$(docker run --rm --pull=never "domjudge/$IMG:${{ env.PR_TAG }}" find / -xdev -perm -o+w ! -type l ! \( -type d -a -perm -+t \) ! -type c)
8382
if [ -n "$files" ]; then
84-
echo "error: image ${{ github.repository_owner }}/$IMG:${{ env.PR_TAG }} contains world-writable files:" >&2
83+
echo "error: image domjudge/$IMG:${{ env.PR_TAG }} contains world-writable files:" >&2
8584
printf "%s\n" "$files" >&2
8685
exit 1
8786
fi

.github/workflows/build-gitlab-container-PR.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
uses: docker/build-push-action@v5
4343
with:
4444
context: "./docker-gitlabci"
45-
push: true
45+
push: false
4646
tags: ${{ steps.meta.outputs.tags }}
4747
labels: ${{ steps.meta.outputs.labels }}
4848

0 commit comments

Comments
 (0)