projection: name the RedFlag Linux capability
Publication keeps the reviewed product tree still while its workflows request public-safe execution authority. Source-Sha: a2b9bfe9f70e6fb3bf4e2060de7bd1106b955d6f Policy-Sha: a2b9bfe9f70e6fb3bf4e2060de7bd1106b955d6f Tree-Digest: f935dee0bf3929b9eb866dd2734081e467b32470c5a5991ed71fab184c8da675
This commit is contained in:
Fimeg
parent
765ec4188f
commit
fdfb3f449b
4 changed files with 22 additions and 22 deletions
|
|
@ -25,7 +25,7 @@ on:
|
|||
|
||||
jobs:
|
||||
release-contract:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
container:
|
||||
image: debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132
|
||||
steps:
|
||||
|
|
@ -45,7 +45,7 @@ jobs:
|
|||
echo "ADMISSION_SHELF_VERSION=admission-${GITHUB_RUN_ID}"
|
||||
|
||||
go-vet:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
||||
|
|
@ -58,7 +58,7 @@ jobs:
|
|||
run: cd agent && go vet ./...
|
||||
|
||||
go-test:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
||||
|
|
@ -71,7 +71,7 @@ jobs:
|
|||
run: cd agent && go test -race -count=1 ./...
|
||||
|
||||
rust-test:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
|
||||
|
|
@ -89,7 +89,7 @@ jobs:
|
|||
# regressions (cfg(target_os), FFI, path assumptions) without needing
|
||||
# a runner per OS.
|
||||
cross-compile:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
|
|
@ -155,7 +155,7 @@ jobs:
|
|||
fi
|
||||
|
||||
web-build:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
||||
|
|
@ -169,7 +169,7 @@ jobs:
|
|||
run: cd web && npm ci && npm run build
|
||||
|
||||
desktop-check:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
||||
|
|
@ -215,7 +215,7 @@ jobs:
|
|||
retention-days: 30
|
||||
|
||||
installer-integrity:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
||||
|
|
@ -233,7 +233,7 @@ jobs:
|
|||
# documented allowlist (.govulncheck-allow, mirrored in SECURITY.md); npm gates the
|
||||
# production tree and treats dev-only advisories as warnings; cargo gates outright.
|
||||
dep-scan:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
||||
|
|
@ -278,7 +278,7 @@ jobs:
|
|||
run: scripts/dep-scan.sh
|
||||
|
||||
commit-voice:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
with:
|
||||
|
|
@ -315,7 +315,7 @@ jobs:
|
|||
--repository Fimeg/RedFlag
|
||||
|
||||
action-pins:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- name: Check for floating action refs
|
||||
|
|
@ -327,7 +327,7 @@ jobs:
|
|||
echo "All action refs are SHA-pinned."
|
||||
|
||||
public-history:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
if: github.ref == 'refs/heads/public' || github.base_ref == 'public'
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
|
|
@ -352,7 +352,7 @@ jobs:
|
|||
# a public-surface decision that shows up in this diff rather than in nobody's
|
||||
# memory.
|
||||
public-surface:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
if: github.ref == 'refs/heads/public' || github.base_ref == 'public'
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
|
|
@ -375,7 +375,7 @@ jobs:
|
|||
# internal forge remains the only writer, and the result is read back
|
||||
# anonymously before any optional downstream moves.
|
||||
publish-forge:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
needs: [go-vet, go-test, rust-test, cross-compile, web-build, desktop-check, installer-integrity, dep-scan, commit-voice, action-pins, public-history, public-surface]
|
||||
if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/public' && github.event.inputs.publish_source == 'true'
|
||||
env:
|
||||
|
|
@ -456,7 +456,7 @@ jobs:
|
|||
# deliberately best-effort: a missing credential or divergent history is a
|
||||
# visible degraded mirror, never a failure of the canonical publication.
|
||||
mirror-downstreams:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
needs: [publish-forge]
|
||||
if: github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/public' && github.event.inputs.publish_source == 'true' && github.event.inputs.mirror_downstreams == 'true'
|
||||
env:
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ on:
|
|||
|
||||
jobs:
|
||||
prove:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ permissions:
|
|||
|
||||
jobs:
|
||||
nightly:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
with:
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ jobs:
|
|||
# Gate runs before any build. A tag that doesn't agree with the tree is a
|
||||
# broken release waiting to happen — fail here, not after artifacts exist.
|
||||
gate:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
with:
|
||||
|
|
@ -189,7 +189,7 @@ jobs:
|
|||
|
||||
# Build the web UI once — it's the same embed for every platform.
|
||||
web:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
|
||||
|
|
@ -217,7 +217,7 @@ jobs:
|
|||
# binary and signed into the release manifest. If this fails, `release` never
|
||||
# builds (it is in `needs`).
|
||||
dep-scan:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
steps:
|
||||
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
||||
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
||||
|
|
@ -245,7 +245,7 @@ jobs:
|
|||
# Build binaries for every target platform. The webui-dist and supply-chain
|
||||
# posture artifacts are downloaded into the embed paths before the server compile.
|
||||
release:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
needs: [gate, web, dep-scan]
|
||||
strategy:
|
||||
fail-fast: false
|
||||
|
|
@ -564,7 +564,7 @@ jobs:
|
|||
# Generic CI assembles one deterministic candidate and deposits it on the
|
||||
# package shelf. This token can write packages; it cannot publish a release.
|
||||
stage_package:
|
||||
runs-on: ubuntu-latest
|
||||
runs-on: redflag-linux-build
|
||||
container:
|
||||
image: debian:13-slim@sha256:d7e12182ce18b85b93007c1dedf31f2d29e01ccf3182cc4017c709b6259bc132
|
||||
needs: [release]
|
||||
|
|
|
|||
Loading…
Reference in a new issue