Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/package.yml
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,15 @@ jobs:
cc: gcc
cxx: g++
shell: sh
- os: ubuntu-22.04-arm
type: container
artifact: alpine-arm
container:
image: alpine:3.21
options: --device /dev/fuse --cap-add SYS_ADMIN --security-opt apparmor:unconfined
cc: gcc
cxx: g++
shell: sh
- os: macos-15-intel
type: native
artifact: macos-x64
Expand Down Expand Up @@ -69,6 +78,12 @@ jobs:
CC: ${{ matrix.platform.cc }}
CXX: ${{ matrix.platform.cxx }}
steps:
# See https://github.com/laverdet/alpine-arm64
# Required for JavaScript-based actions to work inside Alpine containers
# on ARM64 runners
- uses: laverdet/alpine-arm64@v1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1: Pin this third-party action to a full commit SHA instead of a mutable @v1 tag to prevent silent supply-chain drift.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/package.yml, line 84:

<comment>Pin this third-party action to a full commit SHA instead of a mutable `@v1` tag to prevent silent supply-chain drift.</comment>

<file context>
@@ -78,6 +78,12 @@ jobs:
+      # See https://github.com/laverdet/alpine-arm64
+      # Required for JavaScript-based actions to work inside Alpine containers
+      # on ARM64 runners
+      - uses: laverdet/alpine-arm64@v1
+        if: matrix.platform.type == 'container' && runner.arch == 'ARM64'
+
</file context>

if: matrix.platform.type == 'container' && runner.arch == 'ARM64'

- name: Install dependencies (Alpine)
if: matrix.platform.type == 'container'
run: |
Expand Down
14 changes: 14 additions & 0 deletions .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,14 @@ jobs:
cc: gcc
cxx: g++
shell: sh
- os: ubuntu-22.04-arm
type: container
container:
image: alpine:3.21
options: --device /dev/fuse --cap-add SYS_ADMIN --security-opt apparmor:unconfined
cc: gcc
cxx: g++
shell: sh
- os: macos-15-intel
type: native
cc: clang
Expand Down Expand Up @@ -64,6 +72,12 @@ jobs:
CXX: ${{ matrix.platform.cxx }}
WSLENV: CC:CXX
steps:
# See https://github.com/laverdet/alpine-arm64
# Required for JavaScript-based actions to work inside Alpine containers
# on ARM64 runners
- uses: laverdet/alpine-arm64@v1
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Pin this third-party GitHub Action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in CI.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/test.yml, line 78:

<comment>Pin this third-party GitHub Action to a full commit SHA instead of a mutable tag to reduce supply-chain risk in CI.</comment>

<file context>
@@ -72,6 +72,12 @@ jobs:
+      # See https://github.com/laverdet/alpine-arm64
+      # Required for JavaScript-based actions to work inside Alpine containers
+      # on ARM64 runners
+      - uses: laverdet/alpine-arm64@v1
+        if: matrix.platform.type == 'container' && runner.arch == 'ARM64'
+
</file context>

if: matrix.platform.type == 'container' && runner.arch == 'ARM64'

# See https://github.com/Vampire/setup-wsl
- uses: Vampire/setup-wsl@v5
if: runner.os == 'windows' && matrix.platform.type == 'wsl-2'
Expand Down
Loading