blob: f61e417976fa37f3ac13dad8445e4d0566aa5d62 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
|
name: Build-extra CI
on:
push:
branches: [ master ]
paths-ignore:
- '.github/ISSUE_TEMPLATE/*'
- 'etc/**'
- .git-blame-ignore-revs
- .github/pull_request_template.md
- .gitignore
- CONTRIBUTING.md
- COPYING
- README
- README.md
- RELNOTES
- SECURITY.md
- src/firecfg/firecfg.config
pull_request:
branches: [ master ]
paths-ignore:
- '.github/ISSUE_TEMPLATE/*'
- 'etc/**'
- .git-blame-ignore-revs
- .github/pull_request_template.md
- .gitignore
- CONTRIBUTING.md
- COPYING
- README
- README.md
- RELNOTES
- SECURITY.md
- src/firecfg/firecfg.config
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
build-clang:
runs-on: ubuntu-22.04
steps:
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
- name: install dependencies
run: sudo apt-get install libapparmor-dev libselinux1-dev
- name: configure
run: CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor --enable-selinux
- name: make
run: make
- name: make install
run: sudo make install
- name: print version
run: command -V firejail && firejail --version
scan-build:
runs-on: ubuntu-22.04
steps:
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
- name: install clang-tools-14 and dependencies
run: sudo apt-get install clang-tools-14 libapparmor-dev libselinux1-dev
- name: configure
run: CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor --enable-selinux
- name: scan-build
run: NO_EXTRA_CFLAGS="yes" scan-build-14 --status-bugs make
cppcheck:
runs-on: ubuntu-22.04
steps:
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
- name: install cppcheck
run: sudo apt-get install cppcheck
- name: cppcheck
run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance -i src/firejail/checkcfg.c -i src/firejail/main.c .
# new cppcheck version currently chokes on checkcfg.c and main.c, therefore scan all files also
# with older cppcheck version from ubuntu 20.04.
cppcheck_old:
runs-on: ubuntu-20.04
steps:
- name: Harden Runner
uses: step-security/harden-runner@ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5
with:
egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
- uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
- name: install cppcheck
run: sudo apt-get install cppcheck
- name: cppcheck
run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance .
|
