.github/workflows/build.yml


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

name: Build CI

on:
  push:
    branches: [ master ]
    paths-ignore:
      - '.github/ISSUE_TEMPLATE/*'
      - .git-blame-ignore-revs
      - .github/dependabot.yml
      - .github/pull_request_template.md
      - .github/workflows/build-extra.yml
      - .github/workflows/codeql-analysis.yml
      - .github/workflows/profile-checks.yml
      - .gitignore
      - .gitlab-ci.yml
      - CONTRIBUTING.md
      - COPYING
      - README
      - README.md
      - RELNOTES
      - SECURITY.md
  pull_request:
    branches: [ master ]
    paths-ignore:
      - '.github/ISSUE_TEMPLATE/*'
      - .git-blame-ignore-revs
      - .github/dependabot.yml
      - .github/pull_request_template.md
      - .github/workflows/build-extra.yml
      - .github/workflows/codeql-analysis.yml
      - .github/workflows/profile-checks.yml
      - .gitignore
      - .gitlab-ci.yml
      - CONTRIBUTING.md
      - COPYING
      - README
      - README.md
      - RELNOTES
      - SECURITY.md

permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  build_and_test:
    runs-on: ubuntu-22.04
    env:
      SHELL: /bin/bash
    steps:
    - name: Harden Runner
      uses: step-security/harden-runner@6b3083af2869dc3314a0257a42f4af696cc79ba3
      with:
        egress-policy: block
        allowed-endpoints: >
          1.1.1.1:1025
          azure.archive.ubuntu.com:80
          debian.org:80
          dns.quad9.net:53
          github.com:443
          packages.microsoft.com:443
          ppa.launchpadcontent.net:443
          whois.pir.org:43
          www.debian.org:443
          www.debian.org:80
          yahoo.com:1025
    - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab
    - name: update package information
      run: sudo apt-get update
    - name: install dependencies
      run: >
        sudo apt-get install
        gcc-12 libapparmor-dev libselinux1-dev expect xzdec whois
        bridge-utils
    - name: print env
      run: ./ci/printenv.sh
    - name: configure
      run: >
        CC=gcc-12 ./configure --prefix=/usr --enable-fatal-warnings
        --enable-analyzer --enable-apparmor --enable-selinux
    - name: make
      run: make
    - name: make install
      run: sudo make install
    - name: print firejail version
      run: command -V firejail && firejail --version
    - run: make lab-setup
    - run: make test-seccomp-extra
    - run: make test-firecfg
    - run: make test-capabilities
    - run: make test-apparmor
    - run: make test-appimage
    - run: make test-chroot
    - run: make test-sysutils
    - run: make test-private-etc
    - run: make test-profiles
    - run: make test-fcopy
    - run: make test-fnetfilter
    - run: make test-fs
    - run: make test-utils
    - run: make test-environment
    - run: make test-network