mirror of
https://github.com/fastfetch-cli/fastfetch.git
synced 2026-09-13 10:52:08 +02:00
Thibaud-Vdb
b739dfee0b
A version tag like @v1 or a branch like @master is a movable pointer: whoever controls the action repository can re-point it, and the next run executes whatever it points at. Several of these actions run in jobs whose outputs ship to users: build-release.yml creates the GitHub release with the downloadable binaries, and build-windows-hosts.yml holds the SignPath signing token, so a re-pointed tag there could ship a tampered or wrongly signed release. This is exactly how the tj-actions/changed-files compromise propagated (CVE-2025-30066). Pinning by full commit SHA makes the reviewed code the code that runs, the same way docker/setup-qemu-action is already pinned in build-linux-vms.yml. Refs that pointed at master (cross-platform-actions, setup-alpine, get-latest-release) are pinned to their latest release tag. Every pin keeps a version comment, and each SHA was resolved from the upstream repository and cross-checked against its release tag.
46 lines
1.7 KiB
YAML
46 lines
1.7 KiB
YAML
name: Reusable Linux VMs
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
arch:
|
|
required: true
|
|
type: string
|
|
|
|
env:
|
|
CMAKE_BUILD_TYPE: ${{ vars.CMAKE_BUILD_TYPE || 'RelWithDebInfo' }}
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: checkout repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- name: run VM
|
|
uses: uraimo/run-on-arch-action@f9b26e3a1a408d5fd530d20c17b9f3f4428ff8d9 # v3.1.0
|
|
id: runcmd
|
|
with:
|
|
arch: ${{ inputs.arch }}
|
|
distro: ubuntu22.04
|
|
githubToken: ${{ github.token }}
|
|
run: |
|
|
uname -a
|
|
apt-get update && apt-get install -y software-properties-common
|
|
add-apt-repository -y ppa:ubuntu-toolchain-r/test
|
|
apt-get update && apt-get install -y cmake make gcc-13 libvulkan-dev libwayland-dev libxrandr-dev libxcb-randr0-dev libdconf-dev libdbus-1-dev libmagickcore-dev libsqlite3-dev librpm-dev libegl-dev libglx-dev ocl-icd-opencl-dev libpulse-dev libdrm-dev libchafa-dev libelf-dev libefl-all-dev liblua5.4-dev libvdpau-dev libva-dev rpm
|
|
CC=gcc-13 cmake -DSET_TWEAK=Off -DBUILD_TESTS=On -DCMAKE_INSTALL_PREFIX=/usr .
|
|
cmake --build . --target package --verbose -j4
|
|
./fastfetch --list-features
|
|
time ./fastfetch -c presets/ci.jsonc --stat false
|
|
time ./fastfetch -c presets/ci.jsonc --format json
|
|
time ./flashfetch
|
|
ldd fastfetch
|
|
ctest --output-on-failure
|
|
|
|
- name: upload artifacts
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: fastfetch-linux-${{ inputs.arch }}
|
|
path: ./fastfetch-*.*
|