docs: cp -a needs CHOWN, FOWNER and DAC_OVERRIDE #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| # Alpine patch releases reach the image through this, since the Dockerfile pins | |
| # a minor tag rather than a patch. | |
| schedule: | |
| - cron: '0 4 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| IMAGE: ghcr.io/runonflux/flux-volume-tools | |
| jobs: | |
| # Asserts each binary is the implementation the executor relies on. A change in | |
| # Alpine's packaging fails the build here rather than shipping a busybox applet. | |
| smoke-test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-buildx-action@v3 | |
| - name: Build amd64 image locally | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| platforms: linux/amd64 | |
| push: false | |
| load: true | |
| tags: flux-volume-tools:test | |
| - name: Assert the toolchain | |
| run: | | |
| set -euo pipefail | |
| # Output is captured before matching rather than piped into grep: `grep -q` | |
| # exits on its first match and closes the pipe, and the SIGPIPE that sends | |
| # upstream trips `pipefail` non-deterministically. | |
| assert() { | |
| local label="$1" pattern="$2"; shift 2 | |
| local out | |
| out="$(docker run --rm flux-volume-tools:test "$@" 2>&1 || true)" | |
| if grep -q -- "$pattern" <<<"$out"; then | |
| echo "ok - $label" | |
| else | |
| echo "FAIL - $label (no match for '$pattern')" | |
| echo "$out" | head -5 | |
| exit 1 | |
| fi | |
| } | |
| assert "unzip is Info-ZIP, not the busybox applet (zip64)" 'Info-ZIP' unzip -v | |
| assert "tar supports --no-same-owner" 'no-same-owner' tar --help | |
| assert "cp supports -T" '-T' cp --help | |
| assert "mv supports -T" '-T' mv --help | |
| assert "gzip is present" 'gzip' sh -c 'command -v gzip' | |
| echo "-T must actually refuse to recurse into an existing destination" | |
| docker run --rm flux-volume-tools:test sh -c ' | |
| mkdir -p /tmp/src /tmp/dst && echo hi > /tmp/src/f | |
| cp -a -T /tmp/src /tmp/dst | |
| test -f /tmp/dst/f && ! test -e /tmp/dst/src | |
| ' | |
| echo "ok - cp -a -T does not nest" | |
| publish: | |
| needs: smoke-test | |
| if: github.event_name != 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: docker/setup-qemu-action@v3 | |
| - uses: docker/setup-buildx-action@v3 | |
| - uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.IMAGE }} | |
| tags: | | |
| type=ref,event=tag | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - id: build | |
| uses: docker/build-push-action@v6 | |
| with: | |
| context: . | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| # This digest is the value FluxOS pins. It is the manifest LIST digest, so it | |
| # resolves to the right architecture on both x86 and arm nodes. | |
| - name: Publish digest to run summary | |
| run: | | |
| { | |
| echo '## Published' | |
| echo | |
| echo 'Pin this in FluxOS:' | |
| echo | |
| echo '```' | |
| echo "${{ env.IMAGE }}@${{ steps.build.outputs.digest }}" | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" |