Security (Seccomp AF_ALG) #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Security (Seccomp AF_ALG)" | |
| on: | |
| push: | |
| paths: | |
| - 'pkg/docker/seccomp-no-af-alg.json' | |
| - 'pkg/docker/Dockerfile.*' | |
| - 'test/security/seccomp/**' | |
| - '.github/workflows/security-seccomp.yml' | |
| pull_request: | |
| paths: | |
| - 'pkg/docker/seccomp-no-af-alg.json' | |
| - 'pkg/docker/Dockerfile.*' | |
| - 'test/security/seccomp/**' | |
| - '.github/workflows/security-seccomp.yml' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| seccomp-af-alg: | |
| name: Verify AF_ALG seccomp mitigation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - name: Pull test image | |
| run: docker pull python:3.13-slim-trixie | |
| - name: Validate JSON profile | |
| run: python3 -m json.tool pkg/docker/seccomp-no-af-alg.json > /dev/null | |
| - name: Run seccomp tests (python base image) | |
| run: bash test/security/seccomp/test-af-alg.sh python:3.13-slim-trixie | |
| # Build the image from the in-repo Dockerfile instead of pulling a | |
| # published tag: this validates the Dockerfile under change (the very | |
| # trigger of this workflow) and avoids coupling to the release that | |
| # publishes the dash-style tags (latest-python-3.13-slim). | |
| # | |
| # The committed Dockerfile clones the pinned release tag, which does | |
| # not exist yet while a release-prep PR is in flight (release-docker.yml | |
| # rewrites the pin from the real tag at publish time). Retarget the | |
| # source checkout at the code under test instead: the merge commit this | |
| # check reports against (github.sha) -- the same tree actions/checkout | |
| # built above -- rather than the unmerged PR-branch head. | |
| - name: Point the source checkout at the code under test | |
| env: | |
| # Always the base repo + github.sha: on pull_request this is the PR | |
| # *merge* commit (reachable from refs/pull/<n>/merge, so an anonymous | |
| # fetch-by-SHA resolves it), matching actions/checkout above; on push | |
| # it is the pushed commit. Both are pinned per run, so a later push | |
| # cannot change what an already-queued run builds. | |
| HEAD_URL: ${{ format('{0}/{1}', github.server_url, github.repository) }} | |
| HEAD_SHA: ${{ github.sha }} | |
| run: | | |
| # Fetch the exact SHA this check reports against, not a moving | |
| # branch tip (a later push to the branch must not change what an | |
| # already-queued run builds). | |
| sed -i \ | |
| -e "s|git clone --depth 1 -b [^ ]* [^ ]* unit|git init unit \&\& git -C unit fetch --depth 1 ${HEAD_URL} ${HEAD_SHA} \&\& git -C unit checkout --detach FETCH_HEAD|" \ | |
| pkg/docker/Dockerfile.python-3.13-slim | |
| grep -F "git -C unit fetch --depth 1 ${HEAD_URL} ${HEAD_SHA}" \ | |
| pkg/docker/Dockerfile.python-3.13-slim | |
| - name: Build FreeUnit python-3.13-slim image | |
| run: docker build -t freeunit:seccomp-test -f pkg/docker/Dockerfile.python-3.13-slim pkg/docker | |
| - name: Run seccomp tests (FreeUnit image) | |
| run: bash test/security/seccomp/test-af-alg.sh freeunit:seccomp-test |