ci: Make ci system read-only on the git work tree
This commit is contained in:
parent
fab1333292
commit
fa493ef088
2 changed files with 13 additions and 2 deletions
|
@ -41,7 +41,7 @@ export BASE_BUILD_DIR=${BASE_BUILD_DIR:-$BASE_ROOT_DIR}
|
||||||
export BASE_OUTDIR=${BASE_OUTDIR:-$BASE_BUILD_DIR/out/$HOST}
|
export BASE_OUTDIR=${BASE_OUTDIR:-$BASE_BUILD_DIR/out/$HOST}
|
||||||
export SDK_URL=${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}
|
export SDK_URL=${SDK_URL:-https://bitcoincore.org/depends-sources/sdks}
|
||||||
export WINEDEBUG=${WINEDEBUG:-fixme-all}
|
export WINEDEBUG=${WINEDEBUG:-fixme-all}
|
||||||
export DOCKER_PACKAGES=${DOCKER_PACKAGES:-build-essential libtool autotools-dev automake pkg-config bsdmainutils curl ca-certificates ccache python3 git}
|
export DOCKER_PACKAGES=${DOCKER_PACKAGES:-build-essential libtool autotools-dev automake pkg-config bsdmainutils curl ca-certificates ccache python3 rsync git}
|
||||||
export GOAL=${GOAL:-install}
|
export GOAL=${GOAL:-install}
|
||||||
export DIR_QA_ASSETS=${DIR_QA_ASSETS:-${BASE_BUILD_DIR}/qa-assets}
|
export DIR_QA_ASSETS=${DIR_QA_ASSETS:-${BASE_BUILD_DIR}/qa-assets}
|
||||||
export PATH=${BASE_ROOT_DIR}/ci/retry:$PATH
|
export PATH=${BASE_ROOT_DIR}/ci/retry:$PATH
|
||||||
|
|
|
@ -50,7 +50,13 @@ if [ -z "$RUN_CI_ON_HOST" ]; then
|
||||||
echo "Creating $DOCKER_NAME_TAG container to run in"
|
echo "Creating $DOCKER_NAME_TAG container to run in"
|
||||||
${CI_RETRY_EXE} docker pull "$DOCKER_NAME_TAG"
|
${CI_RETRY_EXE} docker pull "$DOCKER_NAME_TAG"
|
||||||
|
|
||||||
DOCKER_ID=$(docker run $DOCKER_ADMIN -idt --mount type=bind,src=$BASE_BUILD_DIR,dst=$BASE_BUILD_DIR --mount type=bind,src=$CCACHE_DIR,dst=$CCACHE_DIR -w $BASE_BUILD_DIR --env-file /tmp/env $DOCKER_NAME_TAG)
|
DOCKER_ID=$(docker run $DOCKER_ADMIN -idt \
|
||||||
|
--mount type=bind,src=$BASE_BUILD_DIR,dst=/ro_base,readonly \
|
||||||
|
--mount type=bind,src=$CCACHE_DIR,dst=$CCACHE_DIR \
|
||||||
|
--mount type=bind,src=$BASE_BUILD_DIR/depends,dst=$BASE_BUILD_DIR/depends \
|
||||||
|
-w $BASE_BUILD_DIR \
|
||||||
|
--env-file /tmp/env \
|
||||||
|
$DOCKER_NAME_TAG)
|
||||||
|
|
||||||
DOCKER_EXEC () {
|
DOCKER_EXEC () {
|
||||||
docker exec $DOCKER_ID bash -c "export PATH=$BASE_SCRATCH_DIR/bins/:\$PATH && cd $PWD && $*"
|
docker exec $DOCKER_ID bash -c "export PATH=$BASE_SCRATCH_DIR/bins/:\$PATH && cd $PWD && $*"
|
||||||
|
@ -86,6 +92,11 @@ export DIR_FUZZ_IN=${DIR_QA_ASSETS}/fuzz_seed_corpus/
|
||||||
|
|
||||||
DOCKER_EXEC mkdir -p "${BASE_BUILD_DIR}/sanitizer-output/"
|
DOCKER_EXEC mkdir -p "${BASE_BUILD_DIR}/sanitizer-output/"
|
||||||
|
|
||||||
|
if [ -z "$RUN_CI_ON_HOST" ]; then
|
||||||
|
echo "Create $BASE_BUILD_DIR"
|
||||||
|
DOCKER_EXEC rsync -a /ro_base/ $BASE_BUILD_DIR
|
||||||
|
fi
|
||||||
|
|
||||||
if [ "$USE_BUSY_BOX" = "true" ]; then
|
if [ "$USE_BUSY_BOX" = "true" ]; then
|
||||||
echo "Setup to use BusyBox utils"
|
echo "Setup to use BusyBox utils"
|
||||||
DOCKER_EXEC mkdir -p $BASE_SCRATCH_DIR/bins/
|
DOCKER_EXEC mkdir -p $BASE_SCRATCH_DIR/bins/
|
||||||
|
|
Loading…
Reference in a new issue