From 3bb90c9fd346af3f11df2e93e25c4b05ba72dae2 Mon Sep 17 00:00:00 2001 From: joshsiv-mulga Date: Fri, 5 Jun 2026 22:58:07 +1000 Subject: [PATCH] fix(ci): guard release Clean Workspace against leaked iso-builder devtmpfs The iso job mounts a kernel-global devtmpfs under the workspace (.cache/rootfs/dev). A killed job skips its EXIT-trap unmount and leaks the bind; the verify job (same ci-single runner) then ran a bare 'rm -rf $WORKSPACE/*' that could traverse it and wipe the host /dev. Detach any mount under the workspace before deleting and add --one-file-system so rm never crosses a mount boundary. Same backstop added to the iso job's own cleanup. --- .github/workflows/release.yml | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c23db7f94..63a884274 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -131,7 +131,16 @@ jobs: REPO: ${{ github.repository }} steps: - name: Clean Workspace - run: rm -rf "$GITHUB_WORKSPACE"/* + run: | + # This runner (ci-single) is shared with the iso job, which mounts a + # kernel-global devtmpfs at /mulga/scripts/iso-builder/.cache/rootfs/dev. + # If that job is killed its EXIT-trap unmount never runs and the bind + # leaks; a plain rm -rf then traverses it and deletes the host's /dev + # (wipes /dev/null, wedges the box). Detach any leaked mounts under the + # workspace first, then forbid rm from crossing a mount boundary. + awk -v w="$GITHUB_WORKSPACE" '$2 ~ "^"w {print $2}' /proc/mounts \ + | sort -r | xargs -r -I{} sudo umount -l -R {} || true + sudo rm -rf --one-file-system "$GITHUB_WORKSPACE"/* - uses: actions/create-github-app-token@v3 id: app-token @@ -216,7 +225,7 @@ jobs: sudo umount -l "${ROOTFS}/dev" 2>/dev/null || true sudo umount -l "${ROOTFS}/sys" 2>/dev/null || true sudo umount -l "${ROOTFS}/proc" 2>/dev/null || true - sudo rm -rf "$GITHUB_WORKSPACE"/* + sudo rm -rf --one-file-system "$GITHUB_WORKSPACE"/* - uses: actions/create-github-app-token@v3 id: app-token