mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Josh Siviour
a2c451128d
setup.sh aborts twice on resolute. qemu-kvm is a virtual package with two providers there, so apt refuses to resolve it; the token was redundant anyway since $QEMU_PACKAGES already installs qemu-system-x86/arm and spinifex execs the qemu-system-* binaries directly. sudo-rs, Ubuntu's default sudo since 25.10, then rejects the sudoers file: it implements no pam_session Defaults setting, and forbids a wildcard inside a command argument. pam_session is now emitted only for classic sudo, and the sysctl grant names a fixed-verb helper instead of a wildcard. The helper is narrower than the rule it replaces: it accepts one interface, a key restricted to rp_filter or accept_local, and a value restricted to 0 or 1, where the old grant permitted any net.ipv4.conf key at any value. Granting sysctl with an unconstrained argument was rejected as root-equivalent. Adds scripts/lint-apt-packages.sh and an Apt Packages workflow so the runtime package list is resolved against each supported suite's real indices in CI.
49 lines
1.2 KiB
YAML
49 lines
1.2 KiB
YAML
name: Apt Packages
|
|
|
|
# Path-filtered like image-scripts.yml: this resolves setup.sh's runtime package
|
|
# list against each supported suite's real indices, so a renamed, dropped, or
|
|
# ambiguously virtual package fails here rather than on a user's machine.
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
- dev
|
|
paths:
|
|
- scripts/setup.sh
|
|
- scripts/lint-apt-packages.sh
|
|
- .github/workflows/apt-packages.yml
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- dev
|
|
paths:
|
|
- scripts/setup.sh
|
|
- scripts/lint-apt-packages.sh
|
|
- .github/workflows/apt-packages.yml
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
apt_packages:
|
|
name: Resolve apt list (${{ matrix.image }})
|
|
runs-on: ubuntu-26.04
|
|
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
# The suites the nightly E2E matrix actually installs on. Ubuntu 22.04 is
|
|
# accepted by detect_os but has never been exercised and does not resolve.
|
|
image:
|
|
- ubuntu:24.04
|
|
- ubuntu:26.04
|
|
- debian:13
|
|
|
|
steps:
|
|
- name: Checkout Code
|
|
uses: actions/checkout@v7
|
|
|
|
- name: Resolve runtime package list
|
|
run: ./scripts/lint-apt-packages.sh ${{ matrix.image }}
|