Run Sized Linux checks on the existing Gitea runner

2026-10-09 18:46:33 -04:00
parent a1b40d1826
commit 67fe175ec7
6 changed files with 95 additions and 5 deletions
@@ -0,0 +1,40 @@
+name: Sized Linux checks
+
+on:
+  push:
+    branches: [main, sizequeen-scan-hardening]
+    paths: ['Cargo.toml', 'Cargo.lock', 'src/**', 'tests/**', 'benches/**', 'scripts/**', '.gitea/workflows/**']
+  pull_request:
+    branches: [main]
+    paths: ['Cargo.toml', 'Cargo.lock', 'src/**', 'tests/**', 'benches/**', 'scripts/**', '.gitea/workflows/**']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  linux-amd64:
+    name: Linux AMD64 / Rust 1.88.0
+    # Keep the existing shared runner limited to owner-triggered, same-repo code.
+    if: ${{ gitea.actor == 'gamertan' && (gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository) }}
+    runs-on: himesan-node24
+    timeout-minutes: 20
+    container:
+      image: sha256:514512270649a85769c2b8ecfcc3a860d3a7da67c29b9b7b1cfe4c75de41d322
+      options: >-
+        --user 65532:65532
+        --tmpfs /tmp/sized-mount-test:rw,nosuid,nodev,noexec,size=16m,uid=65532,gid=65532,mode=0700
+        --tmpfs /tmp/sized-mount-test/foreign:rw,nosuid,nodev,noexec,size=16m,uid=65532,gid=65532,mode=0700
+    env:
+      CARGO_HOME: /tmp/sized-cargo
+      CARGO_BUILD_JOBS: '2'
+      SIZED_TEST_SOURCE: ${{ gitea.workspace }}
+      SIZED_TEST_MOUNT_ROOT: /tmp/sized-mount-test
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        with:
+          persist-credentials: false
+      - name: Unprivileged Linux tests, real mount boundary, Clippy and release smoke
+        run: ./scripts/check-linux-container.sh
+      - name: Require an unchanged checkout
+        run: test -z "$(git status --porcelain=v1 --untracked-files=all)"