ci: mixed hardening: install incus-base only, validate @refs, save base/builder on fail, detect RUNNER_DEBUG - #33
Open
j4n wants to merge 4 commits into
Open
ci: mixed hardening: install incus-base only, validate @refs, save base/builder on fail, detect RUNNER_DEBUG#33j4n wants to merge 4 commits into
j4n wants to merge 4 commits into
Conversation
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 5, 2026 10:32
6e58c52 to
0f9dd1c
Compare
j4n
force-pushed
the
j4n/madmail-main
branch
2 times, most recently
from
August 5, 2026 11:43
21ce0a0 to
6c9a088
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 5, 2026 11:43
0f9dd1c to
74ab76e
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 5, 2026 11:57
74ab76e to
d7cb3cf
Compare
j4n
changed the title
j4n
force-pushed
the
j4n/incus-container-hardening
branch
2 times, most recently
from
August 6, 2026 11:23
b54535a to
a2eb39e
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 6, 2026 11:35
a2eb39e to
2604f7d
Compare
j4n
force-pushed
the
j4n/madmail-main
branch
2 times, most recently
from
August 11, 2026 10:39
17fa180 to
aa1e17d
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 11, 2026 10:39
2604f7d to
9ed3326
Compare
hpk42
force-pushed
the
j4n/madmail-main
branch
from
August 11, 2026 12:36
aa1e17d to
a726488
Compare
hpk42
force-pushed
the
j4n/incus-container-hardening
branch
from
August 11, 2026 12:36
9ed3326 to
11c8d1a
Compare
hpk42
force-pushed
the
j4n/madmail-main
branch
from
August 11, 2026 12:53
a726488 to
02a4d4d
Compare
hpk42
force-pushed
the
j4n/incus-container-hardening
branch
from
August 11, 2026 12:53
11c8d1a to
d2759fe
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 12, 2026 07:04
d2759fe to
118563f
Compare
j4n
force-pushed
the
j4n/madmail-main
branch
2 times, most recently
from
August 13, 2026 13:41
0f158e5 to
4f8695d
Compare
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 13, 2026 14:10
118563f to
41ca883
Compare
j4n
changed the title
j4n
changed the title
actions/cache only saves on job success; after a failed job, the next attempt rebuilds base and builder. Split into restore/save, count exported images and save them.
Do not install the full incus package, incus-base is enough, the full Incus package pulls qemu and all sorts of drivers taking quite a bit of CI time.
Every @ref ends up in `bash -ec` inside `git fetch/checkout` on the builder. Route all three remote SourceSpec construction sites through _remote_spec(), which makes it safe and surfaces typos cleanly as ValueError.
j4n
changed the title
j4n
force-pushed
the
j4n/incus-container-hardening
branch
from
August 13, 2026 15:46
41ca883 to
ea8d2c2
Compare
j4n
changed the title
j4n
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Working on #16, a few improvements came up that are bundled in this PR separately:
Moved out since the last review: the Incus bridge subnet IP filter, the check_init() extraction and the extra_config parameter are all related to #37.