ci: disable network

Disable network access via 'unshare' in two CI workflows to catch issues
like PR119333 where importing polonius meant bootstrap tried to pull crates
from the internet.

ChangeLog:
	PR rust/119333

	* .github/workflows/bootstrap.yml: Disable network via 'unshare'.
	* .github/workflows/ccpp.yml: Ditto.

diff --git a/.github/workflows/bootstrap.yml b/.github/workflows/bootstrap.yml
index f01dc2ad836509ca25fd222fdb8173a2706c8c9f..4bf042a0be99343fb4194cd39f25759549b53486 100644 (file)
--- a/.github/workflows/bootstrap.yml
+++ b/.github/workflows/bootstrap.yml
@@ -42,7 +42,8 @@ jobs:
     - name: Build
       run: |
            cd gccrs-build; \
-           make -j $(nproc)
+           # Build without network access
+           unshare --net --ipc -r /bin/bash -c "make -j $(nproc)"
 
     - name: Run Tests
       run: |

diff --git a/.github/workflows/ccpp.yml b/.github/workflows/ccpp.yml
index bdc2d8df3e5ef3b58247ac6bb7e9d6a72da751ab..9762a0a1acd6b9f4871d38f309fac0778cf103f8 100644 (file)
--- a/.github/workflows/ccpp.yml
+++ b/.github/workflows/ccpp.yml
@@ -61,8 +61,9 @@ jobs:
       run: |
            cd gccrs-build; \
            # Add cargo to our path quickly
-           . "$HOME/.cargo/env";
-           make -Otarget -j $(nproc) 2>&1 | tee log
+           . "$HOME/.cargo/env"; \
+           # Build without network access
+           unshare --net --ipc -r /bin/bash -c "make -Otarget -j $(nproc) 2>&1 | tee log ; exit \${PIPESTATUS[0]}"
 
     - name: Check for new warnings
       run: |