mirror of
https://github.com/coolsnowwolf/lede.git
synced 2025-04-16 04:13:31 +00:00
4e90e9afc8
This PR adds explicit permissions section to workflows. This is a security best practice because by default workflows run with extended set of permissions (except from on: pull_request from external forks). By specifying any permission explicitly all others are set to none. By using the principle of least privilege the damage a compromised workflow can do (because of an injection or compromised third party tool or action) is restricted. It is recommended to have most strict permissions on the top level and grant write permissions on job level case by case.
116 lines
3.5 KiB
YAML
116 lines
3.5 KiB
YAML
#
|
|
# <https://github.com/KFERMercer/OpenWrt-CI>
|
|
#
|
|
# Copyright (C) 2019 P3TERX
|
|
#
|
|
# Copyright (C) 2020 KFERMercer
|
|
#
|
|
name: OpenWrt-CI
|
|
|
|
on:
|
|
schedule:
|
|
- cron: 0 20 * * *
|
|
release:
|
|
types: [published]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
|
|
build_openwrt:
|
|
|
|
permissions:
|
|
contents: write # for release creation
|
|
|
|
name: Build OpenWrt firmware
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
if: github.event.repository.owner.id == github.event.sender.id
|
|
|
|
steps:
|
|
|
|
- name: Checkout
|
|
uses: actions/checkout@v2
|
|
with:
|
|
ref: master
|
|
|
|
- name: Space cleanup
|
|
env:
|
|
DEBIAN_FRONTEND: noninteractive
|
|
run: |
|
|
docker rmi `docker images -q`
|
|
sudo rm -rf /usr/share/dotnet /etc/mysql /etc/php /etc/apt/sources.list.d /usr/local/lib/android
|
|
sudo -E apt-get -y purge azure-cli ghc* zulu* hhvm llvm* firefox google* dotnet* powershell openjdk* adoptopenjdk* mysql* php* mongodb* dotnet* moby* snapd* || true
|
|
sudo -E apt-get update
|
|
sudo -E apt-get -y install build-essential asciidoc binutils bzip2 gawk gettext git libncurses5-dev libz-dev patch python3 unzip zlib1g-dev lib32gcc1 libc6-dev-i386 subversion flex uglifyjs gcc-multilib g++-multilib p7zip p7zip-full msmtp libssl-dev texinfo libglib2.0-dev xmlto qemu-utils upx libelf-dev autoconf automake libtool autopoint device-tree-compiler antlr3 gperf swig
|
|
sudo -E apt-get -y autoremove --purge
|
|
sudo -E apt-get clean
|
|
|
|
df -h
|
|
|
|
- name: Update feeds
|
|
run: |
|
|
sed -i 's/#src-git helloworld/src-git helloworld/g' ./feeds.conf.default
|
|
./scripts/feeds update -a
|
|
./scripts/feeds install -a
|
|
|
|
- name: Generate configuration file
|
|
run: make defconfig
|
|
|
|
- name: Make download
|
|
run: |
|
|
make download -j8
|
|
find dl -size -1024c -exec rm -f {} \;
|
|
|
|
- name: Compile firmware
|
|
run: |
|
|
make -j$(nproc) || make -j1 V=s
|
|
echo "======================="
|
|
echo "Space usage:"
|
|
echo "======================="
|
|
df -h
|
|
echo "======================="
|
|
du -h --max-depth=1 ./ --exclude=build_dir --exclude=bin
|
|
du -h --max-depth=1 ./build_dir
|
|
du -h --max-depth=1 ./bin
|
|
|
|
- name: Prepare artifact
|
|
run: |
|
|
mkdir -p ./artifact/firmware
|
|
mkdir -p ./artifact/package
|
|
mkdir -p ./artifact/buildinfo
|
|
rm -rf $(find ./bin/targets/ -type d -name "packages")
|
|
cp -rf $(find ./bin/targets/ -type f) ./artifact/firmware/
|
|
cp -rf $(find ./bin/packages/ -type f -name "*.ipk") ./artifact/package/
|
|
cp -rf $(find ./bin/targets/ -type f -name "*.buildinfo" -o -name "*.manifest") ./artifact/buildinfo/
|
|
|
|
- name: Deliver buildinfo
|
|
uses: actions/upload-artifact@v2
|
|
with:
|
|
name: OpenWrt_buildinfo
|
|
path: ./artifact/buildinfo/
|
|
|
|
- name: Deliver package
|
|
uses: actions/upload-artifact@v2
|
|
with:
|
|
name: OpenWrt_package
|
|
path: ./artifact/package/
|
|
|
|
- name: Deliver firmware
|
|
uses: actions/upload-artifact@v2
|
|
with:
|
|
name: OpenWrt_firmware
|
|
path: ./bin/targets/
|
|
|
|
|
|
- name: Upload release asset
|
|
if: github.event == 'release'
|
|
uses: svenstaro/upload-release-action@v2
|
|
with:
|
|
repo_token: ${{ secrets.YOURTOKEN }}
|
|
file: ./artifact/firmware/*
|
|
tag: ${{ github.ref }}
|
|
file_glob: true
|