Commit 92d9ae2
authored
Use env vars on CI to set protocol.file.allow
Instead of setting a global git configuration.
This makes no significant difference for security on CI, but it is
an iterative step toward a more specific way of setting them that
will apply on CI and locally and require less configuration.
In addition, this shows an approach more similar to what users who
do not want to carefully review the security impact of changing
the global setting can use locally (and which is more secure).1 parent 537af83 commit 92d9ae2
2 files changed
Lines changed: 8 additions & 5 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -26,7 +26,6 @@ jobs: | |||
| 26 | 26 | shell: bash.exe -eo pipefail -o igncr "{0}" | |
| 27 | 27 | run: | | |
| 28 | 28 | /usr/bin/git config --global --add safe.directory "$(pwd)" | |
| 29 | - /usr/bin/git config --global protocol.file.allow always | ||
| 30 | 29 | - name: Install dependencies and prepare tests | |
| 31 | 30 | shell: bash.exe -eo pipefail -o igncr "{0}" | |
| 32 | 31 | run: | | |
@@ -47,4 +46,8 @@ jobs: | |||
| 47 | 46 | shell: bash.exe -eo pipefail -o igncr "{0}" | |
| 48 | 47 | run: | | |
| 49 | 48 | /usr/bin/python -m pytest | |
| 49 | + env: | ||
| 50 | + GIT_CONFIG_COUNT: "1" | ||
| 51 | + GIT_CONFIG_KEY_0: protocol.file.allow | ||
| 52 | + GIT_CONFIG_VALUE_0: always | ||
| 50 | 53 | continue-on-error: false | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -52,14 +52,14 @@ jobs: | |||
| 52 | 52 | set -x | |
| 53 | 53 | mypy -p git | |
| 54 | 54 | ||
| 55 | - - name: Tell git to allow file protocol even for submodules | ||
| 56 | - run: | | ||
| 57 | - /usr/bin/git config --global protocol.file.allow always | ||
| 58 | - | ||
| 59 | 55 | - name: Test with pytest | |
| 60 | 56 | run: | | |
| 61 | 57 | set -x | |
| 62 | 58 | pytest | |
| 59 | + env: | ||
| 60 | + GIT_CONFIG_COUNT: "1" | ||
| 61 | + GIT_CONFIG_KEY_0: protocol.file.allow | ||
| 62 | + GIT_CONFIG_VALUE_0: always | ||
| 63 | 63 | continue-on-error: false | |
| 64 | 64 | ||
| 65 | 65 | - name: Documentation | |
0 commit comments