Address CI friction between security and caching #155

New issue

Open

opened 2025-02-19 12:25:13 +01:00 by kiara · 4 comments

kiara commented

2025-02-19 12:25:13 +01:00

Owner

Our NixOS-based Gitea actions runner's jobs can access their Nix store (shared), which includes other jobs. This is a potential security concern, particularly if we wanted to allow anyone to sign up to this Forgejo instance and make PRs checked by CI.
As such, we may want to further consider our options on this.

c.f. prior discussion at #152

Our NixOS-based Gitea actions runner's jobs can access their Nix store (shared), which includes other jobs. This is a potential security concern, particularly if we wanted to allow anyone to sign up to this Forgejo instance and make PRs checked by CI. As such, we may want to further consider our options on this. c.f. prior discussion at #152

kiara added the

security

label

2025-02-19 12:25:13 +01:00

fricklerhandwerk commented

2025-02-19 14:03:07 +01:00

Owner

Yes, essentially we just need two isolated instances for eval/build.

kiara commented

2025-02-19 18:19:12 +01:00

Author

Owner

@fricklerhandwerk could you explain that a bit?

fricklerhandwerk commented

2025-02-19 18:25:04 +01:00

Owner

Like Nixpkgs or NGIpkgs does it: There's an isolated instance that will run builds on PRs, read-only accessing the main cache and not caching build results (or only between PR rebuilds), and another instance that runs builds on main and caches build results publicly.

Like [Nixpkgs](https://github.com/NixOS/nixpkgs/) or [NGIpkgs](https://github.com/ngi-nix/ngipkgs/) does it: There's an isolated instance that will run builds on PRs, read-only accessing the main cache and not caching build results (or only between PR rebuilds), and another instance that runs builds on `main` and caches build results publicly.

kiara commented

2025-02-19 18:32:04 +01:00

Author

Owner

that makes sense, thanks.
in addition tho, i think we would need to make sure our (main) builds would not contain sensitive info then.

that makes sense, thanks. in addition tho, i think we would need to make sure our (main) builds would not contain sensitive info then.

kiara referenced this issue

2025-03-22 09:49:04 +01:00

Continuous Integration builds available in a public cache #92

kiara added a new dependency

2025-04-01 23:01:24 +02:00

#291 code passes security check