Check for writes outside of the build directory

ChangeLog: * .github/workflows/ccpp.yml: Make files outside the build directory read-only. Signed-off-by: Owen Avery <[email protected]>
Rust-GCC · Apr 25, 2024 · f4df263 · f4df263
1 parent fa86c37
commit f4df263
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/.github/workflows/ccpp.yml b/.github/workflows/ccpp.yml
@@ -41,6 +41,10 @@ jobs:
           # install Rust directly using rustup
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=1.72.0;
 
+    - name: Make Source Read-Only
+      run: chmod -R -w .;
+           chmod 711 .
+
     - name: Configure
       run: |
            mkdir -p gccrs-build;
@@ -122,6 +126,10 @@ jobs:
           # install Rust directly using rustup
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=1.72.0;
 
+    - name: Make Source Read-Only
+      run: chmod -R -w .;
+           chmod 711 .
+
     - name: Configure
       run: |
            mkdir -p gccrs-build;
@@ -205,6 +213,10 @@ jobs:
           # install Rust directly using rustup
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=1.72.0;
 
+    - name: Make Source Read-Only
+      run: chmod -R -w .;
+           chmod 711 .
+
     - name: Configure
       run: |
            mkdir -p gccrs-build;
@@ -264,6 +276,10 @@ jobs:
           # install Rust directly using rustup
           curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain=1.72.0;
 
+    - name: Make Source Read-Only
+      run: chmod -R -w .;
+           chmod 711 .
+
     - name: Configure
       run: |
            mkdir -p gccrs-build;