Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 92d9ae2

Browse filesBrowse files
EliahKaganEliahKagan
authored
Use env vars on CI to set protocol.file.allow
 Instead of setting a global git configuration. This makes no significant difference for security on CI, but it is an iterative step toward a more specific way of setting them that will apply on CI and locally and require less configuration. In addition, this shows an approach more similar to what users who do not want to carefully review the security impact of changing the global setting can use locally (and which is more secure).
1 parent 537af83 commit 92d9ae2
Copy full SHA for 92d9ae2

File tree

2 files changed

+8
-5
lines changed
Filter options

2 files changed

+8
-5
lines changed

‎.github/workflows/cygwin-test.yml

Copy file name to clipboardExpand all lines: .github/workflows/cygwin-test.yml
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ jobs:
2626
shell: bash.exe -eo pipefail -o igncr "{0}"
2727
run: |
2828
/usr/bin/git config --global --add safe.directory "$(pwd)"
29-
/usr/bin/git config --global protocol.file.allow always
3029
- name: Install dependencies and prepare tests
3130
shell: bash.exe -eo pipefail -o igncr "{0}"
3231
run: |
@@ -47,4 +46,8 @@ jobs:
4746
shell: bash.exe -eo pipefail -o igncr "{0}"
4847
run: |
4948
/usr/bin/python -m pytest
49+
env:
50+
GIT_CONFIG_COUNT: "1"
51+
GIT_CONFIG_KEY_0: protocol.file.allow
52+
GIT_CONFIG_VALUE_0: always
5053
continue-on-error: false

‎.github/workflows/pythonpackage.yml

Copy file name to clipboardExpand all lines: .github/workflows/pythonpackage.yml
+4-4Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -52,14 +52,14 @@ jobs:
5252
set -x
5353
mypy -p git
5454
55-
- name: Tell git to allow file protocol even for submodules
56-
run: |
57-
/usr/bin/git config --global protocol.file.allow always
58-
5955
- name: Test with pytest
6056
run: |
6157
set -x
6258
pytest
59+
env:
60+
GIT_CONFIG_COUNT: "1"
61+
GIT_CONFIG_KEY_0: protocol.file.allow
62+
GIT_CONFIG_VALUE_0: always
6363
continue-on-error: false
6464

6565
- name: Documentation

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.