feat(rules): ask before container privilege escalation or host breakout #134
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| build-test-linux: | |
| name: Build & Test (Linux ${{ matrix.arch }}) | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x86_64 | |
| runner: ubuntu-latest | |
| - arch: aarch64 | |
| runner: ubuntu-24.04-arm | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch head as of 2026-04 | |
| - name: Cache Cargo registry and build artifacts | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ matrix.arch }}-cargo- | |
| - name: Build | |
| run: make build | |
| - name: Download Falco | |
| run: | | |
| make download-falco-linux | |
| echo "${PWD}/$(make falco-linux-bin-dir)" >> "$GITHUB_PATH" | |
| - name: Verify Falco | |
| run: falco --version | |
| - name: Run interceptor tests | |
| run: make test-interceptor | |
| - name: Run Codex interceptor tests | |
| run: make test-codex-interceptor | |
| - name: Run e2e tests | |
| run: make test-e2e | |
| - name: Run Codex e2e tests | |
| run: make test-codex-e2e | |
| build-test-windows: | |
| name: Build & Test (Windows ${{ matrix.arch }}) | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: x64 | |
| runner: windows-latest | |
| vcpkg_triplet: x64-windows-static | |
| - arch: arm64 | |
| runner: windows-11-arm | |
| vcpkg_triplet: arm64-windows-static | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch head as of 2026-04 | |
| - name: Install make | |
| run: choco install make -y | |
| - name: Cache vcpkg installed tree | |
| uses: actions/cache@v4 | |
| with: | |
| # GitHub-hosted Windows runners ship vcpkg at C:\vcpkg. Cache only | |
| # the `installed/<triplet>` subdir so a triplet change invalidates | |
| # independently. | |
| path: C:\vcpkg\installed\${{ matrix.vcpkg_triplet }} | |
| key: vcpkg-${{ matrix.vcpkg_triplet }}-curl-${{ hashFiles('.github/workflows/ci.yaml') }} | |
| - name: Install vcpkg curl | |
| run: vcpkg install curl:${{ matrix.vcpkg_triplet }} | |
| - name: Cache Cargo registry and build artifacts | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ matrix.arch }}-cargo- | |
| - name: Cache Falco build | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| build/falco-*-windows-* | |
| build/falco-src-* | |
| key: falco-windows-${{ matrix.arch }}-${{ hashFiles('installers/windows/build-falco.ps1', 'installers/windows/falco-windows-*.patch') }} | |
| - name: Build | |
| run: make build | |
| - name: Build Falco from source | |
| run: make falco-windows-${{ matrix.arch }} | |
| - name: Run interceptor tests | |
| run: make test-interceptor | |
| - name: Run Codex interceptor tests | |
| run: make test-codex-interceptor | |
| - name: Run e2e tests | |
| run: make test-e2e | |
| - name: Run Codex e2e tests | |
| run: make test-codex-e2e | |
| - name: Install WiX Toolset | |
| run: | | |
| dotnet tool install --global wix | |
| wix eula accept wix7 | |
| wix extension add --global WixToolset.Util.wixext | |
| wix extension add --global WixToolset.UI.wixext | |
| - name: Build MSI | |
| run: >- | |
| powershell -NoProfile -ExecutionPolicy Bypass -File installers/windows/package.ps1 | |
| -Arch ${{ matrix.arch }} -SkipRustBuild -SkipFalcoBuild | |
| - name: Upload MSI artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: windows-${{ matrix.arch }}-msi | |
| path: | | |
| build/out/*.msi | |
| if-no-files-found: error | |
| build-test-macos: | |
| name: Build & Test (macOS ${{ matrix.arch }}) | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: aarch64 | |
| runner: macos-latest | |
| - arch: x86_64 | |
| runner: macos-15-intel | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch head as of 2026-04 | |
| - name: Install dependencies | |
| run: brew install cmake openssl@3 | |
| env: | |
| HOMEBREW_NO_AUTO_UPDATE: 1 | |
| - name: Cache Cargo registry and build artifacts | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-${{ matrix.arch }}-cargo-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-${{ matrix.arch }}-cargo- | |
| - name: Cache Falco build | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| build/falco-*-darwin-* | |
| build/falco-src-* | |
| key: falco-macos-${{ matrix.arch }}-${{ hashFiles('installers/macos/build-falco.sh') }} | |
| - name: Build | |
| run: make build | |
| - name: Build Falco from source | |
| run: make falco-macos | |
| - name: Add Falco to PATH | |
| run: echo "${PWD}/$(make falco-macos-bin-dir)" >> "$GITHUB_PATH" | |
| - name: Verify Falco | |
| run: falco --version | |
| - name: Run interceptor tests | |
| run: make test-interceptor | |
| - name: Run Codex interceptor tests | |
| run: make test-codex-interceptor | |
| - name: Run e2e tests | |
| run: make test-e2e | |
| - name: Run Codex e2e tests | |
| run: make test-codex-e2e | |
| - name: Build .pkg | |
| run: make macos-${{ matrix.arch }} | |
| - name: Run installed-service smoke test | |
| run: bash tests/test_installed_service_macos.sh |