Merge pull request #293 from WaberZhuang/main

CI: prevent remote code execution through github action

Author: yuchen0cc

.github/workflows/ci-unit-test.yml

@@ -0,0 +1,36 @@
+name: Unit Test
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - 'main'
+
+jobs:
+  unit-test:
+    name: Unit Test
+    runs-on: ubuntu-22.04
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: src/github.com/containerd/accelerated-container-image
+          fetch-depth: 100
+
+      - name: install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22.0'
+
+      - name: set env
+        shell: bash
+        run: |
+          echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
+          echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
+
+      - name: unit test
+        working-directory: src/github.com/containerd/accelerated-container-image
+        run: |
+          sudo GO_TESTFLAGS=-v make test

.github/workflows/ci.yml

@@ -17,34 +17,6 @@ on:
       - labeled
 
 jobs:
-  unit-test:
-    name: Unit Test
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
-
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
-          path: src/github.com/containerd/accelerated-container-image
-          fetch-depth: 100
-
-      - name: install Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.22.0'
-
-      - name: set env
-        shell: bash
-        run: |
-          echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
-          echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
-
-      - name: unit test
-        working-directory: src/github.com/containerd/accelerated-container-image
-        run: |
-          sudo GO_TESTFLAGS=-v make test
-
   lowercase-repo:
     name: Lowercase Repo
     runs-on: ubuntu-22.04