ci(mantis): run codex as unprivileged user · openclaw/openclaw@042e096
obviyus
·
2026-05-11
·
via Recent Commits to openclaw:main
| Original file line number | Diff line number | Diff line change |
|---|
@@ -341,6 +341,13 @@ jobs:
|
341 | 341 | exit 1 |
342 | 342 | fi |
343 | 343 | |
| 344 | + - name: Prepare Codex user |
| 345 | +shell: bash |
| 346 | +run: | |
| 347 | + set -euo pipefail |
| 348 | + sudo useradd --create-home --shell /bin/bash codex |
| 349 | + sudo chown -R codex:codex "$GITHUB_WORKSPACE" |
| 350 | + |
344 | 351 | - name: Run Codex Mantis Telegram agent |
345 | 352 | uses: openai/codex-action@5c3f4ccdb2b8790f73d6b21751ac00e602aa0c02 |
346 | 353 | env: |
@@ -368,7 +375,8 @@ jobs:
|
368 | 375 | model: ${{ vars.OPENCLAW_CI_OPENAI_MODEL_BARE }} |
369 | 376 | effort: high |
370 | 377 | sandbox: danger-full-access |
371 | | -safety-strategy: drop-sudo |
| 378 | +safety-strategy: unprivileged-user |
| 379 | +codex-user: codex |
372 | 380 | codex-args: '["--full-auto"]' |
373 | 381 | |
374 | 382 | - name: Inspect Mantis evidence manifest |
|
此内容由惯性聚合(RSS阅读器)自动聚合整理,仅供阅读参考。 原文来自 — 版权归原作者所有。