From 772f8f1b90d5e0ad1f03e7b5d7cf8d30ed04aa6a Mon Sep 17 00:00:00 2001 From: Vincent Ambo Date: Thu, 26 May 2022 14:31:18 +0200 Subject: feat(ops/pipelines): Evaluate depot pipeline in restricted-eval mode Change-Id: Ic5b98a0777860b68dabb9a9b59e8c682236a71c7 Reviewed-on: https://cl.tvl.fyi/c/depot/+/4884 Tested-by: BuildkiteCI Reviewed-by: grfn --- ops/pipelines/static-pipeline.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/ops/pipelines/static-pipeline.yaml b/ops/pipelines/static-pipeline.yaml index 2936f56d2c..2e35a8a179 100644 --- a/ops/pipelines/static-pipeline.yaml +++ b/ops/pipelines/static-pipeline.yaml @@ -52,7 +52,10 @@ steps: PIPELINE_ARGS="--arg parentTargetMap tmp/parent-target-map.json" fi - nix-build -A ops.pipelines.depot -o pipeline --show-trace $$PIPELINE_ARGS + nix-build --option restrict-eval true --include "depot=$${PWD}"\ + --allowed-uris 'https://' \ + -A ops.pipelines.depot \ + -o pipeline --show-trace $$PIPELINE_ARGS # Steps need to be uploaded in reverse order because pipeline # upload prepends instead of appending. -- cgit 1.4.1