From ddc42b473583fff6e9575cd6b6cb674238bc6da3 Mon Sep 17 00:00:00 2001 From: James Pine Date: Sun, 19 Apr 2026 19:19:19 -0700 Subject: [PATCH] ci(release): pin free-disk-space action + stop removing LLVM Review feedback on the Linux release workflow: 1. `jlumbroso/free-disk-space@main` was an unpinned ref in a job that runs with `contents: write` and handles signing secrets. Pin to the v1.3.1 commit SHA so a force-push or repo compromise can't inject arbitrary code into our release flow. 2. `large-packages: true` runs `apt-get remove '^llvm-.*'`, wiping LLVM just before the next step installs `llvm-dev`. That wastes CI time and risks cascade-removal of reverse deps that won't be pulled back in by `llvm-dev` alone. The remaining toggles (android, dotnet, haskell, swap-storage) already clear ~20 GB, which is enough headroom for the Python + torch + PyInstaller build. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/release.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 561a7f32..25e5a943 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,13 +50,19 @@ jobs: # "github runners suck") — not a code issue, a disk-pressure one. - name: Free up disk space (ubuntu) if: contains(matrix.platform, 'ubuntu') || contains(matrix.platform, 'namespace') - uses: jlumbroso/free-disk-space@main + # Pinned to v1.3.1 (SHA) — this job runs with contents: write and + # handles signing secrets later, so we don't want a floating ref. + uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be with: tool-cache: false android: true dotnet: true haskell: true - large-packages: true + # large-packages: true would `apt-get remove '^llvm-.*'`, which + # cascade-removes reverse deps that won't be pulled back in by the + # `llvm-dev` install below. The other flags already free ~20 GB, + # enough for the Python + torch + PyInstaller build. + large-packages: false swap-storage: true - name: Install dependencies (ubuntu only)