261811
From b91a67f2fdd11710c67b4a965bcbecce2833c8d5 Mon Sep 17 00:00:00 2001
261811
From: Frantisek Sumsal <frantisek@sumsal.cz>
261811
Date: Wed, 13 Jul 2022 11:12:36 +0200
261811
Subject: [PATCH] ci: limit which env variables we pass through `sudo`
261811
261811
to work around #23987.
261811
261811
(cherry picked from commit d46e7c7cfd6c286a38298c067f16ac784c2a26f0)
261811
261811
Related: #2087677
261811
---
261811
 .github/workflows/unit_tests.yml | 10 ++++++++--
261811
 1 file changed, 8 insertions(+), 2 deletions(-)
261811
261811
diff --git a/.github/workflows/unit_tests.yml b/.github/workflows/unit_tests.yml
261811
index 2afde5d59d..58b7b7cdb2 100644
261811
--- a/.github/workflows/unit_tests.yml
261811
+++ b/.github/workflows/unit_tests.yml
261811
@@ -28,8 +28,14 @@ jobs:
261811
       - name: Repository checkout
261811
         uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
261811
       - name: Install build dependencies
261811
-        run: sudo -E .github/workflows/unit_tests.sh SETUP
261811
+        run: |
261811
+          # Drop XDG_* stuff from /etc/environment, so we don't get the user
261811
+          # XDG_* variables when running under sudo
261811
+          sudo sed -i '/^XDG_/d' /etc/environment
261811
+          # Pass only specific env variables through sudo, to avoid having
261811
+          # the already existing XDG_* stuff on the "other side"
261811
+          sudo --preserve-env=CRYPTOLIB,GITHUB_ACTIONS,CI .github/workflows/unit_tests.sh SETUP
261811
       - name: Build & test (${{ matrix.run_phase }}-${{ matrix.cryptolib }})
261811
-        run: sudo -E .github/workflows/unit_tests.sh RUN_${{ matrix.run_phase }}
261811
+        run: sudo --preserve-env=CRYPTOLIB,GITHUB_ACTIONS,CI .github/workflows/unit_tests.sh RUN_${{ matrix.run_phase }}
261811
         env:
261811
           CRYPTOLIB: ${{ matrix.cryptolib }}