From 421d997609422c4bc5d020d3cb4f96c9bf7d4b3f Mon Sep 17 00:00:00 2001 From: Mariano Abad Date: Tue, 21 Jul 2026 00:42:01 -0300 Subject: [PATCH] ci: make the pinned libdrmtap commit SHA literal do not let an inherited DRMTAP_SHA override the verified commit in CI, so the tag/commit pair is immutable there. build.py keeps the env override for local forks. --- .github/workflows/flutter-build.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/flutter-build.yml b/.github/workflows/flutter-build.yml index 94ddd4a79..b8ec1061e 100644 --- a/.github/workflows/flutter-build.yml +++ b/.github/workflows/flutter-build.yml @@ -1710,7 +1710,8 @@ jobs: # this once rustdesk-org carries v0.4.13). export DRMTAP_REPO="https://github.com/fxd0h/libdrmtap" export DRMTAP_REF="v0.4.13" - export DRMTAP_SHA="${DRMTAP_SHA:-c9cf0938f3b10a3d4a9eeb9c6f97aaa1606c6b4a}" + # Literal (not overridable by an inherited env var) so the tag/commit pair is immutable in CI. + export DRMTAP_SHA="c9cf0938f3b10a3d4a9eeb9c6f97aaa1606c6b4a" # Guard: refuse a loose/branch ref so a moving `main` can never silently # regress the pin. Only an EXACT vX.Y.Z tag is accepted (a strict anchored # match, so values like v0.4.13-ci or a branch that resolves under