Add mount /tmp as tmpfs to drone script

[guillep2k]

Lets check if we can mount /tmp as tmpfs in our scripts.

Not working (see my next comment), but I'll leave this here in case someone comes up with a fix.

[guillep2k]

No luck, apparently....

[guillep2k]

I can run locally using:

drone exec --trusted --pipeline testing-amd64 

but that's out of the question in our setup, I guess. ☹️

[lafriks]

Yeah that needs option set to trusted for repository

[lafriks]

But problem with that is that allows even for PRs to allow access to host. Only way to prevent this would be signing yaml file and not allow to change them in PR

[guillep2k]

So I've made some local tests in my humble VM server, and I can see that the benefits are not very noticeable if I/O bottleneck isn't actually a problem (my server is pretty much idle on a Sunday afternoon). I've executed test-sqlite two times for each scenario (everything was built in advance).

using tmpfs:

sudo mount -t tmpfs integrations-data integrations-data
time make test-sqlite
[....]
real    12m21.794s
user    11m44.621s
sys     3m16.102s

real    12m20.810s
user    11m46.417s
sys     3m12.369s

normal (NOT using tmpfs):

sudo umount integrations-data/
time make test-sqlite
[....]
real    12m53.892s
user    11m37.175s
sys     4m3.791s

real    12m49.556s
user    11m34.685s
sys     4m3.578s

[guillep2k]

But problem with that is that allows even for PRs to allow access to host. Only way to prevent this would be signing yaml file and not allow to change them in PR

@lafriks Given the russian-doll structure of docker, maybe there can be a parent yml that's signed and a child yml we can edit? Or depart from an image composed to implements that?

[lafriks]

@guillep2k no that is not possible. Only option to sign would be to run drone sign go-gitea/gitea --save for every PR that changes .drone.yaml file. Only users with admin access to gitea repo can do it.

[lafriks]

Initially we had signed drone.yml but we dropped it... maybe for this we could add it back

[zeripath]

oh that would probably allow us to have extra steps - like fmt and linters offering fixing comments.