refactor: refuse unsandboxed campaign runs

Without a working bubblewrap the pass is refused and nothing third-party runs, probes require the sandbox and builds are refused, unless --allow-unsandboxed is given. A job report holding an alert raises an autorun alert.
This commit is contained in:
Abdessamad Derraz committed 2026-10-27 11:53:35 +01:00
1 parent e440073562
commit fd449fdae3
5 files changed
+93 -6

No files matched your search

+2 -2
View File
@@ -13,8 +13,8 @@
"started_at": { "type": "string", "format": "date-time" },
"ended_at": { "type": "string", "format": "date-time" },
"result": {
"enum": ["complete", "budget", "paused", "stopped"],
"description": "complete: nothing runnable was left. budget: the time budget ended the pass. paused: a busy host or a full disk ended it, the next pass resumes. stopped: interrupted."
"enum": ["complete", "budget", "paused", "stopped", "refused"],
"description": "complete: nothing runnable was left. budget: the time budget ended the pass. paused: a busy host or a full disk ended it, the next pass resumes. stopped: interrupted. refused: no sandbox for third-party code, nothing ran."
},
"detail": { "type": "string" },
"counts": {