README.md

# example

A Go test that only passes on OpenBSD, run from GitHub Actions on an
OpenBSD -current VM from [chroot.dev](https://chroot.dev) with
[chroot-action](https://github.com/chroot-dev/chroot-action).

`sandbox.Restrict(dir)` confines the process with unveil(2) and pledge(2):
`dir` stays readable and the rest of the file system is gone. The test
checks both from a child process, since the restrictions last for the
whole process. On Linux the test is skipped.

The workflow is [.github/workflows/openbsd.yml](.github/workflows/openbsd.yml).
Each job copies `ci-go`, a VM with 2 cpus and 1 GiB prepared once with Go
installed; the copy keeps that size:

    ssh chroot.dev new -n ci-go -c 2 -m 1G -w -s /dev/stdin <<'EOF'
    doas pkg_add -I go
    EOF

## License

ISC, see [LICENSE](LICENSE).