Garak's Linux CI workflow tests across x86-64 and ARM architectures and Python 3.10–3.13 using pytest, isolating all cache data to the workspace and operating under least-privilege permissions.
The Linux CI workflow (.github/workflows/test_linux.yml) runs a matrix across both ubuntu-latest (x86-64) and ubuntu-24.04-arm (ARM) to ensure cross-architecture compatibility.[1] Across that matrix, Python 3.10, 3.12, and 3.13 are each tested.[1]
Dependencies are installed with pip install --no-cache-dir -r requirements.txt, after which the workflow explicitly runs python -m pip cache purge to reduce disk usage.[1] The workflow sets XDG_CACHE_HOME to ${{ github.workspace }}/.cache so that all cache data — garak data files and HuggingFace models — lands inside the workspace and remains restorable across runs.[1] Two artifact paths, .cache/garak/data and .cache/huggingface, are persisted across runs under the key garak-test-resources-shared via actions/cache/restore.[1]
Tests are executed with python -m pytest tests/.[1] The workflow applies a least-privilege security posture: every GitHub Actions permission key (actions, contents, id-token, pull-requests, and all others) is explicitly set to none.[1]
Sources