From bfa882873ab7d3e5e71e3ce371fc59b5517ef5bd Mon Sep 17 00:00:00 2001
From: Chris Markiewicz <effigies@gmail.com>
Date: Mon, 26 Aug 2024 14:55:08 -0400
Subject: [PATCH] chore(ci): Run Deno tests with/without network access

---
 .github/workflows/deno_tests.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deno_tests.yml b/.github/workflows/deno_tests.yml
index 4f10a3314..5d76fb247 100644
--- a/.github/workflows/deno_tests.yml
+++ b/.github/workflows/deno_tests.yml
@@ -39,6 +39,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-22.04, macos-12, windows-2022]
+        allow-net: [true, false]
       fail-fast: false
     defaults:
       run:
@@ -51,7 +52,13 @@ jobs:
       - uses: denoland/setup-deno@v1
         with:
           deno-version: v1.x
-      - run: deno test --allow-all --coverage=cov/ src/
+      - name: Set permissions with network access
+        run: echo 'PERMS=--allow-read --allow-env --allow-run --allow-net' >> $GITHUB_ENV
+        if: ${{ matrix.allow-net }}
+      - name: Set permissions without network access
+        run: echo 'PERMS=--allow-read --allow-env --allow-run --deny-net' >> $GITHUB_ENV
+        if: ${{ ! matrix.allow-net }}
+      - run: deno test $PERMS --coverage=cov/ src/
       - name: Collect coverage
         run: deno coverage cov/ --lcov --output=coverage.lcov
         if: ${{ always() }}