ci: re-order sysctl step for podvm_mkosi wf

A default directory is set workflow-wide that will only work after checkout, hence the sysctl call fails. Signed-off-by: Magnus Kulke <[email protected]>
confidential-containers · Dec 12, 2024 · 11ffb47 · 11ffb47
1 parent b9679f0
commit 11ffb47
Showing 1 changed file with 5 additions and 5 deletions.
diff --git a/.github/workflows/podvm_mkosi.yaml b/.github/workflows/podvm_mkosi.yaml
@@ -75,17 +75,17 @@ jobs:
       qcow2_oras_image: ${{ steps.publish_oras_qcow2.outputs.image }}:${{ steps.publish_oras_qcow2.outputs.tag }}
       docker_oci_image: ${{ steps.build_docker_oci.outputs.image }}
     steps:
-      # Required by rootless mkosi
-      - name: Un-restrict user namespaces
-        if: inputs.arch == 'amd64'
-        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-
       - name: Checkout
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
           ref: "${{ inputs.git_ref }}"
 
+      # Required by rootless mkosi
+      - name: Un-restrict user namespaces
+        if: inputs.arch == 'amd64'
+        run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
+
       - name: Rebase the code
         if: github.event_name == 'pull_request_target'
         working-directory: ./