fence repolinter docker action to prevent docker user from poisoning the filesystem permissions (#5256)

Signed-off-by: garyschulte <garyschulte@gmail.com>

.github/workflows/checks.yml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   spotless:
-    runs-on: [besu,Linux,self-hosted,X64]
+    runs-on: [besu,Linux,self-hosted,X64,nodocker]
     if: ${{ github.actor != 'dependabot[bot]' }}
     steps:
       - name: Checkout Repo
@@ -21,7 +21,7 @@ jobs:
       - name: spotless
         run: ./gradlew --no-daemon --parallel clean spotlessCheck
   javadoc_17:
-    runs-on: [besu,Linux,self-hosted,X64]
+    runs-on: [besu,Linux,self-hosted,X64,nodocker]
     if: ${{ github.actor != 'dependabot[bot]' }}
     steps:
       - name: Checkout Repo

.github/workflows/codeql.yml

@@ -24,7 +24,7 @@ on:
 jobs:
   analyze:
     name: Analyze
-    runs-on: [besu,Linux,self-hosted,X64]
+    runs-on: [besu,Linux,self-hosted,X64,nodocker]
     permissions:
       actions: read
       contents: read

.github/workflows/dco-merge-group.yml

@@ -4,7 +4,7 @@ on:
 
 jobs:
   dco:
-    runs-on: [besu,Linux,self-hosted]
+    runs-on: [besu,Linux,self-hosted,nodocker]
     if: ${{ github.actor != 'dependabot[bot]' }}
     steps:
       - run: echo "This DCO job runs on merge_queue event and doesn't check PR contents"

.github/workflows/dco.yml

@@ -5,7 +5,7 @@ on:
 
 jobs:
   dco:
-    runs-on: [besu,Linux,self-hosted]
+    runs-on: [besu,Linux,self-hosted,nodocker]
     if: ${{ github.actor != 'dependabot[bot]' }}
     steps:
       - run: echo "This DCO job runs on pull_request event and workflow_dispatch"

.github/workflows/gradle-wrapper-validation.yml

@@ -5,7 +5,7 @@ on: [push, pull_request]
 jobs:
   validation:
     name: "Gradle Wrapper Validation"
-    runs-on: [besu,Linux,self-hosted]
+    runs-on: [besu,Linux,self-hosted,nodocker]
     steps:
       - uses: actions/checkout@v2
       - uses: gradle/wrapper-validation-action@v1

.github/workflows/pr-checklist-on-open.yml

@@ -6,7 +6,7 @@ on:
 jobs:
   checklist:
     name: "add checklist as a comment on newly opened PRs"
-    runs-on: [besu,Linux,self-hosted]
+    runs-on: [besu,Linux,self-hosted,nodocker]
     steps:
       - uses: actions/github-script@v5
         with:

.github/workflows/release.yml

@@ -4,7 +4,7 @@ on:
     types: released
 jobs:
   dockerPromoteX64:
-    runs-on: [besu,Linux,self-hosted]
+    runs-on: [besu,Linux,self-hosted,nodocker]
     steps:
       - uses: actions/checkout@v3
       - uses: actions/setup-java@v3

.github/workflows/repolinter.yml

@@ -15,15 +15,10 @@ on:
 
 jobs:
   build:
-    runs-on: [besu,Linux,self-hosted,X64]
+    runs-on: [besu,Linux,self-hosted,X64,docker]
     container: ghcr.io/todogroup/repolinter:v0.10.1
     steps:
       - name: Checkout Code
         uses: actions/checkout@v2
       - name: Lint Repo
         run: bundle exec /app/bin/repolinter.js --rulesetUrl https://raw.githubusercontent.com/hyperledger-labs/hyperledger-community-management-tools/main/repo_structure/repolint.json --format markdown
-      - name: Cleanup file permissions created by docker user
-        run: |
-          USER_ID=$(id -u)
-          GROUP_ID=$(id -g)
-          chown -R "$USER_ID:$GROUP_ID" .