[compiler-rt] [llvm] [CI] check libc freestanding in compiler-rt (PR #217972)

[via llvm-commits]

================
@@ -52,3 +52,62 @@
             --build build \
             --parallel \
             --target check-builtins
+
+  # Build the libc-backed builtins against only the extracted shared subset, so
+  # the build fails if they ever reach into the rest of libc.
+  isolation:
+    name: builtins isolation (subset-only build)
+    if: github.repository_owner == 'llvm'
+    runs-on: ubuntu-24.04
+    container:
+      image: ghcr.io/llvm/libc-ubuntu-24.04
----------------
github-advanced-security[bot] wrote:

## zizmor / 

unpinned image references: container image is unpinned

[Show more details](https://github.com/llvm/llvm-project/security/code-scanning/2314)

https://github.com/llvm/llvm-project/pull/217972