8 Commits

Author SHA1 Message Date
Matthias Pigulla
29c4c5bfcc Update the CHANGELOG file 2022-10-19 10:34:44 +00:00
Matthias Pigulla
cf116fbe80 Merge remote-tracking branch 'origin/master' into camilo/log-public-key 2022-10-19 10:33:47 +00:00
Matthias Pigulla
3d2f9b9e54 Express logging flag in a "positive" way, not as "do not log" 2022-10-19 10:26:23 +00:00
Matthias Pigulla
b5b046356c Document action inputs in the README 2022-10-19 10:25:57 +00:00
Camilo Celis Guzman
370777e6ab build 2022-09-02 15:31:17 +09:00
Camilo Celis Guzman
f202749619 opt-out rather than opt-in 2022-09-02 15:30:25 +09:00
Camilo Celis Guzman
9683b6d018 default to true and remove need to monkeypatch getBoolean 2022-09-02 14:59:27 +09:00
Camilo Celis Guzman
79fe588704 don't log public key and add flag for it if needed 2022-09-02 14:39:57 +09:00
8 changed files with 58 additions and 91 deletions

View File

@@ -7,17 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
## [Unreleased]
## v0.7.0 [2022-10-19]
### Added
* Add the `log-public-key` input that can be used to turn off logging key identities (#122)
### Fixed
* Fix path to `git` binary on Windows, assuming GitHub-hosted runners (#136, #137)
* Fix a nonsensical log message (#139)
## v0.6.0 [2022-10-19]
### Changed
@@ -40,7 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
### Fixed
* Fixed cleanup phase to really terminate the ssh-agent (#80)
* Fix termination of ssh-agent also on workflow failure (#79)
* Fix termination of ssh-agent also on workflow faiulre (#79)
### Changed

View File

@@ -114,7 +114,7 @@ If you are using this action on container-based workflows, make sure the contain
If you are using the `docker/build-push-action`, and would like to pass the SSH key, you can do so by adding the following config to pass the socket file through:
```yml
```
- name: Build and push
id: docker_build
uses: docker/build-push-action@v2
@@ -123,36 +123,6 @@ If you are using the `docker/build-push-action`, and would like to pass the SSH
default=${{ env.SSH_AUTH_SOCK }}
```
### Using the `docker/build-push-action` Action together with multiple Deploy Keys
If you use the `docker/build-push-action` and want to use multiple GitHub deploy keys, you need to copy the git and ssh configuration to the container during the build. Otherwise, the Docker build process would still not know how to handle multiple deploy keys. Even if the ssh agent was set up correctly on the runner.
This requires an additional step in the actions workflow and two additional lines in the Dockerfile.
Workflow:
```yml
- name: Prepare git and ssh config for build context
run: |
mkdir root-config
cp -r ~/.gitconfig ~/.ssh root-config/
- name: Build and push
id: docker_build
uses: docker/build-push-action@v2
with:
ssh: |
default=${{ env.SSH_AUTH_SOCK }}
```
Dockerfile:
```Dockerfile
COPY root-config /root/
RUN sed 's|/home/runner|/root|g' -i.bak /root/.ssh/config
```
Have in mind that the Dockerfile now contains customized git and ssh configurations. If you don't want that in your final image, use multi-stage builds.
### Cargo's (Rust) Private Dependencies on Windows
If you are using private repositories in your dependencies like this:

View File

@@ -1,11 +1,11 @@
const core = require('@actions/core');
const { execFileSync } = require('child_process');
const { sshAgentCmd } = require('./paths.js');
const { sshAgent } = require('./paths.js');
try {
// Kill the started SSH agent
console.log('Stopping SSH agent');
execFileSync(sshAgentCmd, ['-k'], { stdio: 'inherit' });
execFileSync(sshAgent, ['-k'], { stdio: 'inherit' });
} catch (error) {
console.log(error.message);
console.log('Error stopping the SSH agent, proceeding anyway');

24
dist/cleanup.js vendored
View File

@@ -599,12 +599,12 @@ exports.debug = debug; // for test
const core = __webpack_require__(470);
const { execFileSync } = __webpack_require__(129);
const { sshAgentCmd } = __webpack_require__(972);
const { sshAgent } = __webpack_require__(972);
try {
// Kill the started SSH agent
console.log('Stopping SSH agent');
execFileSync(sshAgentCmd, ['-k'], { stdio: 'inherit' });
execFileSync(sshAgent, ['-k'], { stdio: 'inherit' });
} catch (error) {
console.log(error.message);
console.log('Error stopping the SSH agent, proceeding anyway');
@@ -2824,21 +2824,23 @@ exports.default = _default;
const os = __webpack_require__(87);
module.exports = (process.env['OS'] != 'Windows_NT') ? {
// Use getent() system call, since this is what ssh does; makes a difference in Docker-based
// Action runs, where $HOME is different from the pwent
homePath: os.userInfo().homedir,
sshAgentCmd: 'ssh-agent',
sshAddCmd: 'ssh-add',
gitCmd: 'git'
home: os.userInfo().homedir,
sshAgent: 'ssh-agent',
sshAdd: 'ssh-add'
} : {
// Assuming GitHub hosted `windows-*` runners for now
homePath: os.homedir(),
sshAgentCmd: 'c://progra~1//git//usr//bin//ssh-agent.exe',
sshAddCmd: 'c://progra~1//git//usr//bin//ssh-add.exe',
gitCmd: 'c://progra~1//git//bin//git.exe'
home: os.homedir(),
sshAgent: 'c://progra~1//git//usr//bin//ssh-agent.exe',
sshAdd: 'c://progra~1//git//usr//bin//ssh-add.exe'
};
/***/ })
/******/ });

38
dist/index.js vendored
View File

@@ -322,7 +322,7 @@ const core = __webpack_require__(470);
const child_process = __webpack_require__(129);
const fs = __webpack_require__(747);
const crypto = __webpack_require__(417);
const { homePath, sshAgentCmd, sshAddCmd, gitCmd } = __webpack_require__(972);
const { home, sshAgent, sshAdd } = __webpack_require__(972);
try {
const privateKey = core.getInput('ssh-private-key');
@@ -334,7 +334,7 @@ try {
return;
}
const homeSsh = homePath + '/.ssh';
const homeSsh = home + '/.ssh';
console.log(`Adding GitHub.com keys to ${homeSsh}/known_hosts`);
@@ -349,7 +349,7 @@ try {
const sshAgentArgs = (authSock && authSock.length > 0) ? ['-a', authSock] : [];
// Extract auth socket path and agent pid and set them as job variables
child_process.execFileSync(sshAgentCmd, sshAgentArgs).toString().split("\n").forEach(function(line) {
child_process.execFileSync(sshAgent, sshAgentArgs).toString().split("\n").forEach(function(line) {
const matches = /^(SSH_AUTH_SOCK|SSH_AGENT_PID)=(.*); export \1/.exec(line);
if (matches && matches.length > 0) {
@@ -362,16 +362,16 @@ try {
console.log("Adding private key(s) to agent");
privateKey.split(/(?=-----BEGIN)/).forEach(function(key) {
child_process.execFileSync(sshAddCmd, ['-'], { input: key.trim() + "\n" });
child_process.execFileSync(sshAdd, ['-'], { input: key.trim() + "\n" });
});
console.log("Key(s) added:");
child_process.execFileSync(sshAddCmd, ['-l'], { stdio: 'inherit' });
child_process.execFileSync(sshAdd, ['-l'], { stdio: 'inherit' });
console.log('Configuring deployment key(s)');
child_process.execFileSync(sshAddCmd, ['-L']).toString().trim().split(/\r?\n/).forEach(function(key) {
child_process.execFileSync(sshAdd, ['-L']).toString().split(/\r?\n/).forEach(function(key) {
const parts = key.match(/\bgithub\.com[:/]([_.a-z0-9-]+\/[_.a-z0-9-]+)/i);
if (!parts) {
@@ -386,9 +386,9 @@ try {
fs.writeFileSync(`${homeSsh}/key-${sha256}`, key + "\n", { mode: '600' });
child_process.execSync(`${gitCmd} config --global --replace-all url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "https://github.com/${ownerAndRepo}"`);
child_process.execSync(`${gitCmd} config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "git@github.com:${ownerAndRepo}"`);
child_process.execSync(`${gitCmd} config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "ssh://git@github.com/${ownerAndRepo}"`);
child_process.execSync(`git config --global --replace-all url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "https://github.com/${ownerAndRepo}"`);
child_process.execSync(`git config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "git@github.com:${ownerAndRepo}"`);
child_process.execSync(`git config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "ssh://git@github.com/${ownerAndRepo}"`);
const sshConfig = `\nHost key-${sha256}.github.com\n`
+ ` HostName github.com\n`
@@ -2903,21 +2903,23 @@ exports.default = _default;
const os = __webpack_require__(87);
module.exports = (process.env['OS'] != 'Windows_NT') ? {
// Use getent() system call, since this is what ssh does; makes a difference in Docker-based
// Action runs, where $HOME is different from the pwent
homePath: os.userInfo().homedir,
sshAgentCmd: 'ssh-agent',
sshAddCmd: 'ssh-add',
gitCmd: 'git'
home: os.userInfo().homedir,
sshAgent: 'ssh-agent',
sshAdd: 'ssh-add'
} : {
// Assuming GitHub hosted `windows-*` runners for now
homePath: os.homedir(),
sshAgentCmd: 'c://progra~1//git//usr//bin//ssh-agent.exe',
sshAddCmd: 'c://progra~1//git//usr//bin//ssh-add.exe',
gitCmd: 'c://progra~1//git//bin//git.exe'
home: os.homedir(),
sshAgent: 'c://progra~1//git//usr//bin//ssh-agent.exe',
sshAdd: 'c://progra~1//git//usr//bin//ssh-add.exe'
};
/***/ })
/******/ });

View File

@@ -2,7 +2,7 @@ const core = require('@actions/core');
const child_process = require('child_process');
const fs = require('fs');
const crypto = require('crypto');
const { homePath, sshAgentCmd, sshAddCmd, gitCmd } = require('./paths.js');
const { home, sshAgent, sshAdd } = require('./paths.js');
try {
const privateKey = core.getInput('ssh-private-key');
@@ -14,7 +14,7 @@ try {
return;
}
const homeSsh = homePath + '/.ssh';
const homeSsh = home + '/.ssh';
console.log(`Adding GitHub.com keys to ${homeSsh}/known_hosts`);
@@ -29,7 +29,7 @@ try {
const sshAgentArgs = (authSock && authSock.length > 0) ? ['-a', authSock] : [];
// Extract auth socket path and agent pid and set them as job variables
child_process.execFileSync(sshAgentCmd, sshAgentArgs).toString().split("\n").forEach(function(line) {
child_process.execFileSync(sshAgent, sshAgentArgs).toString().split("\n").forEach(function(line) {
const matches = /^(SSH_AUTH_SOCK|SSH_AGENT_PID)=(.*); export \1/.exec(line);
if (matches && matches.length > 0) {
@@ -42,16 +42,16 @@ try {
console.log("Adding private key(s) to agent");
privateKey.split(/(?=-----BEGIN)/).forEach(function(key) {
child_process.execFileSync(sshAddCmd, ['-'], { input: key.trim() + "\n" });
child_process.execFileSync(sshAdd, ['-'], { input: key.trim() + "\n" });
});
console.log("Key(s) added:");
child_process.execFileSync(sshAddCmd, ['-l'], { stdio: 'inherit' });
child_process.execFileSync(sshAdd, ['-l'], { stdio: 'inherit' });
console.log('Configuring deployment key(s)');
child_process.execFileSync(sshAddCmd, ['-L']).toString().trim().split(/\r?\n/).forEach(function(key) {
child_process.execFileSync(sshAdd, ['-L']).toString().split(/\r?\n/).forEach(function(key) {
const parts = key.match(/\bgithub\.com[:/]([_.a-z0-9-]+\/[_.a-z0-9-]+)/i);
if (!parts) {
@@ -66,9 +66,9 @@ try {
fs.writeFileSync(`${homeSsh}/key-${sha256}`, key + "\n", { mode: '600' });
child_process.execSync(`${gitCmd} config --global --replace-all url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "https://github.com/${ownerAndRepo}"`);
child_process.execSync(`${gitCmd} config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "git@github.com:${ownerAndRepo}"`);
child_process.execSync(`${gitCmd} config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "ssh://git@github.com/${ownerAndRepo}"`);
child_process.execSync(`git config --global --replace-all url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "https://github.com/${ownerAndRepo}"`);
child_process.execSync(`git config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "git@github.com:${ownerAndRepo}"`);
child_process.execSync(`git config --global --add url."git@key-${sha256}.github.com:${ownerAndRepo}".insteadOf "ssh://git@github.com/${ownerAndRepo}"`);
const sshConfig = `\nHost key-${sha256}.github.com\n`
+ ` HostName github.com\n`

View File

@@ -2,7 +2,7 @@
"name": "webfactory-action-ssh-agent",
"repository": "git@github.com:webfactory/ssh-agent.git",
"description": "GitHub Action to set up ssh-agent with a private SSH key",
"version": "0.7.0",
"version": "0.6.0",
"main": "index.js",
"author": "webfactory GmbH <info@webfactory.de>",
"license": "MIT",

View File

@@ -1,16 +1,18 @@
const os = require('os');
module.exports = (process.env['OS'] != 'Windows_NT') ? {
// Use getent() system call, since this is what ssh does; makes a difference in Docker-based
// Action runs, where $HOME is different from the pwent
homePath: os.userInfo().homedir,
sshAgentCmd: 'ssh-agent',
sshAddCmd: 'ssh-add',
gitCmd: 'git'
home: os.userInfo().homedir,
sshAgent: 'ssh-agent',
sshAdd: 'ssh-add'
} : {
// Assuming GitHub hosted `windows-*` runners for now
homePath: os.homedir(),
sshAgentCmd: 'c://progra~1//git//usr//bin//ssh-agent.exe',
sshAddCmd: 'c://progra~1//git//usr//bin//ssh-add.exe',
gitCmd: 'c://progra~1//git//bin//git.exe'
home: os.homedir(),
sshAgent: 'c://progra~1//git//usr//bin//ssh-agent.exe',
sshAdd: 'c://progra~1//git//usr//bin//ssh-add.exe'
};