Skip to content

Commit 05a269a

Browse files
Burnett01Burnett01
authored
v8 - 8.0.0 (#88)
* feat: latest Alpine 3.23.0 * feat: latest Rsync 3.4.1-r1 * feat: integrate [rsync-docker](https://github.com/JoshPiper/rsync-docker/) 3rd party into this action as 1st party code (no more dependency, better audit, single source of truth) - backported: - agent-start - agent-stop - agent-askpass - agent-add - hosts-add - hosts-clear - new added: - ssh-init - hosts-init - improved: - stricter permissions on .ssh/ folder (700) and known_hosts (600) - use set -eu in all scipts * feat: new ``strict_host_keys`` option to enable support for strict host key verification. Default: false (to keep backward compatibility) * feat: new ``debug`` option to see the commands executed (-x) by this action * feat: this action is now scanned for vulnerabilities by Snyk * feat; this action is now scanned by CodeQL for Q/A * feat: this action now performs CI tasks such as Validation, Linting and Unit Tests * fix: various shell syntax for robustness * fix: use printf and redirect output to non-stdout instead of echo in sensitive code locations * refactor: use $HOME instead of tilde ~ for robustness * feat: cross-platform support * chore: Deprecate 7.0.2 * chore: EOL 7.0.0 & 7.0.1
1 parent 92961b5 commit 05a269a

File tree

17 files changed

+302
-57
lines changed

17 files changed

+302
-57
lines changed

‎.dockerignore‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
Dockerfile
2+
LICENSE
3+
*.md
4+
.git*
5+
.github*

‎.editorconfig‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = lf
6+
tab_width = 4
7+
indent_size = 4
8+
indent_style = space
9+
max_line_length = 9999
10+
insert_final_newline = true
11+
trim_trailing_whitespace = true
12+
13+
[*.{yml,yaml}]
14+
tab_width = 2
15+
indent_size = 2

‎Dockerfile‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,14 @@
1-
# drinternet/rsync@v1.5.1
2-
FROM drinternet/rsync@sha256:e61f4047577b566872764fa39299092adeab691efb3884248dbd6495dc926527
1+
FROM alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375 AS base
2+
3+
RUN apk update && apk add --no-cache --upgrade rsync openssh openssl busybox
34

4-
# always force-upgrade rsync to get the latest security fixes
5-
RUN apk update && apk add --no-cache --upgrade rsync openssl
65
RUN rm -rf /var/cache/apk/*
76

8-
# Copy entrypoint
7+
COPY docker-rsync/* /bin/
8+
RUN chmod +x /bin/agent-*
9+
10+
FROM base AS build
11+
912
COPY entrypoint.sh /entrypoint.sh
1013
RUN chmod +x /entrypoint.sh
1114

‎LICENSE‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
MIT License
22

33
Copyright (c) 2019-2022 Contention
4+
Copyright (c) 2019-2025 Joshua Piper (Dr Internet)
45
Copyright (c) 2019-2025 Burnett01
56

67
Permission is hereby granted, free of charge, to any person obtaining a copy

‎README.md‎

Lines changed: 42 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,28 @@
66
[![Dependabot Updates](https://github.com/Burnett01/rsync-deployments/actions/workflows/dependabot/dependabot-updates/badge.svg)](https://github.com/Burnett01/rsync-deployments/actions/workflows/dependabot/dependabot-updates)
77

88

9-
This GitHub Action (amd64) deploys files in `GITHUB_WORKSPACE` to a remote folder via rsync over ssh.
9+
This cross-platform GitHub Action deploys files in [`path`](#inputs) (relative to `GITHUB_WORKSPACE`) to a remote folder via rsync over ssh.
1010

11-
Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`.
11+
Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`, such [actions/checkout](https://github.com/actions/checkout).
1212

13-
The base-image [drinternet/rsync](https://github.com/JoshPiper/rsync-docker/) of this action is very small and is based on Alpine 3.22.1 (no cache) which results in fast deployments.
13+
The base-image of this action is very small and based on **Alpine 3.23.0** (no cache) which results in fast deployments.
1414

15-
Alpine version: [3.22.1](https://alpinelinux.org/posts/Alpine-3.19.8-3.20.7-3.21.4-3.22.1-released.html)
16-
Rsync version: [3.4.1-r0](https://download.samba.org/pub/rsync/NEWS#3.4.1)
15+
Alpine version: [3.23.0](https://www.alpinelinux.org/posts/Alpine-3.23.0-released.html)
16+
Rsync version: [3.4.1-r1](https://download.samba.org/pub/rsync/NEWS#3.4.1)
1717

1818
---
1919

2020
## Inputs
2121

22+
- `debug`* - Whether to enable debug output. ("true" / "false") - Default: "false"
23+
2224
- `switches`* - The first is for any initial/required rsync flags, eg: `-avzr --delete`
2325

2426
- `rsh` - Remote shell commands
2527

26-
- `legacy_allow_rsa_hostkeys` - Enables support for legacy RSA host keys on OpenSSH 8.8+. ("true" / "false")
28+
- `strict_hostkeys_checking` - Enables support for strict hostkeys (fingerprint) checking. ("true" / "false") - Default: "false"
29+
30+
- `legacy_allow_rsa_hostkeys` - Enables support for legacy RSA host keys on OpenSSH 8.8+. ("true" / "false") - Default: "false"
2731

2832
- `path` - The source path. Defaults to GITHUB_WORKSPACE and is relative to it
2933

@@ -49,7 +53,17 @@ This action needs secret variables for the ssh private key of your key pair. The
4953
5054
For simplicity, we are using `REMOTE_*` as the secret variables throughout the examples.
5155

52-
## Current Version: 7.1.0
56+
## Current Version: v8 (8.0.0)
57+
58+
### Release channels:
59+
60+
| Version | Purpose | Immutable |
61+
| ------- | ------------------ | ------------------ |
62+
| ``v8`` | latest release (pointer to 8.x.x) | no, points to latest MINOR,PATCH |
63+
| 8.0.0 | latest major release | yes |
64+
| 7.1.0 | previous release | yes |
65+
66+
Check [SECURITY.md](SECURITY.md) for support cycles.
5367

5468
## Example usage
5569

@@ -66,9 +80,9 @@ jobs:
6680
deploy:
6781
runs-on: ubuntu-latest
6882
steps:
69-
- uses: actions/checkout@v3
83+
- uses: actions/checkout@v6
7084
- name: rsync deployments
71-
uses: burnett01/rsync-deployments@7.1.0
85+
uses: burnett01/rsync-deployments@v8
7286
with:
7387
switches: -avzr --delete
7488
path: src/
@@ -85,9 +99,9 @@ jobs:
8599
deploy:
86100
runs-on: ubuntu-latest
87101
steps:
88-
- uses: actions/checkout@v3
102+
- uses: actions/checkout@v6
89103
- name: rsync deployments
90-
uses: burnett01/rsync-deployments@7.1.0
104+
uses: burnett01/rsync-deployments@v8
91105
with:
92106
switches: -avzr --delete --exclude="" --include="" --filter=""
93107
path: src/
@@ -105,9 +119,9 @@ jobs:
105119
deploy:
106120
runs-on: ubuntu-latest
107121
steps:
108-
- uses: actions/checkout@v3
122+
- uses: actions/checkout@v6
109123
- name: rsync deployments
110-
uses: burnett01/rsync-deployments@7.1.0
124+
uses: burnett01/rsync-deployments@v8
111125
with:
112126
switches: -avzr --delete
113127
path: src/
@@ -125,9 +139,9 @@ jobs:
125139
deploy:
126140
runs-on: ubuntu-latest
127141
steps:
128-
- uses: actions/checkout@v3
142+
- uses: actions/checkout@v6
129143
- name: rsync deployments
130-
uses: burnett01/rsync-deployments@7.1.0
144+
uses: burnett01/rsync-deployments@v8
131145
with:
132146
switches: -avzr --delete
133147
path: src/
@@ -151,9 +165,9 @@ jobs:
151165
deploy:
152166
runs-on: ubuntu-latest
153167
steps:
154-
- uses: actions/checkout@v3
168+
- uses: actions/checkout@v6
155169
- name: rsync deployments
156-
uses: burnett01/rsync-deployments@7.1.0
170+
uses: burnett01/rsync-deployments@v8
157171
with:
158172
switches: -avzr --delete
159173
legacy_allow_rsa_hostkeys: "true"
@@ -263,20 +277,27 @@ sudo apk add rsync
263277

264278
## Versions
265279

266-
## Version 7.0.2
280+
## Version 7.1.0
281+
282+
Check here:
283+
284+
- https://github.com/Burnett01/rsync-deployments/tree/7.1.0 (alpine 3.22.1)
285+
286+
287+
## Version 7.0.2 (DEPRECATED)
267288

268289
Check here:
269290

270-
- https://github.com/Burnett01/rsync-deployments/tree/7.0.2 (alpine 3.19.1)
291+
- https://github.com/Burnett01/rsync-deployments/tree/7.0.2 (alpine 3.22.1)
271292

272293
---
273294

274-
## Version 7.0.0 & 7.0.1 (DEPRECATED)
295+
## Version 7.0.0 & 7.0.1 (EOL)
275296

276297
Check here:
277298

278299
- https://github.com/Burnett01/rsync-deployments/tree/7.0.0 (alpine 3.19.1)
279-
- https://github.com/Burnett01/rsync-deployments/tree/7.0.1 (alpine 3.19.1)
300+
- https://github.com/Burnett01/rsync-deployments/tree/7.0.1 (alpine 3.22.1)
280301

281302
---
282303

‎SECURITY.md‎

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,30 @@
11
# Security Policy
22

3+
The Docker image and code quality are regularly checked for vulnerabilities and CVEs by Snyk and CodeQL.
4+
35
## Supported Versions
46

57
The following versions are currently being supported with security updates:
68

7-
| Version | Supported | Rsync version |
8-
| ------- | ------------------ | ------------------ |
9-
| 7.1.0 | :white_check_mark: | >= 3.4.1 |
10-
| 7.0.2 | :white_check_mark: | >= 3.4.0 |
11-
| 7.0.1 | :warning: DEPRECATED | < 3.4.0 |
12-
| 7.0.0 | :warning: DEPRECATED | < 3.4.0|
13-
| 6.x | :x: EOL |< 3.4.0|
14-
| 5.x | :x: EOL |< 3.4.0|
15-
| 4.x | :x: EOL |< 3.4.0|
16-
| 3.0 | :x: EOL |< 3.4.0|
17-
| 2.0 | :x: EOL |< 3.4.0|
18-
| 1.0 | :x: EOL |< 3.4.0|
9+
| Version | Supported | Rsync version | Alpine version |
10+
| ------- | ------------------ | ------------------ | ------------------ |
11+
| 8.0.0 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
12+
| 7.1.0 | :white_check_mark: | >= 3.4.1-r0 | 3.22.1 |
13+
| 7.0.2 | :warning: DEPRECATED | >= 3.4.0-r0 | 3.22.1 |
14+
| 7.0.1 | :x: EOL | < 3.4.0 | 3.22.1 |
15+
| 7.0.0 | :x: EOL | < 3.4.0| 3.19.1 |
16+
| 6.x | :x: EOL |< 3.4.0| 3.17.2 |
17+
| 5.x | :x: EOL |< 3.4.0| 3.11 - 3.14.1 - 3.15 - 3.16 - 3.17.2 |
18+
| 4.x | :x: EOL |< 3.4.0| 3.11 |
19+
| 3.0 | :x: EOL |< 3.4.0| N/A |
20+
| 2.0 | :x: EOL |< 3.4.0| Ubuntu |
21+
| 1.0 | :x: EOL |< 3.4.0| Ubuntu |
22+
23+
### Terminology
24+
25+
EOL = End of life (no support/no updates)
26+
27+
DEPRECATED = Close to EOL (support/no updates)
1928

2029
## Reporting a Vulnerability
2130

‎action.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,10 @@ inputs:
1313
description: 'Enables support for legacy RSA host keys on OpenSSH 8.8+'
1414
required: false
1515
default: 'false'
16+
strict_hostkeys_checking:
17+
description: 'Controls strict host keys checking'
18+
required: false
19+
default: 'false'
1620
path:
1721
description: 'The local path'
1822
required: false
@@ -37,6 +41,10 @@ inputs:
3741
description: 'The remote key passphrase'
3842
required: false
3943
default: ''
44+
debug:
45+
description: 'Debug the action'
46+
required: false
47+
default: 'false'
4048
runs:
4149
using: 'docker'
4250
image: 'Dockerfile'

‎docker-rsync/agent-add‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
source agent-start "${1:-default}"
6+
cat - | tr -d '\r' | DISPLAY=1 SSH_ASKPASS=agent-askpass ssh-add - >/dev/null

‎docker-rsync/agent-askpass‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
echo "$SSH_PASS"

‎docker-rsync/agent-start‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/bin/sh
2+
3+
set -eu
4+
5+
FOLDER=${1:-default}
6+
STORE_PATH="/tmp/ssh-agent/$FOLDER"
7+
mkdir -p "$STORE_PATH"
8+
9+
if [ -z "${SSH_AGENT_PID:-}" ]; then
10+
if [ -f "$STORE_PATH/id" ]; then
11+
SSH_AGENT_PID=$(cat "$STORE_PATH/id")
12+
export SSH_AGENT_PID
13+
14+
SSH_AUTH_SOCK=$(cat "$STORE_PATH/sock")
15+
export SSH_AUTH_SOCK
16+
else
17+
eval "$(ssh-agent)" > /dev/null
18+
echo "$SSH_AGENT_PID" > "$STORE_PATH"/id
19+
echo "$SSH_AUTH_SOCK" > "$STORE_PATH"/sock
20+
fi
21+
fi

0 commit comments

Comments
 (0)