* feat: Update base image to Alpine 3.23.4
Alpine 3.23.4 fixes the following:
musl
CVE-2026-6042
CVE-2026-40200
openssl
CVE-2026-31790
CVE-2026-28387
CVE-2026-28388
CVE-2026-28389
CVE-2026-28390
CVE-2026-31789
* chore: Update supported versions in SECURITY.md
* chore: Update README for Alpine and version changes
* chore: Update copyright years in LICENSE file
Updated copyright years for Joshua Piper and Burnett01.
* chore(deps): bump alpine from 3.23.0 to 3.23.2
Bumps alpine from 3.23.0 to 3.23.2.
---
updated-dependencies:
- dependency-name: alpine
dependency-version: 3.23.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
* chore(docs): update Alpine version to 3.23.2 in README and SECURITY files
* chore(docs): update current version to 8.0.3 in README
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* fix: only attempt to create dir if not yet exists
On self-hosted runners it can happen that an action (docker container) is cached. This leads to the script trying to create the .ssh dir despite it already existing. The action then fails.
* fix: only attempt to create file if it doesn't exist yet
On self-hosted runners it can happen that an action (docker container) is cached, resulting in aborting this script because the know_hosts file already exists.
This if clause fixes it.
Setting permissions is intentionally outside the if clause because in all cases we want to reset perms.
* fix: reverting printf in favor of echo
Like in commit 2c22263 we are using echo again instead of printf because some runners can't function properly with it.
* chore: 8.0.2
* chore: readme changes
* feat: latest Alpine 3.23.0
* feat: latest Rsync 3.4.1-r1
* feat: integrate [rsync-docker](https://github.com/JoshPiper/rsync-docker/) 3rd party into this action as 1st party code (no more dependency, better audit, single source of truth)
- backported:
- agent-start
- agent-stop
- agent-askpass
- agent-add
- hosts-add
- hosts-clear
- new added:
- ssh-init
- hosts-init
- improved:
- stricter permissions on .ssh/ folder (700) and known_hosts (600)
- use set -eu in all scipts
* feat: new ``strict_host_keys`` option to enable support for strict host key verification. Default: false (to keep backward compatibility)
* feat: new ``debug`` option to see the commands executed (-x) by this action
* feat: this action is now scanned for vulnerabilities by Snyk
* feat; this action is now scanned by CodeQL for Q/A
* feat: this action now performs CI tasks such as Validation, Linting and Unit Tests
* fix: various shell syntax for robustness
* fix: use printf and redirect output to non-stdout instead of echo in sensitive code locations
* refactor: use $HOME instead of tilde ~ for robustness
* feat: cross-platform support
* chore: Deprecate 7.0.2
* chore: EOL 7.0.0 & 7.0.1
* chore: Add comprehensive SSH troubleshooting section to README
* chore: Enhance README with rsync documentation link, SSH key guide
* chore: further enrich readme with more troubleshooting + change secrets name from DEPLOY_* to REMOTE_*
* chore: Added a new section for versions and updated heading formatting.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Burnett01 <1208707+Burnett01@users.noreply.github.com>
Co-authored-by: sovetski
The latest rsync version 3.4.0 fixes a wide variety of CVE's:
CVE-2024-12084 - Heap Buffer Overflow in Checksum Parsing.
CVE-2024-12085 - Info Leak via uninitialized Stack contents defeats ASLR.
CVE-2024-12086 - Server leaks arbitrary client files.
CVE-2024-12087 - Server can make client write files outside of destination directory using symbolic links.
CVE-2024-12088 - --safe-links Bypass.
CVE-2024-12747 - symlink race condition.
See their press release: https://download.samba.org/pub/rsync/NEWS#3.4.0
The latest action version 7.0.2 is using rsync 3.4.0, so please use that.
- All versions 4.x are now EOL and no longer maintained
- All versions 5.x are now DEPRECATED and will become EOL within Q2 2024
- All versions 6.x are now MAINTENANCE and will become DEPRECATED within Q4 2024
- It is no longer possible to use an empty string as remote_path (Fixes#44) (Thanks to @maximilliangeorge)
- Updated checkout action in examples from v2 to v3
- Added disclaimer to media site-links
- Overall readme improvements
* update base image drinternet/rsync:v1.3.0
* Base Image updates: alpine 3.14.1 latest
* use v5.1 in examples
* support for v5.x
* mention Alpine version
Burnett01