mirror of
https://github.com/Burnett01/rsync-deployments.git
synced 2026-09-20 21:55:23 +08:00
Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Steven
|
fcf16a05b8 |
@@ -1,5 +0,0 @@
|
||||
Dockerfile
|
||||
LICENSE
|
||||
*.md
|
||||
.git*
|
||||
.github*
|
||||
@@ -1,15 +0,0 @@
|
||||
root = true
|
||||
|
||||
[*]
|
||||
charset = utf-8
|
||||
end_of_line = lf
|
||||
tab_width = 4
|
||||
indent_size = 4
|
||||
indent_style = space
|
||||
max_line_length = 9999
|
||||
insert_final_newline = true
|
||||
trim_trailing_whitespace = true
|
||||
|
||||
[*.{yml,yaml}]
|
||||
tab_width = 2
|
||||
indent_size = 2
|
||||
@@ -1,33 +0,0 @@
|
||||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: ''
|
||||
labels: ''
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
**Action version**
|
||||
eg. 7.0.1
|
||||
|
||||
**Runner OS+Version**
|
||||
eg. ubuntu-latest
|
||||
|
||||
**Describe the bug**
|
||||
A clear and concise description of what the bug is.
|
||||
|
||||
**To Reproduce**
|
||||
Steps to reproduce the behavior:
|
||||
1. Go to '...'
|
||||
2. Click on '....'
|
||||
3. Scroll down to '....'
|
||||
4. See error
|
||||
|
||||
**Expected behavior**
|
||||
A clear and concise description of what you expected to happen.
|
||||
|
||||
**Screenshots**
|
||||
If applicable, add screenshots to help explain your problem.
|
||||
|
||||
**Additional context**
|
||||
Add any other context about the problem here.
|
||||
@@ -1,165 +0,0 @@
|
||||
# GitHub Actions CI workflow for rsync-deployments
|
||||
# This workflow validates the action on every push and pull request by:
|
||||
# - Running BATS tests for the entrypoint script
|
||||
# - Validating the action.yml definition
|
||||
# - Building and testing the Docker image
|
||||
# - Checking file structure and permissions
|
||||
# - Linting shell scripts
|
||||
# - Running a final integration check
|
||||
|
||||
name: CI - Validating, Linting, Testing
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ master ]
|
||||
pull_request:
|
||||
branches: [ master ]
|
||||
|
||||
jobs:
|
||||
test:
|
||||
runs-on: ubuntu-latest
|
||||
name: Test BATS Suite
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install BATS
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y bats
|
||||
|
||||
- name: Run BATS tests
|
||||
run: bats test/entrypoint.bats
|
||||
|
||||
validate-action:
|
||||
runs-on: ubuntu-latest
|
||||
name: Validate Action Definition
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Validate action.yml
|
||||
run: |
|
||||
# Check if action.yml exists and has required fields
|
||||
if [ ! -f "action.yml" ]; then
|
||||
echo "Error: action.yml not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Basic validation that action.yml contains required fields
|
||||
python3 -c "
|
||||
import yaml
|
||||
import sys
|
||||
|
||||
with open('action.yml', 'r') as f:
|
||||
action = yaml.safe_load(f)
|
||||
|
||||
required_fields = ['name', 'description', 'inputs', 'runs']
|
||||
for field in required_fields:
|
||||
if field not in action:
|
||||
print(f'Missing required field: {field}')
|
||||
sys.exit(1)
|
||||
|
||||
# Check required inputs exist
|
||||
required_inputs = ['switches', 'remote_path', 'remote_host', 'remote_user', 'remote_key']
|
||||
for input_name in required_inputs:
|
||||
if input_name not in action['inputs']:
|
||||
print(f'Missing required input: {input_name}')
|
||||
sys.exit(1)
|
||||
if not action['inputs'][input_name].get('required', False):
|
||||
print(f'Input {input_name} should be marked as required')
|
||||
sys.exit(1)
|
||||
|
||||
print('Action definition is valid')
|
||||
"
|
||||
|
||||
docker-build:
|
||||
runs-on: ubuntu-latest
|
||||
name: Build Docker Image
|
||||
needs: [validate-action, action-structure]
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Build Docker image
|
||||
run: |
|
||||
echo "Building Docker image..."
|
||||
docker build -t rsync-deployments . --no-cache
|
||||
echo "Docker image built successfully"
|
||||
|
||||
action-structure:
|
||||
runs-on: ubuntu-latest
|
||||
name: Validate Action Structure
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Check required files
|
||||
run: |
|
||||
echo "Checking required files exist..."
|
||||
|
||||
# Check all required files exist
|
||||
required_files=("action.yml" "Dockerfile" "entrypoint.sh")
|
||||
for file in "${required_files[@]}"; do
|
||||
if [ ! -f "$file" ]; then
|
||||
echo "Error: Required file $file not found"
|
||||
exit 1
|
||||
fi
|
||||
echo "✓ $file exists"
|
||||
done
|
||||
|
||||
# Check entrypoint is executable
|
||||
if [ ! -x "entrypoint.sh" ]; then
|
||||
echo "Error: entrypoint.sh is not executable"
|
||||
exit 1
|
||||
fi
|
||||
echo "✓ entrypoint.sh is executable"
|
||||
|
||||
# Check basic script syntax
|
||||
bash -n entrypoint.sh
|
||||
echo "✓ entrypoint.sh has valid syntax"
|
||||
|
||||
echo "All structure checks passed!"
|
||||
|
||||
lint-shell:
|
||||
runs-on: ubuntu-latest
|
||||
name: Lint Shell Scripts
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install ShellCheck
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y shellcheck
|
||||
|
||||
- name: Lint entrypoint.sh
|
||||
run: |
|
||||
echo "Linting shell scripts..."
|
||||
# Run shellcheck with exclusions for Docker-specific dependencies
|
||||
shellcheck -e SC1091 -e SC3046 entrypoint.sh || {
|
||||
echo "ShellCheck found issues, but running with Docker-specific exclusions..."
|
||||
shellcheck -e SC1091 -e SC3046 entrypoint.sh
|
||||
}
|
||||
echo "Shell script linting completed"
|
||||
|
||||
integration-check:
|
||||
runs-on: ubuntu-latest
|
||||
name: Integration Check
|
||||
needs: [test, validate-action, docker-build, action-structure, lint-shell]
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Final integration check
|
||||
run: |
|
||||
echo "All CI jobs completed successfully!"
|
||||
echo "✅ BATS tests passed"
|
||||
echo "✅ Action definition validated"
|
||||
echo "✅ Docker image built and tested"
|
||||
echo "✅ File structure validated"
|
||||
echo "✅ Shell scripts linted"
|
||||
echo ""
|
||||
echo "🎉 rsync-deployments action is ready for use!"
|
||||
@@ -1,41 +0,0 @@
|
||||
name: Snyk Docker Vulnerability Scan
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [ "master" ]
|
||||
pull_request:
|
||||
branches: [ "master" ]
|
||||
schedule:
|
||||
- cron: '39 13 * * 4'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
snyk:
|
||||
permissions:
|
||||
contents: read
|
||||
security-events: write
|
||||
actions: read
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Build a Docker image
|
||||
run: docker build -t burnett01/rsync-deployments .
|
||||
- name: Run Snyk to check Docker image for vulnerabilities
|
||||
continue-on-error: true
|
||||
uses: snyk/actions/docker@master
|
||||
env:
|
||||
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
||||
with:
|
||||
image: burnett01/rsync-deployments
|
||||
args: --file=Dockerfile
|
||||
- name: Output sarif file
|
||||
run: cat snyk.sarif
|
||||
- name: fix security-severity "null" to "0" for valid sarif format
|
||||
run: |
|
||||
sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
|
||||
- name: Upload result to GitHub Code Scanning
|
||||
uses: github/codeql-action/upload-sarif@v4
|
||||
with:
|
||||
sarif_file: snyk.sarif
|
||||
+5
-8
@@ -1,14 +1,11 @@
|
||||
FROM alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375 AS base
|
||||
|
||||
RUN apk update && apk add --no-cache --upgrade rsync openssh openssl busybox
|
||||
# drinternet/rsync@v1.4.4
|
||||
FROM drinternet/rsync@sha256:15b2949838074bd93c49421c22380396a0cd53a322439e799ac87afcadcfe234
|
||||
|
||||
# always force-upgrade rsync to get the latest security fixes
|
||||
RUN apk update && apk add --no-cache --upgrade rsync
|
||||
RUN rm -rf /var/cache/apk/*
|
||||
|
||||
COPY docker-rsync/* /bin/
|
||||
RUN chmod +x /bin/agent-*
|
||||
|
||||
FROM base AS build
|
||||
|
||||
# Copy entrypoint
|
||||
COPY entrypoint.sh /entrypoint.sh
|
||||
RUN chmod +x /entrypoint.sh
|
||||
|
||||
|
||||
@@ -1,8 +1,7 @@
|
||||
MIT License
|
||||
|
||||
Copyright (c) 2019-2022 Contention
|
||||
Copyright (c) 2019-2025 Joshua Piper (Dr Internet)
|
||||
Copyright (c) 2019-2025 Burnett01
|
||||
Copyright (c) 2019-2024 Burnett01
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
|
||||
@@ -1,33 +1,23 @@
|
||||
# rsync deployments
|
||||
|
||||
[](https://github.com/Burnett01/rsync-deployments/actions/workflows/ci-validating-linting-testing.yml)
|
||||
[](https://github.com/Burnett01/rsync-deployments/actions/workflows/snyk-docker-vulnerability-scan.yml)
|
||||
[](https://github.com/Burnett01/rsync-deployments/actions/workflows/github-code-scanning/codeql)
|
||||
[](https://github.com/Burnett01/rsync-deployments/actions/workflows/dependabot/dependabot-updates)
|
||||
This GitHub Action (amd64) deploys files in `GITHUB_WORKSPACE` to a remote folder via rsync over ssh.
|
||||
|
||||
Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`.
|
||||
|
||||
This cross-platform GitHub Action deploys files in [`path`](#inputs) (relative to `GITHUB_WORKSPACE`) to a remote folder via rsync over ssh.
|
||||
The base-image [drinternet/rsync](https://github.com/JoshPiper/rsync-docker/) of this action is very small and is based on Alpine 3.19.1 (no cache) which results in fast deployments.
|
||||
|
||||
Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`, such [actions/checkout](https://github.com/actions/checkout).
|
||||
|
||||
The base-image of this action is very small and based on **Alpine 3.23.0** (no cache) which results in fast deployments.
|
||||
|
||||
Alpine version: [3.23.0](https://www.alpinelinux.org/posts/Alpine-3.23.0-released.html)
|
||||
Rsync version: [3.4.1-r1](https://download.samba.org/pub/rsync/NEWS#3.4.1)
|
||||
Alpine version: [3.19.1](https://alpinelinux.org/posts/Alpine-3.19.1-released.html)
|
||||
Rsync version: [3.4.0-r0](https://download.samba.org/pub/rsync/NEWS#3.4.0)
|
||||
|
||||
---
|
||||
|
||||
## Inputs
|
||||
|
||||
- `debug`* - Whether to enable debug output. ("true" / "false") - Default: "false"
|
||||
|
||||
- `switches`* - The first is for any initial/required rsync flags, eg: `-avzr --delete`
|
||||
|
||||
- `rsh` - Remote shell commands
|
||||
|
||||
- `strict_hostkeys_checking` - Enables support for strict hostkeys (fingerprint) checking. ("true" / "false") - Default: "false"
|
||||
|
||||
- `legacy_allow_rsa_hostkeys` - Enables support for legacy RSA host keys on OpenSSH 8.8+. ("true" / "false") - Default: "false"
|
||||
- `legacy_allow_rsa_hostkeys` - Enables support for legacy RSA host keys on OpenSSH 8.8+. ("true" / "false")
|
||||
|
||||
- `path` - The source path. Defaults to GITHUB_WORKSPACE and is relative to it
|
||||
|
||||
@@ -39,9 +29,9 @@ Rsync version: [3.4.1-r1](https://download.samba.org/pub/rsync/NEWS#3.4.1)
|
||||
|
||||
- `remote_user`* - The remote user
|
||||
|
||||
- `remote_key`* - The remote ssh private key
|
||||
- `remote_key`* - The remote ssh key
|
||||
|
||||
- `remote_key_pass` - The remote ssh private key passphrase (if any)
|
||||
- `remote_key_pass` - The remote ssh key passphrase (if any)
|
||||
|
||||
``* = Required``
|
||||
|
||||
@@ -51,19 +41,9 @@ This action needs secret variables for the ssh private key of your key pair. The
|
||||
|
||||
> Always use secrets when dealing with sensitive inputs!
|
||||
|
||||
For simplicity, we are using `REMOTE_*` as the secret variables throughout the examples.
|
||||
For simplicity, we are using `DEPLOY_*` as the secret variables throughout the examples.
|
||||
|
||||
## Current Version: v8 (8.0.0)
|
||||
|
||||
### Release channels:
|
||||
|
||||
| Version | Purpose | Immutable |
|
||||
| ------- | ------------------ | ------------------ |
|
||||
| ``v8`` | latest release (pointer to 8.x.x) | no, points to latest MINOR,PATCH |
|
||||
| 8.0.0 | latest major release | yes |
|
||||
| 7.1.0 | previous release | yes |
|
||||
|
||||
Check [SECURITY.md](SECURITY.md) for support cycles.
|
||||
## Current Version: 7.0.2
|
||||
|
||||
## Example usage
|
||||
|
||||
@@ -80,16 +60,16 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v3
|
||||
- name: rsync deployments
|
||||
uses: burnett01/rsync-deployments@v8
|
||||
uses: burnett01/rsync-deployments@7.0.2
|
||||
with:
|
||||
switches: -avzr --delete
|
||||
path: src/
|
||||
remote_path: /var/www/html/
|
||||
remote_host: example.com
|
||||
remote_user: debian
|
||||
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
|
||||
remote_key: ${{ secrets.DEPLOY_KEY }}
|
||||
```
|
||||
|
||||
Advanced:
|
||||
@@ -99,9 +79,9 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v3
|
||||
- name: rsync deployments
|
||||
uses: burnett01/rsync-deployments@v8
|
||||
uses: burnett01/rsync-deployments@7.0.2
|
||||
with:
|
||||
switches: -avzr --delete --exclude="" --include="" --filter=""
|
||||
path: src/
|
||||
@@ -109,7 +89,7 @@ jobs:
|
||||
remote_host: example.com
|
||||
remote_port: 5555
|
||||
remote_user: debian
|
||||
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
|
||||
remote_key: ${{ secrets.DEPLOY_KEY }}
|
||||
```
|
||||
|
||||
For better **security**, I suggest you create additional secrets for remote_host, remote_port, remote_user and remote_path inputs.
|
||||
@@ -119,17 +99,17 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v3
|
||||
- name: rsync deployments
|
||||
uses: burnett01/rsync-deployments@v8
|
||||
uses: burnett01/rsync-deployments@7.0.2
|
||||
with:
|
||||
switches: -avzr --delete
|
||||
path: src/
|
||||
remote_path: ${{ secrets.REMOTE_PATH }}
|
||||
remote_host: ${{ secrets.REMOTE_HOST }}
|
||||
remote_port: ${{ secrets.REMOTE_PORT }}
|
||||
remote_user: ${{ secrets.REMOTE_USER }}
|
||||
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
|
||||
remote_path: ${{ secrets.DEPLOY_PATH }}
|
||||
remote_host: ${{ secrets.DEPLOY_HOST }}
|
||||
remote_port: ${{ secrets.DEPLOY_PORT }}
|
||||
remote_user: ${{ secrets.DEPLOY_USER }}
|
||||
remote_key: ${{ secrets.DEPLOY_KEY }}
|
||||
```
|
||||
|
||||
If your private key is passphrase protected you should use:
|
||||
@@ -139,18 +119,18 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v3
|
||||
- name: rsync deployments
|
||||
uses: burnett01/rsync-deployments@v8
|
||||
uses: burnett01/rsync-deployments@7.0.2
|
||||
with:
|
||||
switches: -avzr --delete
|
||||
path: src/
|
||||
remote_path: ${{ secrets.REMOTE_PATH }}
|
||||
remote_host: ${{ secrets.REMOTE_HOST }}
|
||||
remote_port: ${{ secrets.REMOTE_PORT }}
|
||||
remote_user: ${{ secrets.REMOTE_USER }}
|
||||
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
|
||||
remote_key_pass: ${{ secrets.REMOTE_PRIVATE_KEY_PASS }}
|
||||
remote_path: ${{ secrets.DEPLOY_PATH }}
|
||||
remote_host: ${{ secrets.DEPLOY_HOST }}
|
||||
remote_port: ${{ secrets.DEPLOY_PORT }}
|
||||
remote_user: ${{ secrets.DEPLOY_USER }}
|
||||
remote_key: ${{ secrets.DEPLOY_KEY }}
|
||||
remote_key_pass: ${{ secrets.DEPLOY_KEY_PASS }}
|
||||
```
|
||||
|
||||
---
|
||||
@@ -165,139 +145,30 @@ jobs:
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v6
|
||||
- uses: actions/checkout@v3
|
||||
- name: rsync deployments
|
||||
uses: burnett01/rsync-deployments@v8
|
||||
uses: burnett01/rsync-deployments@7.0.2
|
||||
with:
|
||||
switches: -avzr --delete
|
||||
legacy_allow_rsa_hostkeys: "true"
|
||||
path: src/
|
||||
remote_path: ${{ secrets.REMOTE_PATH }}
|
||||
remote_host: ${{ secrets.REMOTE_HOST }}
|
||||
remote_port: ${{ secrets.REMOTE_PORT }}
|
||||
remote_user: ${{ secrets.REMOTE_USER }}
|
||||
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
|
||||
remote_path: ${{ secrets.DEPLOY_PATH }}
|
||||
remote_host: ${{ secrets.DEPLOY_HOST }}
|
||||
remote_port: ${{ secrets.DEPLOY_PORT }}
|
||||
remote_user: ${{ secrets.DEPLOY_USER }}
|
||||
remote_key: ${{ secrets.DEPLOY_KEY }}
|
||||
```
|
||||
|
||||
See [#49](https://github.com/Burnett01/rsync-deployments/issues/49) and [#24](https://github.com/Burnett01/rsync-deployments/issues/24) for more information.
|
||||
|
||||
**Note:** Only use this if necessary. It's recommended to upgrade your remote OpenSSH server instead.
|
||||
|
||||
--
|
||||
|
||||
## Advanced Rsync switches/flags/options
|
||||
|
||||
For advanced rsync configuration options and switches, refer to the [rsync manual](https://linux.die.net/man/1/rsync).
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### SSH Permission Denied Errors
|
||||
|
||||
If you encounter "Permission denied (publickey,password)" errors, here are the most common solutions:
|
||||
|
||||
#### 1. SSH Key Setup
|
||||
|
||||
Ensure your SSH key pair is correctly generated and configured:
|
||||
|
||||
```bash
|
||||
# Generate a new SSH key pair (recommended: Ed25519 or RSA 4096-bit)
|
||||
ssh-keygen -t ed25519 -C "deploy@yourproject" -f ~/.ssh/deploy_yourproject -N ""
|
||||
# OR for RSA:
|
||||
ssh-keygen -t rsa -b 4096 -C "deploy@yourproject" -f ~/.ssh/deploy_yourproject -N ""
|
||||
```
|
||||
|
||||
**Important Steps:**
|
||||
- Add the **public key** (`.pub` file) to your server's `~/.ssh/authorized_keys`
|
||||
- Add the **private key** (without `.pub` extension) to GitHub Secrets as `REMOTE_PRIVATE_KEY`
|
||||
- Ensure correct file permissions on your server:
|
||||
```bash
|
||||
chmod 700 ~/.ssh
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
```
|
||||
|
||||
For detailed information on creating and managing SSH keys, see [GitHub's SSH Key Guide](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
|
||||
|
||||
#### 2. ``remote_path`` permissions
|
||||
|
||||
Make sure the ``remote_user`` has write access to ``remote_path``.
|
||||
|
||||
See: https://github.com/Burnett01/rsync-deployments/issues/81#issuecomment-3308152891
|
||||
|
||||
#### 3. Firewall / GitHub Actions IP Restrictions
|
||||
|
||||
If your remote server has firewall restrictions:
|
||||
|
||||
- **Option A:** Whitelist [GitHub Actions IP ranges](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#ip-addresses) (Azure-based)
|
||||
- **Option B:** Use self-hosted runners on your server (recommended for strict firewall environments)
|
||||
|
||||
### Excluding files/folders (eg .git)
|
||||
|
||||
By default, rsync copies dot files and folder if present at ``path:``. To exclude them, you can use the ``--exclude`` switch:
|
||||
|
||||
```yml
|
||||
switches: -avzr --delete --exclude='.git/'
|
||||
```
|
||||
|
||||
Other common exclusions:
|
||||
```yml
|
||||
switches: -avzr --delete --exclude='.git/' --exclude='node_modules/' --exclude='.env'
|
||||
```
|
||||
|
||||
More advanced examples:
|
||||
|
||||
- https://github.com/Burnett01/rsync-deployments/issues/5#issuecomment-667589874
|
||||
- https://github.com/Burnett01/rsync-deployments/issues/16
|
||||
- https://github.com/Burnett01/rsync-deployments/issues/71
|
||||
- https://github.com/Burnett01/rsync-deployments/issues/52
|
||||
|
||||
### Missing rsync on Remote Host
|
||||
|
||||
If the action fails with "rsync: command not found" or similar errors, rsync is not installed on your remote server. Install it using your system's package manager:
|
||||
|
||||
**Ubuntu/Debian:**
|
||||
```bash
|
||||
sudo apt-get update && sudo apt-get install rsync
|
||||
```
|
||||
|
||||
**CentOS/RHEL/Rocky/AlmaLinux:**
|
||||
```bash
|
||||
sudo yum install rsync
|
||||
# OR on newer versions:
|
||||
sudo dnf install rsync
|
||||
```
|
||||
|
||||
**Alpine Linux:**
|
||||
```bash
|
||||
sudo apk add rsync
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Versions
|
||||
|
||||
## Version 7.1.0
|
||||
|
||||
Check here:
|
||||
|
||||
- https://github.com/Burnett01/rsync-deployments/tree/7.1.0 (alpine 3.22.1)
|
||||
|
||||
|
||||
## Version 7.0.2 (DEPRECATED)
|
||||
|
||||
Check here:
|
||||
|
||||
- https://github.com/Burnett01/rsync-deployments/tree/7.0.2 (alpine 3.22.1)
|
||||
|
||||
---
|
||||
|
||||
## Version 7.0.0 & 7.0.1 (EOL)
|
||||
## Version 7.0.0 & 7.0.1 (DEPRECATED)
|
||||
|
||||
Check here:
|
||||
|
||||
- https://github.com/Burnett01/rsync-deployments/tree/7.0.0 (alpine 3.19.1)
|
||||
- https://github.com/Burnett01/rsync-deployments/tree/7.0.1 (alpine 3.22.1)
|
||||
- https://github.com/Burnett01/rsync-deployments/tree/7.0.1 (alpine 3.19.1)
|
||||
|
||||
---
|
||||
|
||||
@@ -362,20 +233,12 @@ Please note that version 1.0 has reached end of life state.
|
||||
|
||||
---
|
||||
|
||||
## Media & Pingback
|
||||
## Media
|
||||
|
||||
This action was featured in multiple blogs across the globe:
|
||||
|
||||
> Disclaimer: The author & co-authors are not responsible for the content of the site-links below.
|
||||
|
||||
- https://hosting.xyz/wiki/hosting/other/github-actions/
|
||||
|
||||
- https://www.alexander-palm.de/2025/07/22/sichere-rsync-deployments-mit-github-actions-und-rrsync/
|
||||
|
||||
- https://lab.uberspace.de/howto_automatic-deployment/
|
||||
|
||||
- https://blog.devops.dev/setting-up-an-ubuntu-instance-for-nodejs-apps-in-ovh-cloud-using-nginx-pm2-github-actions-7618c768d081
|
||||
|
||||
- https://elijahverdoorn.com/2020/04/14/automating-deployment-with-github-actions/
|
||||
|
||||
- https://www.vektor-inc.co.jp/post/github-actions-deploy/
|
||||
|
||||
+11
-21
@@ -1,30 +1,20 @@
|
||||
# Security Policy
|
||||
|
||||
The Docker image and code quality are regularly checked for vulnerabilities and CVEs by Snyk and CodeQL.
|
||||
|
||||
## Supported Versions
|
||||
|
||||
The following versions are currently being supported with security updates:
|
||||
|
||||
| Version | Supported | Rsync version | Alpine version |
|
||||
| ------- | ------------------ | ------------------ | ------------------ |
|
||||
| 8.0.0 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
|
||||
| 7.1.0 | :white_check_mark: | >= 3.4.1-r0 | 3.22.1 |
|
||||
| 7.0.2 | :warning: DEPRECATED | >= 3.4.0-r0 | 3.22.1 |
|
||||
| 7.0.1 | :x: EOL | < 3.4.0 | 3.22.1 |
|
||||
| 7.0.0 | :x: EOL | < 3.4.0| 3.19.1 |
|
||||
| 6.x | :x: EOL |< 3.4.0| 3.17.2 |
|
||||
| 5.x | :x: EOL |< 3.4.0| 3.11 - 3.14.1 - 3.15 - 3.16 - 3.17.2 |
|
||||
| 4.x | :x: EOL |< 3.4.0| 3.11 |
|
||||
| 3.0 | :x: EOL |< 3.4.0| N/A |
|
||||
| 2.0 | :x: EOL |< 3.4.0| Ubuntu |
|
||||
| 1.0 | :x: EOL |< 3.4.0| Ubuntu |
|
||||
|
||||
### Terminology
|
||||
|
||||
EOL = End of life (no support/no updates)
|
||||
|
||||
DEPRECATED = Close to EOL (support/no updates)
|
||||
| Version | Supported | Rsync version |
|
||||
| ------- | ------------------ | ------------------ |
|
||||
| 7.0.2 | :white_check_mark: | >= 3.4.0 |
|
||||
| 7.0.1 | :warning: DEPRECATED | < 3.4.0 |
|
||||
| 7.0.0 | :warning: DEPRECATED | < 3.4.0|
|
||||
| 6.x | :x: EOL |< 3.4.0|
|
||||
| 5.x | :x: EOL |< 3.4.0|
|
||||
| 4.x | :x: EOL |< 3.4.0|
|
||||
| 3.0 | :x: EOL |< 3.4.0|
|
||||
| 2.0 | :x: EOL |< 3.4.0|
|
||||
| 1.0 | :x: EOL |< 3.4.0|
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
|
||||
@@ -13,10 +13,6 @@ inputs:
|
||||
description: 'Enables support for legacy RSA host keys on OpenSSH 8.8+'
|
||||
required: false
|
||||
default: 'false'
|
||||
strict_hostkeys_checking:
|
||||
description: 'Controls strict host keys checking'
|
||||
required: false
|
||||
default: 'false'
|
||||
path:
|
||||
description: 'The local path'
|
||||
required: false
|
||||
@@ -41,10 +37,6 @@ inputs:
|
||||
description: 'The remote key passphrase'
|
||||
required: false
|
||||
default: ''
|
||||
debug:
|
||||
description: 'Debug the action'
|
||||
required: false
|
||||
default: 'false'
|
||||
runs:
|
||||
using: 'docker'
|
||||
image: 'Dockerfile'
|
||||
|
||||
@@ -1,6 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
source agent-start "${1:-default}"
|
||||
cat - | tr -d '\r' | DISPLAY=1 SSH_ASKPASS=agent-askpass ssh-add - >/dev/null
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
echo "$SSH_PASS"
|
||||
@@ -1,21 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
FOLDER=${1:-default}
|
||||
STORE_PATH="/tmp/ssh-agent/$FOLDER"
|
||||
mkdir -p "$STORE_PATH"
|
||||
|
||||
if [ -z "${SSH_AGENT_PID:-}" ]; then
|
||||
if [ -f "$STORE_PATH/id" ]; then
|
||||
SSH_AGENT_PID=$(cat "$STORE_PATH/id")
|
||||
export SSH_AGENT_PID
|
||||
|
||||
SSH_AUTH_SOCK=$(cat "$STORE_PATH/sock")
|
||||
export SSH_AUTH_SOCK
|
||||
else
|
||||
eval "$(ssh-agent)" > /dev/null
|
||||
echo "$SSH_AGENT_PID" > "$STORE_PATH"/id
|
||||
echo "$SSH_AUTH_SOCK" > "$STORE_PATH"/sock
|
||||
fi
|
||||
fi
|
||||
@@ -1,37 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
if [ ! -z "$SSH_AGENT_PID" ]; then
|
||||
# Here, the environment is set already, just kill the script.
|
||||
eval $(ssh-agent -k) >/dev/null
|
||||
exit $?
|
||||
else
|
||||
# The env isn't set, construct the file path.
|
||||
FOLDER=${1:-default}
|
||||
STORE_PATH="/tmp/ssh-agent/$FOLDER"
|
||||
if [ ! -d "$STORE_PATH" ]; then
|
||||
echo "Store Path $STORE_PATH doesn't exist!" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# And check our files exist.
|
||||
if [ -f "$STORE_PATH/id" ]; then
|
||||
# Grab our PID and socket.
|
||||
SSH_AGENT_PID=$(cat "$STORE_PATH/id")
|
||||
export SSH_AGENT_PID
|
||||
rm "$STORE_PATH/id"
|
||||
|
||||
SSH_AUTH_SOCK=$(cat "$STORE_PATH/sock")
|
||||
export SSH_AUTH_SOCK
|
||||
rm "$STORE_PATH/sock"
|
||||
|
||||
|
||||
rmdir "$STORE_PATH"
|
||||
eval $(ssh-agent -k) >/dev/null
|
||||
exit $?
|
||||
else
|
||||
echo "SSH_AGENT_PID not set, $STORE_PATH/id doesn't exist!" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
printf '%s\n' "$@" >> $HOME/.ssh/known_hosts
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
truncate -s 0 $HOME/.ssh/known_hosts
|
||||
@@ -1,6 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
touch $HOME/.ssh/known_hosts
|
||||
chmod 600 $HOME/.ssh/known_hosts
|
||||
@@ -1,5 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
mkdir -m 700 $HOME/.ssh
|
||||
+10
-38
@@ -1,55 +1,27 @@
|
||||
#!/bin/sh
|
||||
|
||||
set -eu
|
||||
|
||||
if [ "${INPUT_DEBUG:-false}" = "true" ]; then
|
||||
set -x
|
||||
fi
|
||||
|
||||
if [ -z "$(echo "$INPUT_REMOTE_PATH" | awk '{$1=$1};1')" ]; then
|
||||
echo "The remote_path can not be empty. see: github.com/Burnett01/rsync-deployments/issues/44"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Initialize SSH and known hosts.
|
||||
source ssh-init
|
||||
source hosts-init
|
||||
echo "::warning title=DEPRECATION-WARNING::Version 7.1.0 and 7.0.2 are deprecated! Use v8! See deprecation notice https://github.com/Burnett01/rsync-deployments/discussions/96"
|
||||
|
||||
# Start the SSH agent and load key.
|
||||
source agent-start "$GITHUB_ACTION"
|
||||
printf '%s' "$INPUT_REMOTE_KEY" | SSH_PASS="${INPUT_REMOTE_KEY_PASS}" agent-add >/dev/null 2>&1
|
||||
echo "$INPUT_REMOTE_KEY" | SSH_PASS="$INPUT_REMOTE_KEY_PASS" agent-add
|
||||
|
||||
# Add strict errors.
|
||||
set -eu
|
||||
|
||||
# Variables.
|
||||
LEGACY_RSA_HOSTKEYS=""
|
||||
if [ "${INPUT_LEGACY_ALLOW_RSA_HOSTKEYS:-false}" = "true" ]; then
|
||||
LEGACY_RSA_HOSTKEYS="-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa"
|
||||
fi
|
||||
LEGACY_RSA_HOSTKEYS="-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa"
|
||||
LEGACY_RSA_HOSTKEYS=$([ "$INPUT_LEGACY_ALLOW_RSA_HOSTKEYS" = "true" ] && echo "$LEGACY_RSA_HOSTKEYS" || echo "")
|
||||
|
||||
STRICT_HOSTKEYS_CHECKING="-o StrictHostKeyChecking=no"
|
||||
if [ "${INPUT_STRICT_HOSTKEYS_CHECKING:-false}" = "true" ]; then
|
||||
STRICT_HOSTKEYS_CHECKING="-o UserKnownHostsFile=$HOME/.ssh/known_hosts -o StrictHostKeyChecking=yes"
|
||||
|
||||
key="$(ssh-keyscan -p "$INPUT_REMOTE_PORT" "$INPUT_REMOTE_HOST" 2>/dev/null | sed '/^#/d')" || key=""
|
||||
if [ -n "$key" ]; then
|
||||
# fingerprint verification
|
||||
echo "$key" | ssh-keygen -lf -
|
||||
# add to known hosts
|
||||
echo "$key" | while IFS= read -r line; do hosts-add "$line"; done
|
||||
else
|
||||
echo "Warning: failed to fetch host key for $INPUT_REMOTE_HOST" >&2
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
RSH="ssh $STRICT_HOSTKEYS_CHECKING $LEGACY_RSA_HOSTKEYS -p $INPUT_REMOTE_PORT $INPUT_RSH"
|
||||
SWITCHES="$INPUT_SWITCHES"
|
||||
RSH="ssh -o StrictHostKeyChecking=no $LEGACY_RSA_HOSTKEYS -p $INPUT_REMOTE_PORT $INPUT_RSH"
|
||||
LOCAL_PATH="$GITHUB_WORKSPACE/$INPUT_PATH"
|
||||
DSN="$INPUT_REMOTE_USER@$INPUT_REMOTE_HOST"
|
||||
|
||||
# Deploy.
|
||||
sh -c "rsync $INPUT_SWITCHES -e '$RSH' $LOCAL_PATH $DSN:$INPUT_REMOTE_PATH"
|
||||
|
||||
# Clean up.
|
||||
source agent-stop "$GITHUB_ACTION"
|
||||
source hosts-clear
|
||||
|
||||
exit 0
|
||||
sh -c "rsync $SWITCHES -e '$RSH' $LOCAL_PATH $DSN:$INPUT_REMOTE_PATH"
|
||||
|
||||
@@ -1,128 +0,0 @@
|
||||
#!/usr/bin/env bats
|
||||
|
||||
setup() {
|
||||
# Create dummy binaries for sourcing
|
||||
echo 'echo "source"' > source
|
||||
echo 'echo "agent started"' > agent-start
|
||||
echo 'echo "key added"' > agent-add
|
||||
chmod +x source agent-start agent-add
|
||||
|
||||
# Create dummy rsync binary to capture its arguments
|
||||
echo 'echo "rsync $@"' > rsync
|
||||
chmod +x rsync
|
||||
|
||||
PATH="$PWD:$PATH"
|
||||
}
|
||||
|
||||
teardown() {
|
||||
rm -f source agent-start agent-add rsync ssh-keyscan hosts-add
|
||||
}
|
||||
|
||||
@test "fails if INPUT_REMOTE_PATH is empty" {
|
||||
export INPUT_REMOTE_PATH=" "
|
||||
run ./entrypoint.sh
|
||||
[ "$status" -eq 1 ]
|
||||
[[ "${output}" == *"can not be empty"* ]]
|
||||
}
|
||||
|
||||
@test "includes legacy RSA switches when allowed" {
|
||||
export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="true"
|
||||
export INPUT_REMOTE_PATH="remote/"
|
||||
export INPUT_REMOTE_KEY="dummy"
|
||||
export INPUT_REMOTE_KEY_PASS="dummy"
|
||||
export GITHUB_ACTION="dummy"
|
||||
export INPUT_SWITCHES="-avz"
|
||||
export INPUT_REMOTE_PORT="22"
|
||||
export INPUT_RSH=""
|
||||
export INPUT_PATH=""
|
||||
export INPUT_REMOTE_USER="user"
|
||||
export INPUT_REMOTE_HOST="localhost.local"
|
||||
export GITHUB_WORKSPACE="/tmp"
|
||||
export DSN="user@localhost.local"
|
||||
export LOCAL_PATH="/tmp/"
|
||||
|
||||
run ./entrypoint.sh
|
||||
|
||||
[[ "${output}" == *"rsync -avz -e ssh -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 22 /tmp/ user@localhost.local:remote/"* ]]
|
||||
}
|
||||
|
||||
@test "does not include legacy RSA switches when not allowed" {
|
||||
export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="false"
|
||||
export INPUT_REMOTE_PATH="remote/"
|
||||
export INPUT_REMOTE_KEY="dummy"
|
||||
export INPUT_REMOTE_KEY_PASS="dummy"
|
||||
export GITHUB_ACTION="dummy"
|
||||
export INPUT_SWITCHES="-avz"
|
||||
export INPUT_REMOTE_PORT="22"
|
||||
export INPUT_RSH=""
|
||||
export INPUT_PATH=""
|
||||
export INPUT_REMOTE_USER="user"
|
||||
export INPUT_REMOTE_HOST="localhost.local"
|
||||
export GITHUB_WORKSPACE="/tmp"
|
||||
export DSN="user@localhost.local"
|
||||
export LOCAL_PATH="/tmp/"
|
||||
|
||||
run ./entrypoint.sh
|
||||
[[ "${output}" == *"rsync -avz -e ssh -o StrictHostKeyChecking=no -p 22 /tmp/ user@localhost.local:remote/"* ]]
|
||||
}
|
||||
|
||||
@test "includes STRICT_HOSTKEYS_CHECKING switches when allowed" {
|
||||
# Set a fake HOME dir
|
||||
local -r HOME="/tmp"
|
||||
|
||||
export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="false"
|
||||
export INPUT_STRICT_HOSTKEYS_CHECKING="true"
|
||||
export INPUT_REMOTE_PATH="remote/"
|
||||
export INPUT_REMOTE_KEY="dummy"
|
||||
export INPUT_REMOTE_KEY_PASS="dummy"
|
||||
export GITHUB_ACTION="dummy"
|
||||
export INPUT_SWITCHES="-avz"
|
||||
export INPUT_REMOTE_PORT="22"
|
||||
export INPUT_RSH=""
|
||||
export INPUT_PATH=""
|
||||
export INPUT_REMOTE_USER="user"
|
||||
export INPUT_REMOTE_HOST="localhost.local"
|
||||
export GITHUB_WORKSPACE="/tmp"
|
||||
export DSN="user@localhost.local"
|
||||
export LOCAL_PATH="/tmp/"
|
||||
|
||||
# Generate a mock key pair to test ssh-keyscan (entrypoint.sh:32)
|
||||
rm -f "$HOME/mockKeyPair" "$HOME/mockKeyPair.pub" \
|
||||
&& ssh-keygen -t ed25519 -f "$HOME/mockKeyPair" -N '' -q -C '' \
|
||||
&& mockPublicKey=$(< "$HOME/mockKeyPair.pub")
|
||||
|
||||
# Create dummy ssh-keyscan binary to return $mockPublicKey
|
||||
echo "echo 'localhost.local $mockPublicKey #Mock 1'" > ssh-keyscan
|
||||
chmod +x ssh-keyscan
|
||||
|
||||
# Create dummy hosts-add binary to capture its arguments
|
||||
echo 'echo "hosts-add $@"' > hosts-add
|
||||
chmod +x hosts-add
|
||||
|
||||
run ./entrypoint.sh
|
||||
|
||||
[[ "${output}" == *"hosts-add localhost.local ssh-ed25519"* ]]
|
||||
[[ "${output}" == *"rsync -avz -e ssh -o UserKnownHostsFile=/tmp/.ssh/known_hosts -o StrictHostKeyChecking=yes -p 22 /tmp/ user@localhost.local:remote/"* ]]
|
||||
}
|
||||
|
||||
@test "does not includes STRICT_HOSTKEYS_CHECKING switches when not allowed" {
|
||||
export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="false"
|
||||
export INPUT_STRICT_HOSTKEYS_CHECKING="false"
|
||||
export INPUT_REMOTE_PATH="remote/"
|
||||
export INPUT_REMOTE_KEY="dummy"
|
||||
export INPUT_REMOTE_KEY_PASS="dummy"
|
||||
export GITHUB_ACTION="dummy"
|
||||
export INPUT_SWITCHES="-avz"
|
||||
export INPUT_REMOTE_PORT="22"
|
||||
export INPUT_RSH=""
|
||||
export INPUT_PATH=""
|
||||
export INPUT_REMOTE_USER="user"
|
||||
export INPUT_REMOTE_HOST="localhost.local"
|
||||
export GITHUB_WORKSPACE="/tmp"
|
||||
export DSN="user@localhost.local"
|
||||
export LOCAL_PATH="/tmp/"
|
||||
|
||||
run ./entrypoint.sh
|
||||
|
||||
[[ "${output}" == *"rsync -avz -e ssh -o StrictHostKeyChecking=no -p 22 /tmp/ user@localhost.local:remote/"* ]]
|
||||
}
|
||||
Reference in New Issue
Block a user