Merge pull request #26 from JoshPiper/dependabot/docker/alpine-3.20.0

Bump alpine from 3.19.1 to 3.20.0

.dockerignore

@@ -1,5 +0,0 @@
-Dockerfile
-LICENSE
-*.md
-.git*
-.github*

.editorconfig

@@ -1,15 +0,0 @@
-root = true
-
-[*]
-charset = utf-8
-end_of_line = lf
-tab_width = 4
-indent_size = 4
-indent_style = space
-max_line_length = 9999
-insert_final_newline = true
-trim_trailing_whitespace = true
-
-[*.{yml,yaml}]
-tab_width = 2
-indent_size = 2

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,33 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Action version**
-eg. 7.0.1
-
-**Runner OS+Version**
-eg. ubuntu-latest
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**To Reproduce**
-Steps to reproduce the behavior:
-1. Go to '...'
-2. Click on '....'
-3. Scroll down to '....'
-4. See error
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**Additional context**
-Add any other context about the problem here.

.github/dependabot.yml

@@ -1,6 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: docker
-    directory: /
-    schedule:
-      interval: monthly

.github/workflows/ci-validating-linting-testing.yml

@@ -1,165 +0,0 @@
-# GitHub Actions CI workflow for rsync-deployments
-# This workflow validates the action on every push and pull request by:
-# - Running BATS tests for the entrypoint script
-# - Validating the action.yml definition
-# - Building and testing the Docker image
-# - Checking file structure and permissions
-# - Linting shell scripts
-# - Running a final integration check
-
-name: CI - Validating, Linting, Testing
-permissions:
-  contents: read
-
-on:
-  push:
-    branches: [ master ]
-  pull_request:
-    branches: [ master ]
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    name: Test BATS Suite
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Install BATS
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y bats
-
-    - name: Run BATS tests
-      run: bats test/entrypoint.bats
-
-  validate-action:
-    runs-on: ubuntu-latest
-    name: Validate Action Definition
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Validate action.yml
-      run: |
-        # Check if action.yml exists and has required fields
-        if [ ! -f "action.yml" ]; then
-          echo "Error: action.yml not found"
-          exit 1
-        fi
-        
-        # Basic validation that action.yml contains required fields
-        python3 -c "
-        import yaml
-        import sys
-        
-        with open('action.yml', 'r') as f:
-            action = yaml.safe_load(f)
-        
-        required_fields = ['name', 'description', 'inputs', 'runs']
-        for field in required_fields:
-            if field not in action:
-                print(f'Missing required field: {field}')
-                sys.exit(1)
-        
-        # Check required inputs exist
-        required_inputs = ['switches', 'remote_path', 'remote_host', 'remote_user', 'remote_key']
-        for input_name in required_inputs:
-            if input_name not in action['inputs']:
-                print(f'Missing required input: {input_name}')
-                sys.exit(1)
-            if not action['inputs'][input_name].get('required', False):
-                print(f'Input {input_name} should be marked as required')
-                sys.exit(1)
-        
-        print('Action definition is valid')
-        "
-
-  docker-build:
-    runs-on: ubuntu-latest
-    name: Build Docker Image
-    needs: [validate-action, action-structure]
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Build Docker image
-      run: |
-        echo "Building Docker image..."
-        docker build -t rsync-deployments . --no-cache
-        echo "Docker image built successfully"
-
-  action-structure:
-    runs-on: ubuntu-latest
-    name: Validate Action Structure
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Check required files
-      run: |
-        echo "Checking required files exist..."
-        
-        # Check all required files exist
-        required_files=("action.yml" "Dockerfile" "entrypoint.sh")
-        for file in "${required_files[@]}"; do
-          if [ ! -f "$file" ]; then
-            echo "Error: Required file $file not found"
-            exit 1
-          fi
-          echo "✓ $file exists"
-        done
-        
-        # Check entrypoint is executable
-        if [ ! -x "entrypoint.sh" ]; then
-          echo "Error: entrypoint.sh is not executable"
-          exit 1
-        fi
-        echo "✓ entrypoint.sh is executable"
-        
-        # Check basic script syntax
-        bash -n entrypoint.sh
-        echo "✓ entrypoint.sh has valid syntax"
-        
-        echo "All structure checks passed!"
-
-  lint-shell:
-    runs-on: ubuntu-latest
-    name: Lint Shell Scripts
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Install ShellCheck
-      run: |
-        sudo apt-get update
-        sudo apt-get install -y shellcheck
-
-    - name: Lint entrypoint.sh
-      run: |
-        echo "Linting shell scripts..."
-        # Run shellcheck with exclusions for Docker-specific dependencies
-        shellcheck -e SC1091 -e SC3046 entrypoint.sh || {
-          echo "ShellCheck found issues, but running with Docker-specific exclusions..."
-          shellcheck -e SC1091 -e SC3046 entrypoint.sh
-        }
-        echo "Shell script linting completed"
-
-  integration-check:
-    runs-on: ubuntu-latest
-    name: Integration Check
-    needs: [test, validate-action, docker-build, action-structure, lint-shell]
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-
-    - name: Final integration check
-      run: |
-        echo "All CI jobs completed successfully!"
-        echo "✅ BATS tests passed"
-        echo "✅ Action definition validated"
-        echo "✅ Docker image built and tested"
-        echo "✅ File structure validated"
-        echo "✅ Shell scripts linted"
-        echo ""
-        echo "🎉 rsync-deployments action is ready for use!"

.github/workflows/snyk-docker-vulnerability-scan.yml

@@ -1,41 +0,0 @@
-name: Snyk Docker Vulnerability Scan
-
-on:
-  push:
-    branches: [ "master" ]
-  pull_request:
-    branches: [ "master" ]
-  schedule:
-    - cron: '39 13 * * 4'
-
-permissions:
-  contents: read
-
-jobs:
-  snyk:
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - name: Build a Docker image
-      run: docker build -t burnett01/rsync-deployments .
-    - name: Run Snyk to check Docker image for vulnerabilities
-      continue-on-error: true
-      uses: snyk/actions/docker@master
-      env:
-        SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      with:
-        image: burnett01/rsync-deployments
-        args: --file=Dockerfile
-    - name: Output sarif file
-      run: cat snyk.sarif
-    - name: fix security-severity "null" to "0" for valid sarif format
-      run: |
-        sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
-    - name: Upload result to GitHub Code Scanning
-      uses: github/codeql-action/upload-sarif@v4
-      with:
-        sarif_file: snyk.sarif

CODE_OF_CONDUCT.md

@@ -1,76 +0,0 @@
-# Contributor Covenant Code of Conduct
-
-## Our Pledge
-
-In the interest of fostering an open and welcoming environment, we as
-contributors and maintainers pledge to making participation in our project and
-our community a harassment-free experience for everyone, regardless of age, body
-size, disability, ethnicity, sex characteristics, gender identity and expression,
-level of experience, education, socio-economic status, nationality, personal
-appearance, race, religion, or sexual identity and orientation.
-
-## Our Standards
-
-Examples of behavior that contributes to creating a positive environment
-include:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior by participants include:
-
-* The use of sexualized language or imagery and unwelcome sexual attention or
- advances
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information, such as a physical or electronic
- address, without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a
- professional setting
-
-## Our Responsibilities
-
-Project maintainers are responsible for clarifying the standards of acceptable
-behavior and are expected to take appropriate and fair corrective action in
-response to any instances of unacceptable behavior.
-
-Project maintainers have the right and responsibility to remove, edit, or
-reject comments, commits, code, wiki edits, issues, and other contributions
-that are not aligned to this Code of Conduct, or to ban temporarily or
-permanently any contributor for other behaviors that they deem inappropriate,
-threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies both within project spaces and in public spaces
-when an individual is representing the project or its community. Examples of
-representing a project or community include using an official project e-mail
-address, posting via an official social media account, or acting as an appointed
-representative at an online or offline event. Representation of a project may be
-further defined and clarified by project maintainers.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be
-reported by contacting the project team via issues. All
-complaints will be reviewed and investigated and will result in a response that
-is deemed necessary and appropriate to the circumstances. The project team is
-obligated to maintain confidentiality with regard to the reporter of an incident.
-Further details of specific enforcement policies may be posted separately.
-
-Project maintainers who do not follow or enforce the Code of Conduct in good
-faith may face temporary or permanent repercussions as determined by other
-members of the project's leadership.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
-available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
-
-[homepage]: https://www.contributor-covenant.org
-
-For answers to common questions about this code of conduct, see
-https://www.contributor-covenant.org/faq

CONTRIBUTING.md

@@ -1 +0,0 @@
-Feel free to contribute to this project.

Dockerfile

@@ -1,15 +1,16 @@
-FROM alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375 AS base
-
-RUN apk update && apk add --no-cache --upgrade rsync openssh openssl busybox
+FROM alpine:3.20.0
+MAINTAINER Dr Internet <internet@limelightgaming.net>
 
+# Install RSync and Open SSH.
+RUN apk update && apk add --no-cache rsync openssh-client
 RUN rm -rf /var/cache/apk/*
 
-COPY docker-rsync/* /bin/
-RUN chmod +x /bin/agent-*
+# Prepare SSH dir.
+RUN mkdir ~/.ssh
 
-FROM base AS build
+# Copy in our executables.
+COPY agent-* hosts-* /bin/
+RUN chmod +x /bin/agent-* /bin/hosts-*
 
-COPY entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
-
-ENTRYPOINT ["/entrypoint.sh"]
+# Prepare for known hosts.
+RUN hosts-clear

LICENSE

@@ -1,8 +1,6 @@
 MIT License
 
-Copyright (c) 2019-2022 Contention
-Copyright (c) 2019-2025 Joshua Piper (Dr Internet)
-Copyright (c) 2019-2025 Burnett01
+Copyright (c) 2020 Joshua Piper
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,390 +1,93 @@
-# rsync deployments
+# rsync docker image.
 
-[![CI - Validating, Linting, Testing](https://github.com/Burnett01/rsync-deployments/actions/workflows/ci-validating-linting-testing.yml/badge.svg)](https://github.com/Burnett01/rsync-deployments/actions/workflows/ci-validating-linting-testing.yml) 
-[![Snyk Docker Vulnerability Scan](https://github.com/Burnett01/rsync-deployments/actions/workflows/snyk-docker-vulnerability-scan.yml/badge.svg)](https://github.com/Burnett01/rsync-deployments/actions/workflows/snyk-docker-vulnerability-scan.yml) 
-[![CodeQL](https://github.com/Burnett01/rsync-deployments/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/Burnett01/rsync-deployments/actions/workflows/github-code-scanning/codeql) 
-[![Dependabot Updates](https://github.com/Burnett01/rsync-deployments/actions/workflows/dependabot/dependabot-updates/badge.svg)](https://github.com/Burnett01/rsync-deployments/actions/workflows/dependabot/dependabot-updates)
+A simple alpine based docker image for rsync and ssh deployments.
 
+## Using this image
+This image has two primary uses. Firstly, as a deployment image for GitLab CI runs. Secondly, as a base image for other images.
 
-This cross-platform GitHub Action deploys files in [`path`](#inputs) (relative to  `GITHUB_WORKSPACE`) to a remote folder via rsync over ssh. 
-
-Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`, such [actions/checkout](https://github.com/actions/checkout).
-
-The base-image of this action is very small and based on **Alpine 3.23.0** (no cache) which results in fast deployments.
-
-Alpine version: [3.23.0](https://www.alpinelinux.org/posts/Alpine-3.23.0-released.html)
-Rsync version: [3.4.1-r1](https://download.samba.org/pub/rsync/NEWS#3.4.1)
-
----
-
-## Inputs
-
-- `debug`* - Whether to enable debug output. ("true" / "false") - Default: "false"
-
-- `switches`* - The first is for any initial/required rsync flags, eg: `-avzr --delete`
-
-- `rsh` - Remote shell commands
-
-- `strict_hostkeys_checking` - Enables support for strict hostkeys (fingerprint) checking. ("true" / "false") - Default: "false"
-
-- `legacy_allow_rsa_hostkeys` - Enables support for legacy RSA host keys on OpenSSH 8.8+. ("true" / "false") - Default: "false"
-
-- `path` - The source path. Defaults to GITHUB_WORKSPACE and is relative to it
-
-- `remote_path`* - The deployment target path
-
-- `remote_host`* - The remote host
-
-- `remote_port` - The remote port. Defaults to 22
-
-- `remote_user`* - The remote user
-
-- `remote_key`* - The remote ssh private key
-
-- `remote_key_pass` - The remote ssh private key passphrase (if any)
-
-``* = Required``
-
-## Required secret(s)
-
-This action needs secret variables for the ssh private key of your key pair. The public key part should be added to the authorized_keys file on the server that receives the deployment. The secret variable should be set in the Github secrets section of your org/repo and then referenced as the  `remote_key` input.
-
-> Always use secrets when dealing with sensitive inputs!
-
-For simplicity, we are using `REMOTE_*` as the secret variables throughout the examples.
-
-## Current Version: v8 (8.0.0)
-
-### Release channels:
-
-| Version | Purpose          | Immutable  | 
-| ------- | ------------------ | ------------------ | 
-| ``v8``  |  latest release (pointer to 8.x.x) | no, points to latest MINOR,PATCH |
-| 8.0.0  | latest major release | yes |
-| 7.1.0   | previous release | yes |
-
-Check [SECURITY.md](SECURITY.md) for support cycles.
-
-## Example usage
-
-Simple:
-
+### gitlab-ci.yml
 ```yml
-name: DEPLOY
-on:
-  push:
-    branches:
-    - master
+image: drinternet/rsync:1.0.1
+...
+before_script:
+  - source agent-autostart "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
+  - hosts-add "$SSH_KNOWN_HOSTS"
 
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@v8
-      with:
-        switches: -avzr --delete
-        path: src/
-        remote_path: /var/www/html/
-        remote_host: example.com
-        remote_user: debian
-        remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
+after_script:
+  - agent-stop "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
 ```
 
-Advanced:
+### Base image in a `Dockerfile
+```dockerfile
+FROM drinternet/rsync:1.0.1
+COPY some/file or/whatever
+```
 
+## Inbuilt commands.
+
+This base image also includes a few shell scripts, to help with managing SSH agents and known hosts files.
+### SSH Agent Management
+#### agent-start
+This command starts the SSH agent, if it isn't already started (SSH_AGENT_PID set or ssh agent ID file found).
+It takes one optional argument, for the name of the agent to be started. Defaults to "default".
+This program needs to be source'd to work correctly.
+`source agent-start "default"`
+
+#### agent-stop
+This command stops the SSH agent, if it is started (SSH_AGENT_PID set or ssh agent ID file found).
+It takes one optional argument, for the name of the agent to be stopped. Defaults to "default".
+`agent-stop "my-agent-name"`
+
+#### agent-add
+This command adds a key to the currently running SSH agent. The key is taken from stdin, and the agent used is that in SSH_AGENT_PID.
+
+#### agent-autostart
+This command starts the SSH agent and loads the private key from the "SSH_PRIVATE_KEY" environment var. The command takes one optional argument, for the name of the agent to be started. Defaults to "default".
+As with agent-start, this command needs to be sourced.
+
+#### agent-askpass
+This command is called by ssh-add when the [SSH_ASKPASS](https://man.openbsd.org/ssh-add.1#ENVIRONMENT) variable is set active. The command returns the SSH_PASS to [ssh-askpass(1)](https://man.openbsd.org/ssh-askpass.1).
+
+This command is ignored by ssh-add if the key does not require a passphrase.
+
+### known_hosts management
+#### hosts-clear
+This command truncates the known_hosts file and sets its permissions.
+
+#### hosts-add
+This command adds an entry to the known hosts file, and ensures its permissions are correct. It takes one argument, which is the new key to add.
+
+## Tags
+Both the repository and Docker Hub images follow the [semantic versioning](https://semver.org/) standard.
+Docker Hub image versions are prefixed with v, and contain the full version, version sub patch number and version sub minor and patch.
+
+For example, the repository tag 1.2.3, creates the Hub tags v1.2.3, v1.2 and v1, to allow for binding to a specific version, specific minor version or specific major version.
+
+
+## Example gitlab-ci.yml
 ```yml
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@v8
-      with:
-        switches: -avzr --delete --exclude="" --include="" --filter=""
-        path: src/
-        remote_path: /var/www/html/
-        remote_host: example.com
-        remote_port: 5555
-        remote_user: debian
-        remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
+image: drinternet/rsync:1.0.1
+
+stages:
+  - deploy
+
+before_script:
+  - source agent-autostart "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
+  - hosts-add "$SSH_KNOWN_HOSTS"
+
+after_script:
+  - agent-stop "$CI_PROJECT_ID-$CI_PIPELINE_ID-$_CI_CONCURRENT_ID"
+
+deploy:
+  stage: deploy
+  script:
+    - rsync -zrSlhaO --chmod=D2775,F664 --delete-after . $FTP_USER@$FTP_HOST:/var/www/deployment/
 ```
 
-For better **security**, I suggest you create additional secrets for remote_host, remote_port, remote_user and remote_path inputs.
+## Using with passphrase protected key
+
+You can supply a passphrase with ``SSH_PASS`` to ``agent-add``, ``agent-start`` or ``agent-autostart``.
 
-```yml
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@v8
-      with:
-        switches: -avzr --delete
-        path: src/
-        remote_path: ${{ secrets.REMOTE_PATH }}
-        remote_host: ${{ secrets.REMOTE_HOST }}
-        remote_port: ${{ secrets.REMOTE_PORT }}
-        remote_user: ${{ secrets.REMOTE_USER }}
-        remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
 ```
-
-If your private key is passphrase protected you should use:
-
-```yml
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@v8
-      with:
-        switches: -avzr --delete
-        path: src/
-        remote_path: ${{ secrets.REMOTE_PATH }}
-        remote_host: ${{ secrets.REMOTE_HOST }}
-        remote_port: ${{ secrets.REMOTE_PORT }}
-        remote_user: ${{ secrets.REMOTE_USER }}
-        remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
-        remote_key_pass: ${{ secrets.REMOTE_PRIVATE_KEY_PASS }}
+SSH_PASS="THE_PASSPHRASE" agent-add
 ```
-
----
-
-#### Legacy RSA Hostkeys support for OpenSSH Servers >= 8.8+
-
-If your remote OpenSSH Server still uses RSA hostkeys, then you have to
-manually enable legacy support for this by using ``legacy_allow_rsa_hostkeys: "true"``.
-
-```yml
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v6
-    - name: rsync deployments
-      uses: burnett01/rsync-deployments@v8
-      with:
-        switches: -avzr --delete
-        legacy_allow_rsa_hostkeys: "true"
-        path: src/
-        remote_path: ${{ secrets.REMOTE_PATH }}
-        remote_host: ${{ secrets.REMOTE_HOST }}
-        remote_port: ${{ secrets.REMOTE_PORT }}
-        remote_user: ${{ secrets.REMOTE_USER }}
-        remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
-```
-
-See [#49](https://github.com/Burnett01/rsync-deployments/issues/49) and [#24](https://github.com/Burnett01/rsync-deployments/issues/24) for more information.
-
-**Note:** Only use this if necessary. It's recommended to upgrade your remote OpenSSH server instead.
-
---
-
-## Advanced Rsync switches/flags/options
-
-For advanced rsync configuration options and switches, refer to the [rsync manual](https://linux.die.net/man/1/rsync).
-
----
-
-## Troubleshooting
-
-### SSH Permission Denied Errors
-
-If you encounter "Permission denied (publickey,password)" errors, here are the most common solutions:
-
-#### 1. SSH Key Setup
-
-Ensure your SSH key pair is correctly generated and configured:
-
-```bash
-# Generate a new SSH key pair (recommended: Ed25519 or RSA 4096-bit)
-ssh-keygen -t ed25519 -C "deploy@yourproject" -f ~/.ssh/deploy_yourproject -N ""
-# OR for RSA:
-ssh-keygen -t rsa -b 4096 -C "deploy@yourproject" -f ~/.ssh/deploy_yourproject -N ""
-```
-
-**Important Steps:**
-- Add the **public key** (`.pub` file) to your server's `~/.ssh/authorized_keys`
-- Add the **private key** (without `.pub` extension) to GitHub Secrets as `REMOTE_PRIVATE_KEY`
-- Ensure correct file permissions on your server:
-  ```bash
-  chmod 700 ~/.ssh
-  chmod 600 ~/.ssh/authorized_keys
-  ```
-
-For detailed information on creating and managing SSH keys, see [GitHub's SSH Key Guide](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
-
-#### 2. ``remote_path`` permissions
-
-Make sure the ``remote_user`` has write access to ``remote_path``.
-
-See: https://github.com/Burnett01/rsync-deployments/issues/81#issuecomment-3308152891
-
-#### 3. Firewall / GitHub Actions IP Restrictions
-
-If your remote server has firewall restrictions:
-
-- **Option A:** Whitelist [GitHub Actions IP ranges](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#ip-addresses) (Azure-based)
-- **Option B:** Use self-hosted runners on your server (recommended for strict firewall environments)
-
-### Excluding files/folders (eg .git) 
-
-By default, rsync copies dot files and folder if present at ``path:``. To exclude them, you can use the ``--exclude`` switch:
-
-```yml
-switches: -avzr --delete --exclude='.git/'
-```
-
-Other common exclusions:
-```yml
-switches: -avzr --delete --exclude='.git/' --exclude='node_modules/' --exclude='.env'
-```
-
-More advanced examples:
-
-- https://github.com/Burnett01/rsync-deployments/issues/5#issuecomment-667589874
-- https://github.com/Burnett01/rsync-deployments/issues/16
-- https://github.com/Burnett01/rsync-deployments/issues/71
-- https://github.com/Burnett01/rsync-deployments/issues/52
-
-### Missing rsync on Remote Host
-
-If the action fails with "rsync: command not found" or similar errors, rsync is not installed on your remote server. Install it using your system's package manager:
-
-**Ubuntu/Debian:**
-```bash
-sudo apt-get update && sudo apt-get install rsync
-```
-
-**CentOS/RHEL/Rocky/AlmaLinux:**
-```bash
-sudo yum install rsync
-# OR on newer versions:
-sudo dnf install rsync
-```
-
-**Alpine Linux:**
-```bash
-sudo apk add rsync
-```
-
----
-
-## Versions
-
-## Version 7.1.0
-
-Check here: 
-
-- https://github.com/Burnett01/rsync-deployments/tree/7.1.0  (alpine 3.22.1)
-  
-
-## Version 7.0.2 (DEPRECATED)
-
-Check here: 
-
-- https://github.com/Burnett01/rsync-deployments/tree/7.0.2  (alpine 3.22.1)
-  
----
-
-## Version 7.0.0 & 7.0.1 (EOL)
-
-Check here: 
-
-- https://github.com/Burnett01/rsync-deployments/tree/7.0.0  (alpine 3.19.1)
-- https://github.com/Burnett01/rsync-deployments/tree/7.0.1  (alpine 3.22.1)
-  
----
-
-## Version 6.0 (EOL)
-
-Check here: 
-
-- https://github.com/Burnett01/rsync-deployments/tree/6.0  (alpine 3.17.2)
-
----
-
-## Version 5.0, 5.1 & 5.2 & 5.x (EOL)
-
-Check here: 
-
-- https://github.com/Burnett01/rsync-deployments/tree/5.0  (alpine 3.11.x)
-- https://github.com/Burnett01/rsync-deployments/tree/5.1  (alpine 3.14.1)
-- https://github.com/Burnett01/rsync-deployments/tree/5.2  (alpine 3.15.0)
-- https://github.com/Burnett01/rsync-deployments/tree/5.2.1  (alpine 3.16.1)
-- https://github.com/Burnett01/rsync-deployments/tree/5.2.2  (alpine 3.17.2)
-
----
-
-## Version 4.0 & 4.1 (EOL)
-
-Check here: 
-
-- https://github.com/Burnett01/rsync-deployments/tree/4.0
-- https://github.com/Burnett01/rsync-deployments/tree/4.1
-
-Version 4.0 & 4.1 use the ``drinternet/rsync:1.0.1`` base-image.
-
----
-
-## Version 3.0 (EOL)
-
-Check here: https://github.com/Burnett01/rsync-deployments/tree/3.0
-
-Version 3.0 uses the ``alpine:latest`` base-image directly.<br>
-Consider upgrading to 4.0 that uses a docker-image ``drinternet/rsync:1.0.1`` that is<br>
-based on ``alpine:latest``and heavily optimized for rsync.
-
-## Version 2.0 (EOL)
-
-Check here: https://github.com/Burnett01/rsync-deployments/tree/2.0
-
-Version 2.0 uses a larger base-image (``ubuntu:latest``).<br>
-Consider upgrading to 3.0 for even faster deployments.
-
-## Version 1.0 (EOL)
-
-Check here: https://github.com/Burnett01/rsync-deployments/tree/1.0
-
-Please note that version 1.0 has reached end of life state.
-
----
-
-## Acknowledgements
-
-+ This project is a fork of [Contention/rsync-deployments](https://github.com/Contention/rsync-deployments)
-+ Base image [JoshPiper/rsync-docker](https://github.com/JoshPiper/rsync-docker)
-
----
-
-## Media & Pingback
-
-This action was featured in multiple blogs across the globe:
-
-> Disclaimer: The author & co-authors are not responsible for the content of the site-links below.
-
-- https://hosting.xyz/wiki/hosting/other/github-actions/
-
-- https://www.alexander-palm.de/2025/07/22/sichere-rsync-deployments-mit-github-actions-und-rrsync/
-
-- https://lab.uberspace.de/howto_automatic-deployment/
-
-- https://blog.devops.dev/setting-up-an-ubuntu-instance-for-nodejs-apps-in-ovh-cloud-using-nginx-pm2-github-actions-7618c768d081
-
-- https://elijahverdoorn.com/2020/04/14/automating-deployment-with-github-actions/
-
-- https://www.vektor-inc.co.jp/post/github-actions-deploy/
-
-- https://webpick.info/automatiser-avec-github-actions/
-
-- https://matthias-andrasch.eu/blog/2021/tutorial-webseite-mittels-github-actions-deployment-zu-uberspace-uebertragen-rsync/
-
-- https://jishuin.proginn.com/p/763bfbd38928
-
-- https://cloud.tencent.com/developer/article/1786522
-

SECURITY.md

@@ -1,31 +0,0 @@
-# Security Policy
-
-The Docker image and code quality are regularly checked for vulnerabilities and CVEs by Snyk and CodeQL.
-
-## Supported Versions
-
-The following versions are currently being supported with security updates:
-
-| Version | Supported          | Rsync version          | Alpine version          |
-| ------- | ------------------ | ------------------ | ------------------ |
-| 8.0.0  | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
-| 7.1.0  | :white_check_mark: | >= 3.4.1-r0 | 3.22.1 |
-| 7.0.2   | :warning: DEPRECATED | >= 3.4.0-r0 | 3.22.1 |
-| 7.0.1   | :x: EOL | < 3.4.0 | 3.22.1 |
-| 7.0.0   | :x: EOL | < 3.4.0| 3.19.1 |
-| 6.x   | :x: EOL |< 3.4.0| 3.17.2 |
-| 5.x   | :x: EOL |< 3.4.0| 3.11 - 3.14.1 - 3.15 - 3.16 - 3.17.2 |
-| 4.x   | :x: EOL |< 3.4.0| 3.11 |
-| 3.0   | :x: EOL |< 3.4.0| N/A |
-| 2.0   | :x: EOL               |< 3.4.0| Ubuntu |
-| 1.0   | :x: EOL               |< 3.4.0| Ubuntu |
-
-### Terminology
-
-EOL = End of life (no support/no updates)
-
-DEPRECATED = Close to EOL (support/no updates)
-
-## Reporting a Vulnerability
-
-You can report a vulnerability by creating an issue.

action.yml

@@ -1,53 +0,0 @@
-name: 'Rsync Deployments Action'
-description: 'GitHub Action for deploying code via rsync over ssh'
-author: 'Burnett01'
-inputs:
-  switches:
-    description: 'The switches'
-    required: true
-  rsh:
-    description: 'The remote shell argument'
-    required: false
-    default: ''
-  legacy_allow_rsa_hostkeys:
-    description: 'Enables support for legacy RSA host keys on OpenSSH 8.8+'
-    required: false
-    default: 'false'
-  strict_hostkeys_checking:
-    description: 'Controls strict host keys checking'
-    required: false
-    default: 'false'
-  path:
-    description: 'The local path'
-    required: false
-    default: ''
-  remote_path:
-    description: 'The remote path'
-    required: true
-  remote_host:
-    description: 'The remote host'
-    required: true
-  remote_port:
-    description: 'The remote port'
-    required: false
-    default: 22
-  remote_user:
-    description: 'The remote user'
-    required: true
-  remote_key:
-    description: 'The remote key'
-    required: true
-  remote_key_pass:
-    description: 'The remote key passphrase'
-    required: false
-    default: ''
-  debug:
-    description: 'Debug the action'
-    required: false
-    default: 'false'
-runs:
-  using: 'docker'
-  image: 'Dockerfile'
-branding:
-  icon: 'send'  
-  color: 'gray-dark'

agent-add

@@ -1,6 +1,4 @@
 #!/bin/sh
 
-set -eu
-
 source agent-start "${1:-default}"
-cat - | tr -d '\r' | DISPLAY=1 SSH_ASKPASS=agent-askpass ssh-add - >/dev/null
+cat - | tr -d '\r' | DISPLAY=1 SSH_ASKPASS=agent-askpass ssh-add - >/dev/null

agent-askpass

@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "$SSH_PASS"

agent-autostart

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+source agent-start "${1:-default}"
+echo "$SSH_PRIVATE_KEY" | agent-add

agent-start

@@ -1,13 +1,14 @@
 #!/bin/sh
 
-set -eu
-
 FOLDER=${1:-default}
 STORE_PATH="/tmp/ssh-agent/$FOLDER"
 mkdir -p "$STORE_PATH"
 
-if [ -z "${SSH_AGENT_PID:-}" ]; then
+# Start the SSH agent if it isn't already.
+if [ -z "$SSH_AGENT_PID" ]; then
 	if [ -f "$STORE_PATH/id" ]; then
+		# Our auth agent is already running.
+		# Reload the vars, and export them.
 		SSH_AGENT_PID=$(cat "$STORE_PATH/id")
 		export SSH_AGENT_PID
 

agent-stop

@@ -1,7 +1,5 @@
 #!/bin/sh
 
-set -eu
-
 if [ ! -z "$SSH_AGENT_PID" ]; then
 	# Here, the environment is set already, just kill the script.
 	eval $(ssh-agent -k) >/dev/null
@@ -34,4 +32,4 @@ else
 		echo "SSH_AGENT_PID not set, $STORE_PATH/id doesn't exist!" >&2
 		exit 1
 	fi
-fi
+fi

docker-rsync/agent-askpass

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-echo "$SSH_PASS"

docker-rsync/hosts-add

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-printf '%s\n' "$@" >> $HOME/.ssh/known_hosts

docker-rsync/hosts-clear

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-truncate -s 0 $HOME/.ssh/known_hosts

docker-rsync/hosts-init

@@ -1,6 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-touch $HOME/.ssh/known_hosts
-chmod 600 $HOME/.ssh/known_hosts

docker-rsync/ssh-init

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-mkdir -m 700 $HOME/.ssh

entrypoint.sh

@@ -1,55 +0,0 @@
-#!/bin/sh
-
-set -eu
-
-if [ "${INPUT_DEBUG:-false}" = "true" ]; then
-    set -x
-fi
-
-if [ -z "$(echo "$INPUT_REMOTE_PATH" | awk '{$1=$1};1')" ]; then
-    echo "The remote_path can not be empty. see: github.com/Burnett01/rsync-deployments/issues/44"
-    exit 1
-fi
-
-# Initialize SSH and known hosts.
-source ssh-init
-source hosts-init
-
-# Start the SSH agent and load key.
-source agent-start "$GITHUB_ACTION"
-printf '%s' "$INPUT_REMOTE_KEY" | SSH_PASS="${INPUT_REMOTE_KEY_PASS}" agent-add >/dev/null 2>&1
-
-# Variables.
-LEGACY_RSA_HOSTKEYS=""
-if [ "${INPUT_LEGACY_ALLOW_RSA_HOSTKEYS:-false}" = "true" ]; then
-    LEGACY_RSA_HOSTKEYS="-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa"
-fi
-
-STRICT_HOSTKEYS_CHECKING="-o StrictHostKeyChecking=no"
-if [ "${INPUT_STRICT_HOSTKEYS_CHECKING:-false}" = "true" ]; then
-    STRICT_HOSTKEYS_CHECKING="-o UserKnownHostsFile=$HOME/.ssh/known_hosts -o StrictHostKeyChecking=yes"
-
-    key="$(ssh-keyscan -p "$INPUT_REMOTE_PORT" "$INPUT_REMOTE_HOST" 2>/dev/null | sed '/^#/d')" || key=""
-    if [ -n "$key" ]; then
-        # fingerprint verification
-        echo "$key" | ssh-keygen -lf -
-        # add to known hosts
-        echo "$key" | while IFS= read -r line; do hosts-add "$line"; done
-    else
-        echo "Warning: failed to fetch host key for $INPUT_REMOTE_HOST" >&2
-        exit 1
-    fi
-fi
-
-RSH="ssh $STRICT_HOSTKEYS_CHECKING $LEGACY_RSA_HOSTKEYS -p $INPUT_REMOTE_PORT $INPUT_RSH"
-LOCAL_PATH="$GITHUB_WORKSPACE/$INPUT_PATH"
-DSN="$INPUT_REMOTE_USER@$INPUT_REMOTE_HOST"
-
-# Deploy.
-sh -c "rsync $INPUT_SWITCHES -e '$RSH' $LOCAL_PATH $DSN:$INPUT_REMOTE_PATH"
-
-# Clean up.
-source agent-stop "$GITHUB_ACTION"
-source hosts-clear
-
-exit 0

hosts-add

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+echo "$@" >> ~/.ssh/known_hosts
+chmod 0664 ~/.ssh/known_hosts

hosts-clear

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+truncate -s 0 ~/.ssh/known_hosts
+chmod 0664 ~/.ssh/known_hosts

test/entrypoint.bats

@@ -1,128 +0,0 @@
-#!/usr/bin/env bats
-
-setup() {
-    # Create dummy binaries for sourcing
-    echo 'echo "source"' > source
-    echo 'echo "agent started"' > agent-start
-    echo 'echo "key added"' > agent-add
-    chmod +x source agent-start agent-add
-
-    # Create dummy rsync binary to capture its arguments
-    echo 'echo "rsync $@"' > rsync
-    chmod +x rsync
-
-    PATH="$PWD:$PATH"
-}
-
-teardown() {
-    rm -f source agent-start agent-add rsync ssh-keyscan hosts-add
-}
-
-@test "fails if INPUT_REMOTE_PATH is empty" {
-    export INPUT_REMOTE_PATH=" "
-    run ./entrypoint.sh
-    [ "$status" -eq 1 ]
-    [[ "${output}" == *"can not be empty"* ]]
-}
-
-@test "includes legacy RSA switches when allowed" {
-    export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="true"
-    export INPUT_REMOTE_PATH="remote/"
-    export INPUT_REMOTE_KEY="dummy"
-    export INPUT_REMOTE_KEY_PASS="dummy"
-    export GITHUB_ACTION="dummy"
-    export INPUT_SWITCHES="-avz"
-    export INPUT_REMOTE_PORT="22"
-    export INPUT_RSH=""
-    export INPUT_PATH=""
-    export INPUT_REMOTE_USER="user"
-    export INPUT_REMOTE_HOST="localhost.local"
-    export GITHUB_WORKSPACE="/tmp"
-    export DSN="user@localhost.local"
-    export LOCAL_PATH="/tmp/"
-
-    run ./entrypoint.sh
-
-    [[ "${output}" == *"rsync -avz -e ssh -o StrictHostKeyChecking=no -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa -p 22  /tmp/ user@localhost.local:remote/"* ]]
-}
-
-@test "does not include legacy RSA switches when not allowed" {
-    export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="false"
-    export INPUT_REMOTE_PATH="remote/"
-    export INPUT_REMOTE_KEY="dummy"
-    export INPUT_REMOTE_KEY_PASS="dummy"
-    export GITHUB_ACTION="dummy"
-    export INPUT_SWITCHES="-avz"
-    export INPUT_REMOTE_PORT="22"
-    export INPUT_RSH=""
-    export INPUT_PATH=""
-    export INPUT_REMOTE_USER="user"
-    export INPUT_REMOTE_HOST="localhost.local"
-    export GITHUB_WORKSPACE="/tmp"
-    export DSN="user@localhost.local"
-    export LOCAL_PATH="/tmp/"
-
-    run ./entrypoint.sh
-    [[ "${output}" == *"rsync -avz -e ssh -o StrictHostKeyChecking=no  -p 22  /tmp/ user@localhost.local:remote/"* ]]
-}
-
-@test "includes STRICT_HOSTKEYS_CHECKING switches when allowed" {
-    # Set a fake HOME dir
-    local -r HOME="/tmp"
-
-    export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="false"
-    export INPUT_STRICT_HOSTKEYS_CHECKING="true"
-    export INPUT_REMOTE_PATH="remote/"
-    export INPUT_REMOTE_KEY="dummy"
-    export INPUT_REMOTE_KEY_PASS="dummy"
-    export GITHUB_ACTION="dummy"
-    export INPUT_SWITCHES="-avz"
-    export INPUT_REMOTE_PORT="22"
-    export INPUT_RSH=""
-    export INPUT_PATH=""
-    export INPUT_REMOTE_USER="user"
-    export INPUT_REMOTE_HOST="localhost.local"
-    export GITHUB_WORKSPACE="/tmp"
-    export DSN="user@localhost.local"
-    export LOCAL_PATH="/tmp/"
-
-    # Generate a mock key pair to test ssh-keyscan (entrypoint.sh:32)
-    rm -f "$HOME/mockKeyPair" "$HOME/mockKeyPair.pub" \
-    && ssh-keygen -t ed25519 -f "$HOME/mockKeyPair" -N '' -q -C '' \
-    && mockPublicKey=$(< "$HOME/mockKeyPair.pub")
-
-    # Create dummy ssh-keyscan binary to return $mockPublicKey
-    echo "echo 'localhost.local $mockPublicKey #Mock 1'" > ssh-keyscan
-    chmod +x ssh-keyscan
-
-    # Create dummy hosts-add binary to capture its arguments
-    echo 'echo "hosts-add $@"' > hosts-add
-    chmod +x hosts-add
-    
-    run ./entrypoint.sh
-
-    [[ "${output}" == *"hosts-add localhost.local ssh-ed25519"* ]]
-    [[ "${output}" == *"rsync -avz -e ssh -o UserKnownHostsFile=/tmp/.ssh/known_hosts -o StrictHostKeyChecking=yes  -p 22  /tmp/ user@localhost.local:remote/"* ]]
-}
-
-@test "does not includes STRICT_HOSTKEYS_CHECKING switches when not allowed" {
-    export INPUT_LEGACY_ALLOW_RSA_HOSTKEYS="false"
-    export INPUT_STRICT_HOSTKEYS_CHECKING="false"
-    export INPUT_REMOTE_PATH="remote/"
-    export INPUT_REMOTE_KEY="dummy"
-    export INPUT_REMOTE_KEY_PASS="dummy"
-    export GITHUB_ACTION="dummy"
-    export INPUT_SWITCHES="-avz"
-    export INPUT_REMOTE_PORT="22"
-    export INPUT_RSH=""
-    export INPUT_PATH=""
-    export INPUT_REMOTE_USER="user"
-    export INPUT_REMOTE_HOST="localhost.local"
-    export GITHUB_WORKSPACE="/tmp"
-    export DSN="user@localhost.local"
-    export LOCAL_PATH="/tmp/"
-    
-    run ./entrypoint.sh
-
-    [[ "${output}" == *"rsync -avz -e ssh -o StrictHostKeyChecking=no  -p 22  /tmp/ user@localhost.local:remote/"* ]]
-}