Compare commits

...

16 Commits

Author SHA1 Message Date
Burnett01 155b6d6c12 Release/9.0.1 (#107)
* feat: upgrade rsync to 3.5.0-r0

Rsync released version 3.5.0 with a ton of CVE fixes.

https://download.samba.org/pub/rsync/NEWS#3.5.0

- CVE-2026-53802 (HIGH)
- CVE-2026-53803 (HIGH)
- CVE-2026-53785 (HIGH)
- CVE-2026-53784 (HIGH)
- CVE-2026-53793 (HIGH)
- CVE-2026-53795 (HIGH)
- CVE-2026-53796 (MEDIUM)
- CVE-2026-53797 (MEDIUM)
- CVE-2026-53799 (MEDIUM)
- CVE-2026-53800 (MEDIUM)
- CVE-2026-53801 (MEDIUM)
- CVE-2026-53783 (HIGH)
- CVE-2026-53786 (MEDIUM)
- CVE-2026-53798 (MEDIUM)
- CVE-2026-53788 (MEDIUM)
- CVE-2026-53789 (MEDIUM)
- CVE-2026-53791 (CRITICAL)
- CVE-2026-53790 (HIGH)
- CVE-2026-53792 (MEDIUM)
- CVE-2026-53794 (MEDIUM)
- CVE-2026-70461 (HIGH)
- CVE-2026-70458 (HIGH)
- CVE-2026-70456 (HIGH)
- CVE-2026-70457 (MEDIUM)
- CVE-2026-70459 (MEDIUM)
- CVE-2026-70464 (HIGH)
- CVE-2026-70455 (HIGH)
- CVE-2026-70453 (HIGH)
- CVE-2026-70452 (HIGH)
- CVE-2026-70463 (HIGH)
- CVE-2026-70460 (HIGH)
- CVE-2026-70462 (MEDIUM)
- CVE-2026-70454 (MEDIUM

* chore: update supported version from 9.0.0 to 9.0.1

* chore: Update README with new rsync and version information
2026-09-04 19:46:02 +02:00
Burnett01 4d419d1dc4 Release/9.0.0 (v9) (#105)
* feat: Upgrade Alpine base image to version 3.24.1

* chore: Update supported versions and their statuses

* chore: Update README with new versions and action updates

Updated the README to reflect changes in Alpine and Rsync versions, and updated the action versions from v8 to v9.

* chore: Update Alpine version in README.md
2026-06-22 22:35:49 +02:00
dependabot[bot] 32988e12ed chore(deps): bump actions/checkout from 4 to 7 (#104)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v4...v7)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 22:15:50 +02:00
Burnett01 003130719f chore: Add GitHub Actions to Dependabot configuration 2026-06-22 21:46:51 +02:00
Burnett01 0467ec3563 chore!: EOL of version 7.0.2 and 7.1.0 (#102)
* chore: EOL of version 7.0.2 and 7.1.0
2026-06-01 13:37:22 +02:00
Burnett01 66257cad6b Release/8.0.5 (#101)
* feat: Update base image to Alpine 3.23.4

Alpine 3.23.4 fixes the following:

musl
CVE-2026-6042
CVE-2026-40200

openssl
CVE-2026-31790
CVE-2026-28387
CVE-2026-28388
CVE-2026-28389
CVE-2026-28390
CVE-2026-31789

* chore: Update supported versions in SECURITY.md

* chore: Update README for Alpine and version changes

* chore: Update copyright years in LICENSE file

Updated copyright years for Joshua Piper and Burnett01.
2026-04-17 18:50:35 +02:00
Steven 27212fc826 chore(readme): Version upgrade to 8.0.4 2026-02-04 20:48:49 +01:00
Steven dc0d5d44c4 Release/8.0.4 (#100)
* chore(deps): bump alpine from 3.23.2 to 3.23.3 (#99)

Bumps alpine from 3.23.2 to 3.23.3.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: 3.23.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* feat(action): Version 8.0.4 (alpine upgrade 3.23.3)

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-04 20:38:53 +01:00
Steven cccc35d762 chore(action): update description to match modern facts 2026-01-15 23:15:06 +01:00
Steven 2ad5f95a8a chore(funding): create funding yaml 2026-01-15 23:12:32 +01:00
Steven 115573f97b chore(readme): mention deprecation of 7.0.2 too 2026-01-15 22:59:55 +01:00
Steven 7659d600d8 feat(release): 8.0.3 (v8) - bump alpine from 3.23.0 to 3.23.2 (#97) (#98)
* chore(deps): bump alpine from 3.23.0 to 3.23.2

Bumps alpine from 3.23.0 to 3.23.2.

---
updated-dependencies:
- dependency-name: alpine
  dependency-version: 3.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...



* chore(docs): update Alpine version to 3.23.2 in README and SECURITY files

* chore(docs): update current version to 8.0.3 in README

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-02 21:55:43 +01:00
Steven 81be6cf6d7 chore: add deprecation notice, move release channels to top 2025-12-09 21:22:31 +01:00
Steven 178d2ea600 chore: deprecation notice 2025-12-09 14:45:28 +01:00
Steven 241aa321a8 chore: add support cycles 2025-12-07 14:02:36 +01:00
Steven 80e4fa792e chore: update readme
- advise users to always use secrets
- simplified examples
- other adjustments
2025-12-07 13:51:46 +01:00
9 changed files with 143 additions and 89 deletions
+1
View File
@@ -0,0 +1 @@
github: [burnett01]
+4
View File
@@ -4,3 +4,7 @@ updates:
directory: /
schedule:
interval: monthly
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
@@ -23,7 +23,7 @@ jobs:
name: Test BATS Suite
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
- name: Install BATS
run: |
@@ -38,7 +38,7 @@ jobs:
name: Validate Action Definition
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
- name: Validate action.yml
run: |
@@ -81,7 +81,7 @@ jobs:
needs: [validate-action, action-structure]
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
- name: Build Docker image
run: |
@@ -94,7 +94,7 @@ jobs:
name: Validate Action Structure
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
- name: Check required files
run: |
@@ -128,7 +128,7 @@ jobs:
name: Lint Shell Scripts
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
- name: Install ShellCheck
run: |
@@ -151,7 +151,7 @@ jobs:
needs: [test, validate-action, docker-build, action-structure, lint-shell]
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7
- name: Final integration check
run: |
@@ -19,7 +19,7 @@ jobs:
actions: read
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/checkout@v7
- name: Build a Docker image
run: docker build -t burnett01/rsync-deployments .
- name: Run Snyk to check Docker image for vulnerabilities
+2 -2
View File
@@ -1,6 +1,6 @@
FROM alpine:3.23.0@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375 AS base
FROM alpine:3.24.1@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b AS base
RUN apk update && apk add --no-cache --upgrade rsync openssh openssl busybox
RUN apk update && apk add --no-cache --upgrade 'rsync>=3.5.0-r0' openssh openssl busybox
RUN rm -rf /var/cache/apk/*
+2 -2
View File
@@ -1,8 +1,8 @@
MIT License
Copyright (c) 2019-2022 Contention
Copyright (c) 2019-2025 Joshua Piper (Dr Internet)
Copyright (c) 2019-2025 Burnett01
Copyright (c) 2019-2026 Joshua Piper (Dr Internet)
Copyright (c) 2019-2026 Burnett01
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
+106 -62
View File
@@ -10,13 +10,50 @@ This cross-platform GitHub Action deploys files in [`path`](#inputs) (relative t
Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`, such [actions/checkout](https://github.com/actions/checkout).
The base-image of this action is very small and based on **Alpine 3.23.0** (no cache) which results in fast deployments.
The base-image of this action is very small and based on **Alpine 3.24.1** (no cache) which results in fast deployments.
Alpine version: [3.23.0](https://www.alpinelinux.org/posts/Alpine-3.23.0-released.html)
Rsync version: [3.4.1-r1](https://download.samba.org/pub/rsync/NEWS#3.4.1)
Alpine version: [3.24.1](https://www.alpinelinux.org/posts/Alpine-3.24.1-released.html)
Rsync version: [3.5.0-r0](https://download.samba.org/pub/rsync/NEWS#3.5.0)
## Current Version: v9 (9.0.1)
### Release channels:
| Version | Purpose | Immutable |
| ------- | ------------------ | ------------------ |
| ``v9`` (recommended, LTS) | latest MAJOR (pointer to 9.MINOR.PATCH) | no |
| 9.0.1 | latest MAJOR+MINOR+PATCH | yes |
| ``v8`` (ESU) | previous MAJOR (pointer to 8.MINOR.PATCH) | no |
| 8.0.5 | previous MAJOR+MINOR+PATCH | yes |
Check [SECURITY.md](SECURITY.md) for support cycles.
---
## How it works
```yml
name: DEPLOY
on:
push:
branches:
- master
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- name: rsync deployments
uses: burnett01/rsync-deployments@v9
with:
switches: -avzr --delete
path: src/
remote_path: ${{ secrets.REMOTE_PATH }} # ex: /var/www/html/
remote_host: ${{ secrets.REMOTE_HOST }} # ex: example.com
remote_port: ${{ secrets.REMOTE_PORT }} # ex: 22
remote_user: ${{ secrets.REMOTE_USER }} # ex: ubuntu
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
```
## Inputs
- `debug`* - Whether to enable debug output. ("true" / "false") - Default: "false"
@@ -53,20 +90,10 @@ This action needs secret variables for the ssh private key of your key pair. The
For simplicity, we are using `REMOTE_*` as the secret variables throughout the examples.
## Current Version: v8 (8.0.2)
### Release channels:
| Version | Purpose | Immutable |
| ------- | ------------------ | ------------------ |
| ``v8`` | latest release (pointer to 8.x.x) | no, points to latest MINOR,PATCH |
| 8.0.2 | latest major release | yes |
| 7.1.0 | previous release | yes |
Check [SECURITY.md](SECURITY.md) for support cycles.
## Example usage
For better **security** always use secrets for remote_host, remote_port, remote_user and remote_path inputs.
Simple:
```yml
@@ -80,55 +107,36 @@ jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: rsync deployments
uses: burnett01/rsync-deployments@v8
uses: burnett01/rsync-deployments@v9
with:
switches: -avzr --delete
path: src/
remote_path: /var/www/html/
remote_host: example.com
remote_user: debian
remote_path: ${{ secrets.REMOTE_PATH }} # ex: /var/www/html/
remote_host: ${{ secrets.REMOTE_HOST }} # ex: example.com
remote_port: ${{ secrets.REMOTE_PORT }} # ex: 22
remote_user: ${{ secrets.REMOTE_USER }} # ex: ubuntu
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
```
Advanced:
Advanced (with filters etc):
```yml
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: rsync deployments
uses: burnett01/rsync-deployments@v8
uses: burnett01/rsync-deployments@v9
with:
switches: -avzr --delete --exclude="" --include="" --filter=""
path: src/
remote_path: /var/www/html/
remote_host: example.com
remote_port: 5555
remote_user: debian
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
```
For better **security**, I suggest you create additional secrets for remote_host, remote_port, remote_user and remote_path inputs.
```yml
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: rsync deployments
uses: burnett01/rsync-deployments@v8
with:
switches: -avzr --delete
path: src/
remote_path: ${{ secrets.REMOTE_PATH }}
remote_host: ${{ secrets.REMOTE_HOST }}
remote_port: ${{ secrets.REMOTE_PORT }}
remote_user: ${{ secrets.REMOTE_USER }}
remote_path: ${{ secrets.REMOTE_PATH }} # ex: /var/www/html/
remote_host: ${{ secrets.REMOTE_HOST }} # ex: example.com
remote_port: ${{ secrets.REMOTE_PORT }} # ex: 22
remote_user: ${{ secrets.REMOTE_USER }} # ex: ubuntu
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
```
@@ -139,16 +147,16 @@ jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: rsync deployments
uses: burnett01/rsync-deployments@v8
uses: burnett01/rsync-deployments@v9
with:
switches: -avzr --delete
path: src/
remote_path: ${{ secrets.REMOTE_PATH }}
remote_host: ${{ secrets.REMOTE_HOST }}
remote_port: ${{ secrets.REMOTE_PORT }}
remote_user: ${{ secrets.REMOTE_USER }}
remote_path: ${{ secrets.REMOTE_PATH }} # ex: /var/www/html/
remote_host: ${{ secrets.REMOTE_HOST }} # ex: example.com
remote_port: ${{ secrets.REMOTE_PORT }} # ex: 22
remote_user: ${{ secrets.REMOTE_USER }} # ex: ubuntu
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
remote_key_pass: ${{ secrets.REMOTE_PRIVATE_KEY_PASS }}
```
@@ -165,17 +173,17 @@ jobs:
deploy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: rsync deployments
uses: burnett01/rsync-deployments@v8
uses: burnett01/rsync-deployments@v9
with:
switches: -avzr --delete
legacy_allow_rsa_hostkeys: "true"
path: src/
remote_path: ${{ secrets.REMOTE_PATH }}
remote_host: ${{ secrets.REMOTE_HOST }}
remote_port: ${{ secrets.REMOTE_PORT }}
remote_user: ${{ secrets.REMOTE_USER }}
remote_path: ${{ secrets.REMOTE_PATH }} # ex: /var/www/html/
remote_host: ${{ secrets.REMOTE_HOST }} # ex: example.com
remote_port: ${{ secrets.REMOTE_PORT }} # ex: 22
remote_user: ${{ secrets.REMOTE_USER }} # ex: ubuntu
remote_key: ${{ secrets.REMOTE_PRIVATE_KEY }}
```
@@ -277,20 +285,56 @@ sudo apk add rsync
## Versions
## Version 9.0.0
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/9.0.0 (alpine 3.24.1)
## Version 8.0.5
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.5 (alpine 3.23.4)
## Version 8.0.4
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.4 (alpine 3.23.3)
## Version 8.0.3
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.3 (alpine 3.23.2)
## Version 8.0.2
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.2 (alpine 3.23.0)
## Version 8.0.1 (EOL)
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.1 (alpine 3.23.0)
## Version 8.0.0 (EOL due to regression -> fixed via 8.0.1 & 8.0.2)
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/8.0.0 (alpine 3.23.0)
## Version 7.1.0
## Version 7.1.0 (EOL)
Check here:
- https://github.com/Burnett01/rsync-deployments/tree/7.1.0 (alpine 3.22.1)
## Version 7.0.2 (DEPRECATED)
## Version 7.0.2 (EOL)
Check here:
@@ -364,7 +408,7 @@ Please note that version 1.0 has reached end of life state.
## Acknowledgements
+ This project is a fork of [Contention/rsync-deployments](https://github.com/Contention/rsync-deployments)
+ Base image [JoshPiper/rsync-docker](https://github.com/JoshPiper/rsync-docker)
+ docker-rsync [JoshPiper/rsync-docker](https://github.com/JoshPiper/rsync-docker)
---
+20 -15
View File
@@ -6,21 +6,26 @@ The Docker image and code quality are regularly checked for vulnerabilities and
The following versions are currently being supported with security updates:
| Version | Supported | Rsync version | Alpine version |
| ------- | ------------------ | ------------------ | ------------------ |
| 8.0.2 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
| 8.0.1 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 |
| 8.0.0 | :x: EOL (due to regression #90) | >= 3.4.1-r1 | 3.23.0 |
| 7.1.0 | :white_check_mark: | >= 3.4.1-r0 | 3.22.1 |
| 7.0.2 | :warning: DEPRECATED | >= 3.4.0-r0 | 3.22.1 |
| 7.0.1 | :x: EOL | < 3.4.0 | 3.22.1 |
| 7.0.0 | :x: EOL | < 3.4.0| 3.19.1 |
| 6.x | :x: EOL |< 3.4.0| 3.17.2 |
| 5.x | :x: EOL |< 3.4.0| 3.11 - 3.14.1 - 3.15 - 3.16 - 3.17.2 |
| 4.x | :x: EOL |< 3.4.0| 3.11 |
| 3.0 | :x: EOL |< 3.4.0| N/A |
| 2.0 | :x: EOL |< 3.4.0| Ubuntu |
| 1.0 | :x: EOL |< 3.4.0| Ubuntu |
| Version | Supported | Rsync version | Alpine version | Support Until |
| ------- | ------------------ | ------------------ | ------------------ | ------------------ |
| (``v9``) 9.0.1 | :white_check_mark: | >= 3.5.0-r0 | 3.24.1 | LTS (2028-*) |
| 9.0.0 | :white_check_mark: | >= 3.4.3-r1 | 3.24.1 | LTS (2028-*) |
| (``v8``) 8.0.5 | :white_check_mark: | >= 3.4.1-r1 | 3.23.4 | ESU (Apr, 1st 2027) |
| 8.0.4 | :white_check_mark: | >= 3.4.1-r1 | 3.23.3 | Dec, 6th 2026 |
| 8.0.3 | :white_check_mark: | >= 3.4.1-r1 | 3.23.2 | Dec, 6th 2026 |
| 8.0.2 | :white_check_mark: | >= 3.4.1-r1 | 3.23.0 | Dec, 6th 2026 |
| 8.0.1 | :x: EOL | >= 3.4.1-r1 | 3.23.0 | † Apr, 1st 2026 |
| 8.0.0 | :x: EOL (due to regression #90) | >= 3.4.1-r1 | 3.23.0 | † Dec, 6th 2025 |
| 7.1.0 | :x: EOL | >= 3.4.1-r0 | 3.22.1 | † June, 1st 2026 ([deprecation notice](https://github.com/Burnett01/rsync-deployments/discussions/96)) |
| 7.0.2 | :x: EOL | >= 3.4.0-r0 | 3.22.1 | † June, 1st 2026 ([deprecation notice](https://github.com/Burnett01/rsync-deployments/discussions/96)) |
| 7.0.1 | :x: EOL | < 3.4.0 | 3.22.1 | † Dec, 6th 2025 |
| 7.0.0 | :x: EOL | < 3.4.0| 3.19.1 | † Dec, 6th 2025 |
| 6.x | :x: EOL |< 3.4.0| 3.17.2 | † 2024 |
| 5.x | :x: EOL |< 3.4.0| 3.11 - 3.14.1 - 3.15 - 3.16 - 3.17.2 | † 2024 |
| 4.x | :x: EOL |< 3.4.0| 3.11 | † |
| 3.0 | :x: EOL |< 3.4.0| N/A | † |
| 2.0 | :x: EOL |< 3.4.0| Ubuntu | † |
| 1.0 | :x: EOL |< 3.4.0| Ubuntu | † |
### Terminology
+1 -1
View File
@@ -1,5 +1,5 @@
name: 'Rsync Deployments Action'
description: 'GitHub Action for deploying code via rsync over ssh'
description: 'GitHub Action for deploying code via rsync over ssh securely - used by 5k+ workflows!'
author: 'Burnett01'
inputs:
switches: