mirror of
https://github.com/Burnett01/rsync-deployments.git
synced 2025-12-07 00:22:20 +01:00
05a269aeea
* feat: latest Alpine 3.23.0 * feat: latest Rsync 3.4.1-r1 * feat: integrate [rsync-docker](https://github.com/JoshPiper/rsync-docker/) 3rd party into this action as 1st party code (no more dependency, better audit, single source of truth) - backported: - agent-start - agent-stop - agent-askpass - agent-add - hosts-add - hosts-clear - new added: - ssh-init - hosts-init - improved: - stricter permissions on .ssh/ folder (700) and known_hosts (600) - use set -eu in all scipts * feat: new ``strict_host_keys`` option to enable support for strict host key verification. Default: false (to keep backward compatibility) * feat: new ``debug`` option to see the commands executed (-x) by this action * feat: this action is now scanned for vulnerabilities by Snyk * feat; this action is now scanned by CodeQL for Q/A * feat: this action now performs CI tasks such as Validation, Linting and Unit Tests * fix: various shell syntax for robustness * fix: use printf and redirect output to non-stdout instead of echo in sensitive code locations * refactor: use $HOME instead of tilde ~ for robustness * feat: cross-platform support * chore: Deprecate 7.0.2 * chore: EOL 7.0.0 & 7.0.1
55 lines
1.6 KiB
Bash
Executable file
55 lines
1.6 KiB
Bash
Executable file
#!/bin/sh
|
|
|
|
set -eu
|
|
|
|
if [ "${INPUT_DEBUG:-false}" = "true" ]; then
|
|
set -x
|
|
fi
|
|
|
|
if [ -z "$(echo "$INPUT_REMOTE_PATH" | awk '{$1=$1};1')" ]; then
|
|
echo "The remote_path can not be empty. see: github.com/Burnett01/rsync-deployments/issues/44"
|
|
exit 1
|
|
fi
|
|
|
|
# Initialize SSH and known hosts.
|
|
source ssh-init
|
|
source hosts-init
|
|
|
|
# Start the SSH agent and load key.
|
|
source agent-start "$GITHUB_ACTION"
|
|
printf '%s' "$INPUT_REMOTE_KEY" | SSH_PASS="${INPUT_REMOTE_KEY_PASS}" agent-add >/dev/null 2>&1
|
|
|
|
# Variables.
|
|
LEGACY_RSA_HOSTKEYS=""
|
|
if [ "${INPUT_LEGACY_ALLOW_RSA_HOSTKEYS:-false}" = "true" ]; then
|
|
LEGACY_RSA_HOSTKEYS="-o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedKeyTypes=+ssh-rsa"
|
|
fi
|
|
|
|
STRICT_HOSTKEYS_CHECKING="-o StrictHostKeyChecking=no"
|
|
if [ "${INPUT_STRICT_HOSTKEYS_CHECKING:-false}" = "true" ]; then
|
|
STRICT_HOSTKEYS_CHECKING="-o UserKnownHostsFile=$HOME/.ssh/known_hosts -o StrictHostKeyChecking=yes"
|
|
|
|
key="$(ssh-keyscan -p "$INPUT_REMOTE_PORT" "$INPUT_REMOTE_HOST" 2>/dev/null | sed '/^#/d')" || key=""
|
|
if [ -n "$key" ]; then
|
|
# fingerprint verification
|
|
echo "$key" | ssh-keygen -lf -
|
|
# add to known hosts
|
|
echo "$key" | while IFS= read -r line; do hosts-add "$line"; done
|
|
else
|
|
echo "Warning: failed to fetch host key for $INPUT_REMOTE_HOST" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
RSH="ssh $STRICT_HOSTKEYS_CHECKING $LEGACY_RSA_HOSTKEYS -p $INPUT_REMOTE_PORT $INPUT_RSH"
|
|
LOCAL_PATH="$GITHUB_WORKSPACE/$INPUT_PATH"
|
|
DSN="$INPUT_REMOTE_USER@$INPUT_REMOTE_HOST"
|
|
|
|
# Deploy.
|
|
sh -c "rsync $INPUT_SWITCHES -e '$RSH' $LOCAL_PATH $DSN:$INPUT_REMOTE_PATH"
|
|
|
|
# Clean up.
|
|
source agent-stop "$GITHUB_ACTION"
|
|
source hosts-clear
|
|
|
|
exit 0
|