From 9c19e7ec30ce0d5f62884a341f416be774892ee9 Mon Sep 17 00:00:00 2001 From: Dawid Dziurla Date: Thu, 11 Feb 2021 17:08:44 +0100 Subject: [PATCH 1/8] test/playbook: install cowsay via apt --- test/playbook.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/test/playbook.yml b/test/playbook.yml index aaae8f5..b0f0656 100644 --- a/test/playbook.yml +++ b/test/playbook.yml @@ -1,7 +1,8 @@ - name: Test Action hosts: all tasks: - - name: Copy action.yml - copy: - src: ../action.yml - dest: /tmp/action.yml + - name: Install cowsay + become: yes + apt: + name: cowsay + update_cache: yes From 0d7274dc6acf48414154d3ece2458392f3390818 Mon Sep 17 00:00:00 2001 From: Dawid Dziurla Date: Thu, 11 Feb 2021 17:24:38 +0100 Subject: [PATCH 2/8] workflows: refactor --- .github/workflows/test.yml | 94 +++++++++++++++++++++++++------------- 1 file changed, 61 insertions(+), 33 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 41d4655..46bf5e2 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -7,14 +7,56 @@ on: pull_request: jobs: - test-remote: + remote: runs-on: ubuntu-latest + env: + SSH_PRIVATE_KEY: | + -----BEGIN OPENSSH PRIVATE KEY----- + b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn + NhAAAAAwEAAQAAAYEAw1mPRVbmzA1LGWbk9rk9lNxC34M7ZlCHi/OAgglMtFfP6f95hoNA + mSggomlTgQNysk1/kTfhVuIvVDVroTV6iyxM6b0eBOwSMglZn60PPZCXzF+VstfrMUH5Vd + PbuahVTW453g1ZAhwA+EPDBMEp2VzzbZgX7dCO0WnYrIrXknfiJ+sNYErVm9WqY58a7aoi + Y4eCgRD/9FGMyGoQcrmuHPR6tKCN0zIoVKl/wjzWH2jRUhRbZbf7V72VN+lWwJyciH7V+S + l4YZiob/JmW0FIPcWckoO1+hLUAQ0LpSaoCyz7ua+G0wgRoeLH3c32yQVjAHFesYzQymhn + /KVZBRPfdI2Hjzqj+cnYvyfy0t3R8/K6rdutRSYaQoqfFaFxoWtl59B/v5/IEE7s0Zsy2B + 5ZJ4SbdYs1lA74UUGn+XjXVor7TTxvDWBV83npHFGBOhn3gqSLRcZ8JLb7KY5CGhbpy3z7 + y5JDY0lYiZaWXTUQmIOfX54csTu40+yCnlCjRHaDAAAFiAuND90LjQ/dAAAAB3NzaC1yc2 + EAAAGBAMNZj0VW5swNSxlm5Pa5PZTcQt+DO2ZQh4vzgIIJTLRXz+n/eYaDQJkoIKJpU4ED + crJNf5E34VbiL1Q1a6E1eossTOm9HgTsEjIJWZ+tDz2Ql8xflbLX6zFB+VXT27moVU1uOd + 4NWQIcAPhDwwTBKdlc822YF+3QjtFp2KyK15J34ifrDWBK1ZvVqmOfGu2qImOHgoEQ//RR + jMhqEHK5rhz0erSgjdMyKFSpf8I81h9o0VIUW2W3+1e9lTfpVsCcnIh+1fkpeGGYqG/yZl + tBSD3FnJKDtfoS1AENC6UmqAss+7mvhtMIEaHix93N9skFYwBxXrGM0MpoZ/ylWQUT33SN + h486o/nJ2L8n8tLd0fPyuq3brUUmGkKKnxWhcaFrZefQf7+fyBBO7NGbMtgeWSeEm3WLNZ + QO+FFBp/l411aK+008bw1gVfN56RxRgToZ94Kki0XGfCS2+ymOQhoW6ct8+8uSQ2NJWImW + ll01EJiDn1+eHLE7uNPsgp5Qo0R2gwAAAAMBAAEAAAGBAJixNlWCmaBBe8P9M1bOcB4dFI + BUuWc95tUzne0Gi9gjEzbaJAlKKoIMZYXNQiIDqfFItj+yKAabgVcW8mvtuz1xgSTqV76N + L6PAvzcaNGFw1dY/mGlUcFfuM5AsqwCxXQvK7pxsXnhRn0hu3s6mlal7CCNP0NRoQlnZnC + 0x0VKBNlrxVWFA3TqThj2cLZY7d+nID/AGc6pq29oDXZvvGvMy/X6WSIUeHXwfiOcwWkXu + zj6T/uTBLErmuu4bC14+ipTv5JbdjiKW6Ob/uM8mBY9V1T+XJxYXVuICNHAiydFj73mnwo + RrtVx53w0/bt4FWtkzaN564DPHBm6GD4uIby+GRv600IzCQlYiz0RYPlQzaIbe5ut9rbQ/ + lCrdkP0kuuO9SNcu9XuuTxetz9HfXprJaWwZbDXx/zUFNE9Q/d2X3N3NTWxNNVW6a4MxVx + 856rvds+z0s4pu7SJXEPy7qMwLPqMZak7JALSmllaQ/FOSOCsEs0Mlfn+dsEVAlmVDwQAA + AMEA2jU9wUprSajSEf44kKuWk5amcdW4r7R09ZU5g6RWJEcIzfyeMdkab/3zm6/yWthZsT + TYFJlA/DINhclwMFY4W1K4hvedsbFy7RV55W21Mcv1e0Df1RHtV6+C8GFKCu1nXQY0wg5R + MvCet49Raqqg5OfMn0a2iGLSvNATUhI4PDUiHj5U4q6r6v5/XOs6+12lCExMaq1F+8TB/r + ClnveBFFUKByahd/0MeKqWnvHvsm25EOu7IuNbQ5+MgaNS5ugQAAAAwQD1BaD/r4rUhz8Z + bJzuqMJ+5c5BdS8m+I5yEYtXWM9LE4y1KuKZxl9kdWlC/YoceVh7cmhr2l0WWELLWpQUu0 + qx9Pd4PDU3FIyBw9hrNAa+FVQmFMHPh69bXtC7c9yPqA8aUXwUCUAJaXBbTb8DmZsy79LG + ysdl5xbELZlcW0cCv1RLeorxdQGjqtLTOf6aHqtqQmNIwEm07rJzU2TVMQVnlQ2Dqnfp8X + qzShem8cdVWud5OJiC8ddZFJTVkZkpsjEAAADBAMwaMpJq+wNz4k6X8EUm056IoJUuHgL5 + 5z1bwpQcvKI+6QmoytK6QZD1aa77Qx4rEOS8bOmdeB4sTMjh88HR2x1XsXU8qi66sxh5Wv + dkiRyb5m8cxvdMywZJ9WuSD9+cI4lR5PQaKUMJdDyB42pBrHansXoS/zW1/j3Oecv0h1lV + hSK/8idmd/gOAkcRj8uf0FvyaftILlfSeyPQM60fMgW2rrEDBiIZ2cA7yduoQB08T0lzsA + 8uPJFry1jRnJ7y8wAAAA5kYXdpZGQ2QFN1bGFjbwECAw== + -----END OPENSSH PRIVATE KEY----- + SSH_PUBLIC_KEY: | + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDDWY9FVubMDUsZZuT2uT2U3ELfgztmUIeL84CCCUy0V8/p/3mGg0CZKCCiaVOBA3KyTX+RN+FW4i9UNWuhNXqLLEzpvR4E7BIyCVmfrQ89kJfMX5Wy1+sxQflV09u5qFVNbjneDVkCHAD4Q8MEwSnZXPNtmBft0I7RadisiteSd+In6w1gStWb1apjnxrtqiJjh4KBEP/0UYzIahByua4c9Hq0oI3TMihUqX/CPNYfaNFSFFtlt/tXvZU36VbAnJyIftX5KXhhmKhv8mZbQUg9xZySg7X6EtQBDQulJqgLLPu5r4bTCBGh4sfdzfbJBWMAcV6xjNDKaGf8pVkFE990jYePOqP5ydi/J/LS3dHz8rqt261FJhpCip8VoXGha2Xn0H+/n8gQTuzRmzLYHlknhJt1izWUDvhRQaf5eNdWivtNPG8NYFXzeekcUYE6GfeCpItFxnwktvspjkIaFunLfPvLkkNjSViJlpZdNRCYg59fnhyxO7jT7IKeUKNEdoM= steps: - name: Checkout code uses: actions/checkout@v2 - name: Setup remote run: | - echo "${{secrets.SSH_PUBLIC_KEY}}" | sudo tee /etc/ssh/authorized_keys + echo "$SSH_PUBLIC_KEY" | sudo tee /etc/ssh/authorized_keys sudo tee /etc/ssh/sshd_config < Date: Thu, 11 Feb 2021 17:28:23 +0100 Subject: [PATCH 3/8] workflows: always run in test/ dir --- .github/workflows/test.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 46bf5e2..db8c0c3 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -88,27 +88,24 @@ jobs: steps: - name: Checkout code uses: actions/checkout@v2 - - name: With directory - uses: ./ - with: - playbook: playbook.yml - directory: test - options: --inventory hosts - name: With requirements uses: ./ with: playbook: playbook.yml + directory: test requirements: requirements.yml options: --inventory hosts - name: With requirements bundle uses: ./ with: playbook: playbook.yml + directory: test requirements: requirements-bundle.yml options: --inventory hosts - name: With vault password uses: ./ with: playbook: playbook.yml + directory: test vault_password: test options: --inventory hosts From 1b347b1afeb9f964893d7a72fa3a5f7b68a3c68d Mon Sep 17 00:00:00 2001 From: Dawid Dziurla Date: Thu, 11 Feb 2021 17:28:46 +0100 Subject: [PATCH 4/8] put test stuff intooo... test/ dir --- playbook.yml | 7 ------- hosts => test/hosts | 0 test/playbook.yml | 4 ++++ requirements-bundle.yml => test/requirements-bundle.yml | 0 requirements.yml => test/requirements.yml | 0 5 files changed, 4 insertions(+), 7 deletions(-) delete mode 100644 playbook.yml rename hosts => test/hosts (100%) rename requirements-bundle.yml => test/requirements-bundle.yml (100%) rename requirements.yml => test/requirements.yml (100%) diff --git a/playbook.yml b/playbook.yml deleted file mode 100644 index fa20c3e..0000000 --- a/playbook.yml +++ /dev/null @@ -1,7 +0,0 @@ -- name: Test Action - hosts: all - tasks: - - name: Copy action.yml - copy: - src: action.yml - dest: /tmp/action.yml \ No newline at end of file diff --git a/hosts b/test/hosts similarity index 100% rename from hosts rename to test/hosts diff --git a/test/playbook.yml b/test/playbook.yml index b0f0656..a199a27 100644 --- a/test/playbook.yml +++ b/test/playbook.yml @@ -1,6 +1,10 @@ - name: Test Action hosts: all tasks: + - name: Copy file + copy: + src: requirements.yml + dest: /tmp/requirements.yml - name: Install cowsay become: yes apt: diff --git a/requirements-bundle.yml b/test/requirements-bundle.yml similarity index 100% rename from requirements-bundle.yml rename to test/requirements-bundle.yml diff --git a/requirements.yml b/test/requirements.yml similarity index 100% rename from requirements.yml rename to test/requirements.yml From 16c5208cd3fd927d42895b1fcfb68738c33ab63d Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Mon, 15 Mar 2021 04:43:20 +0000 Subject: [PATCH 5/8] build(deps): bump yaml from 1.10.0 to 1.10.2 Bumps [yaml](https://github.com/eemeli/yaml) from 1.10.0 to 1.10.2. - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](https://github.com/eemeli/yaml/compare/v1.10.0...v1.10.2) Signed-off-by: dependabot-preview[bot] --- package-lock.json | 14 +++++++------- package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 008542a..c2687f6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -7,7 +7,7 @@ "dependencies": { "@actions/core": "^1.2.6", "@actions/exec": "^1.0.4", - "yaml": "^1.10.0" + "yaml": "^1.10.2" } }, "node_modules/@actions/core": { @@ -29,9 +29,9 @@ "integrity": "sha512-J8KuFqVPr3p6U8W93DOXlXW6zFvrQAJANdS+vw0YhusLIq+bszW8zmK2Fh1C2kDPX8FMvwIl1OUcFgvJoXLbAg==" }, "node_modules/yaml": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.0.tgz", - "integrity": "sha512-yr2icI4glYaNG+KWONODapy2/jDdMSDnrONSjblABjD9B4Z5LgiircSt8m8sRZFNi08kG9Sm0uSHtEmP3zaEGg==", + "version": "1.10.2", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz", + "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==", "engines": { "node": ">= 6" } @@ -57,9 +57,9 @@ "integrity": "sha512-J8KuFqVPr3p6U8W93DOXlXW6zFvrQAJANdS+vw0YhusLIq+bszW8zmK2Fh1C2kDPX8FMvwIl1OUcFgvJoXLbAg==" }, "yaml": { - "version": "1.10.0", - "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.0.tgz", - "integrity": "sha512-yr2icI4glYaNG+KWONODapy2/jDdMSDnrONSjblABjD9B4Z5LgiircSt8m8sRZFNi08kG9Sm0uSHtEmP3zaEGg==" + "version": "1.10.2", + "resolved": "https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz", + "integrity": "sha512-r3vXyErRCYJ7wg28yvBY5VSoAF8ZvlcW9/BwUzEtUsjvX/DKs24dIkuwjtuprwJJHsbyUbLApepYTR1BN4uHrg==" } } } diff --git a/package.json b/package.json index 1851331..8a067b7 100644 --- a/package.json +++ b/package.json @@ -4,6 +4,6 @@ "dependencies": { "@actions/core": "^1.2.6", "@actions/exec": "^1.0.4", - "yaml": "^1.10.0" + "yaml": "^1.10.2" } } From d45b74f42d9508b4b5f02c38abd342d708bfba5e Mon Sep 17 00:00:00 2001 From: Scott Rubin Date: Sun, 4 Apr 2021 14:51:37 -0400 Subject: [PATCH 6/8] Add support for SSH Host Key Checking By default it seems that SSH host key checking has been disabled. This patch makes it optional. If a variable named known_hosts is passed in, the key checking will be enabled. The variable should contain the complete contents of the known_hosts file, which must contain the public key(s) of the host(s) in the inventory. --- .github/workflows/test.yml | 4 ++++ action.yml | 3 +++ main.js | 22 ++++++++++++++++++++-- post.js | 5 +++++ 4 files changed, 32 insertions(+), 2 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index db8c0c3..60037a6 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -65,11 +65,15 @@ jobs: Subsystem sftp /usr/lib/openssh/sftp-server EOF sudo systemctl restart sshd + echo 'SSH_KNOWN_HOSTS<> $GITHUB_ENV + echo $(ssh-keyscan localhost) >> $GITHUB_ENV + echo 'EOF' >> $GITHUB_ENV - name: With everything uses: ./ with: playbook: playbook.yml key: ${{env.SSH_PRIVATE_KEY}} + known_hosts: ${{env.SSH_KNOWN_HOSTS}} directory: test vault_password: test requirements: requirements.yml diff --git a/action.yml b/action.yml index 9a95cb0..9766694 100644 --- a/action.yml +++ b/action.yml @@ -22,6 +22,9 @@ inputs: vault_password: description: The password used for decrypting vaulted files required: false + known_hosts: + description: Contents of SSH known_hosts file + required: false options: description: Extra options that should be passed to ansible-playbook command required: false diff --git a/main.js b/main.js index c17356c..1789e5e 100644 --- a/main.js +++ b/main.js @@ -12,6 +12,7 @@ async function main() { const key = core.getInput("key") const inventory = core.getInput("inventory") const vaultPassword = core.getInput("vault_password") + const knownHosts = core.getInput("known_hosts") const options = core.getInput("options") let cmd = ["ansible-playbook", playbook] @@ -63,10 +64,27 @@ async function main() { cmd.push(vaultPasswordFile) } - process.env.ANSIBLE_HOST_KEY_CHECKING = "False" + if (knownHosts) { + const knownHostsFile = ".ansible_known_hosts" + fs.writeFileSync(knownHostsFile, knownHosts, { mode: 0600 }) + core.saveState("knownHostsFile", knownHostsFile) + let known_hosts_param = [ + "--ssh-common-args=", + "\"", + "-o UserKnownHostsFile=", + knownHostsFile, + "\"" + ].join('') + cmd.push(known_hosts_param) + process.env.ANSIBLE_HOST_KEY_CHECKING = "True" + } else { + process.env.ANSIBLE_HOST_KEY_CHECKING = "False" + } + process.env.ANSIBLE_FORCE_COLOR = "True" - await exec.exec(cmd.join(" ")) + await exec.exec(cmd.join(' ')) + } catch (error) { core.setFailed(error.message) } diff --git a/post.js b/post.js index 0c149e2..281881b 100644 --- a/post.js +++ b/post.js @@ -14,6 +14,7 @@ async function main() { const keyFile = core.getState("keyFile") const inventoryFile = core.getState("inventoryFile") const vaultPasswordFile = core.getState("vaultPasswordFile") + const knownHostsFile = core.getState("knownHostsFile") if (directory) process.chdir(directory) @@ -26,6 +27,10 @@ async function main() { if (vaultPasswordFile) rm(vaultPasswordFile) + + if (knownHostsFile) + rm(knownHostsFile) + } catch (error) { core.setFailed(error.message) } From 3c219bf69ce6444c0e58f0682df872b5e16135a5 Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Wed, 14 Apr 2021 04:54:38 +0000 Subject: [PATCH 7/8] build(deps): bump @actions/core from 1.2.6 to 1.2.7 Bumps [@actions/core](https://github.com/actions/toolkit/tree/HEAD/packages/core) from 1.2.6 to 1.2.7. - [Release notes](https://github.com/actions/toolkit/releases) - [Changelog](https://github.com/actions/toolkit/blob/main/packages/core/RELEASES.md) - [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/core) Signed-off-by: dependabot-preview[bot] --- package-lock.json | 14 +++++++------- package.json | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index c2687f6..dc195b3 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5,15 +5,15 @@ "packages": { "": { "dependencies": { - "@actions/core": "^1.2.6", + "@actions/core": "^1.2.7", "@actions/exec": "^1.0.4", "yaml": "^1.10.2" } }, "node_modules/@actions/core": { - "version": "1.2.6", - "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz", - "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA==" + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.7.tgz", + "integrity": "sha512-kzLFD5BgEvq6ubcxdgPbRKGD2Qrgya/5j+wh4LZzqT915I0V3rED+MvjH6NXghbvk1MXknpNNQ3uKjXSEN00Ig==" }, "node_modules/@actions/exec": { "version": "1.0.4", @@ -39,9 +39,9 @@ }, "dependencies": { "@actions/core": { - "version": "1.2.6", - "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz", - "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA==" + "version": "1.2.7", + "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.7.tgz", + "integrity": "sha512-kzLFD5BgEvq6ubcxdgPbRKGD2Qrgya/5j+wh4LZzqT915I0V3rED+MvjH6NXghbvk1MXknpNNQ3uKjXSEN00Ig==" }, "@actions/exec": { "version": "1.0.4", diff --git a/package.json b/package.json index 8a067b7..1e43ec6 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "action-ansible-playbook", "main": "main.js", "dependencies": { - "@actions/core": "^1.2.6", + "@actions/core": "^1.2.7", "@actions/exec": "^1.0.4", "yaml": "^1.10.2" } From 75ae6272367acd7c3ed0b463b45915408c4ec2fb Mon Sep 17 00:00:00 2001 From: "dependabot-preview[bot]" <27856297+dependabot-preview[bot]@users.noreply.github.com> Date: Wed, 28 Apr 2021 22:30:47 +0000 Subject: [PATCH 8/8] Upgrade to GitHub-native Dependabot --- .github/dependabot.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..b8b36f6 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,18 @@ +version: 2 +updates: +- package-ecosystem: npm + directory: "/" + schedule: + interval: daily + time: "04:00" + pull-request-branch-name: + separator: "-" + open-pull-requests-limit: 10 +- package-ecosystem: github-actions + directory: "/" + schedule: + interval: daily + time: "04:00" + pull-request-branch-name: + separator: "-" + open-pull-requests-limit: 10