Compare commits

..

No commits in common. "master" and "v0.0.11" have entirely different histories.

10 changed files with 79 additions and 389 deletions

13
.github/FUNDING.yml vendored
View File

@ -1,13 +0,0 @@
# These are supported funding model platforms
github: # Replace with up to 4 GitHub Sponsors-enabled usernames e.g., [user1, user2]
patreon: # Replace with a single Patreon username
open_collective: # Replace with a single Open Collective username
ko_fi: # Replace with a single Ko-fi username
tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
liberapay: # Replace with a single Liberapay username
issuehunt: # Replace with a single IssueHunt username
otechie: # Replace with a single Otechie username
lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
custom: ['https://www.paypal.me/appleboy46']

View File

@ -1,10 +0,0 @@
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
- package-ecosystem: gomod
directory: /
schedule:
interval: weekly

View File

@ -1,150 +1,52 @@
name: scp files name: scp files
on: [push] on: [push]
jobs: jobs:
testing:
name: test scp action build:
name: Build
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- name: checkout - name: checkout
uses: actions/checkout@v4 uses: actions/checkout@v1
- name: copy file via ssh password - name: copy file via ssh password
uses: ./ uses: ./
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
password: ${{ secrets.PASSWORD }} password: ${{ secrets.PASSWORD }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: "test" target: "test"
- name: copy file via ssh key - name: copy file via ssh key
uses: ./ uses: ./
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }} key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: "test" target: "test"
- name: remove the specified number of leading path elements - name: remove the specified number of leading path elements
uses: ./ uses: ./
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }} key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: "foobar" target: "foobar"
strip_components: 1 strip_components: 1
- name: ssh key with passphrase - name: ssh key with passphrase
uses: ./ uses: ./
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
key: ${{ secrets.SSH2 }} key: ${{ secrets.SSH2 }}
passphrase: ${{ secrets.PASSPHRASE }} passphrase: ${{ secrets.PASSPHRASE }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: "test" target: "test"
- name: use insecure cipher
uses: ./
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.SSH2 }}
passphrase: ${{ secrets.PASSPHRASE }}
port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt"
target: "test"
use_insecure_cipher: true
deploy:
name: test deploy artifact
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- run: echo hello > world.txt
- uses: actions/upload-artifact@v4
with:
name: my-artifact
path: world.txt
- uses: actions/download-artifact@v4
with:
name: my-artifact
path: distfiles
- name: copy file to server
uses: ./
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: distfiles/*
target: test
changes:
name: test changed-files
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@v46
with:
since_last_remote_commit: true
separator: ","
- name: copy file to server
uses: ./
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: ${{ steps.changed-files.outputs.all_changed_files }}
target: test
target:
name: test target folder
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- name: copy file to server
uses: ./
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: tests/a.txt,tests/b.txt
target: foobar foobar 1234
multipleHost:
name: test Multiple Host
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- name: copy file to server
uses: ./
with:
host: ${{ secrets.HOST }}:${{ secrets.PORT }},${{ secrets.HOST }}:${{ secrets.PORT }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: 1024
source: tests/a.txt,tests/b.txt
target: foobar

View File

@ -1,5 +1,5 @@
FROM ghcr.io/appleboy/drone-scp:1.6.14 FROM appleboy/drone-scp:1.6.0-linux-amd64
COPY entrypoint.sh /bin/entrypoint.sh ADD entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/bin/entrypoint.sh"] ENTRYPOINT ["/entrypoint.sh"]

231
README.md
View File

@ -2,13 +2,15 @@
[GitHub Action](https://github.com/features/actions) for copying files and artifacts via SSH. [GitHub Action](https://github.com/features/actions) for copying files and artifacts via SSH.
![ssh key](./images/copy-multiple-file.png)
[![Actions Status](https://github.com/appleboy/scp-action/workflows/scp%20files/badge.svg)](https://github.com/appleboy/scp-action/actions) [![Actions Status](https://github.com/appleboy/scp-action/workflows/scp%20files/badge.svg)](https://github.com/appleboy/scp-action/actions)
**Important**: Only support **Linux** [docker](https://www.docker.com/) container. **Importment**: Only support **Linux** container.
## Usage ## Usage
Copy files and artifacts via SSH: copy files and artifacts via SSH as blow.
```yaml ```yaml
name: scp files name: scp files
@ -19,21 +21,21 @@ jobs:
name: Build name: Build
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v4 - uses: actions/checkout@master
- name: copy file via ssh password - name: copy file via ssh password
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
password: ${{ secrets.PASSWORD }} password: ${{ secrets.PASSWORD }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path target: "test"
``` ```
## Input variables ## Input variables
See the [action.yml](./action.yml) file for more detail information. see the [action.yml](./action.yml) file for more detail imformation.
* host - scp remote host * host - scp remote host
* port - scp remote port, default is `22` * port - scp remote port, default is `22`
@ -45,15 +47,12 @@ See the [action.yml](./action.yml) file for more detail information.
* command_timeout - timeout for scp command, default is `10m` * command_timeout - timeout for scp command, default is `10m`
* key - content of ssh private key. ex raw content of ~/.ssh/id_rsa * key - content of ssh private key. ex raw content of ~/.ssh/id_rsa
* key_path - path of ssh private key * key_path - path of ssh private key
* target - target path on the server, must be a directory (**required**) * target - target path on the server
* source - scp file list (**required**) * source - scp file list
* rm - remove target folder before upload data, default is `false` * rm - remove target folder before upload data, default is `false`
* strip_components - remove the specified number of leading path elements. * strip_components - remove the specified number of leading path elements.
* overwrite - use `--overwrite` flag with tar, overwrite existing files when extracting * overwrite - use `--overwrite` flag with tar
* tar_tmp_path - temporary path for tar file on the dest host * tar_tmp_path - temporary path for tar file on the dest host
* tar_exec - path to tar executable on the dest host. default is `tar`
* tar_dereference - use `--dereference` flag with tar, follow symlinks; archive and dump the files they point to
* use_insecure_cipher - include more ciphers with use_insecure_cipher (see [#15](https://github.com/appleboy/scp-action/issues/15))
SSH Proxy Setting: SSH Proxy Setting:
@ -66,119 +65,55 @@ SSH Proxy Setting:
* proxy_key - content of ssh proxy private key. * proxy_key - content of ssh proxy private key.
* proxy_key_path - path of ssh proxy private key * proxy_key_path - path of ssh proxy private key
* proxy_fingerprint - fingerprint SHA256 of the host public key, default is to skip verification * proxy_fingerprint - fingerprint SHA256 of the host public key, default is to skip verification
* proxy_use_insecure_cipher - include more ciphers with use_insecure_cipher (see [#15](https://github.com/appleboy/scp-action/issues/15))
## Setting up a SSH Key ### Example
Make sure to follow the below steps while creating SSH Keys and using them. Copy file via ssh password
The best practice is create the SSH Keys on local machine not remote machine.
Login with username specified in Github Secrets. Generate a RSA Key-Pair:
```bash
# rsa
ssh-keygen -t rsa -b 4096 -C "your_email@example.com"
# ed25519
ssh-keygen -t ed25519 -a 200 -C "your_email@example.com"
```
Add newly generated key into Authorized keys. Read more about authorized keys [here](https://www.ssh.com/ssh/authorized_keys/).
```bash
# rsa
cat .ssh/id_rsa.pub | ssh b@B 'cat >> .ssh/authorized_keys'
# d25519
cat .ssh/id_ed25519.pub | ssh b@B 'cat >> .ssh/authorized_keys'
```
Copy Private Key content and paste in Github Secrets.
```bash
# rsa
clip < ~/.ssh/id_rsa
# ed25519
clip < ~/.ssh/id_ed25519
```
See the detail information about [SSH login without password](http://www.linuxproblem.org/art_9.html).
**A note** from one of our readers: Depending on your version of SSH you might also have to do the following changes:
* Put the public key in `.ssh/authorized_keys2`
* Change the permissions of `.ssh` to 700
* Change the permissions of `.ssh/authorized_keys2` to 640
### If you are using OpenSSH
If you are currently using OpenSSH and are getting the following error:
```bash
ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey]
```
Make sure that your key algorithm of choice is supported.
On Ubuntu 20.04 or later you must explicitly allow the use of the ssh-rsa algorithm. Add the following line to your OpenSSH daemon file (which is either `/etc/ssh/sshd_config` or a drop-in file under `/etc/ssh/sshd_config.d/`):
```bash
CASignatureAlgorithms +ssh-rsa
```
Alternatively, `ed25519` keys are accepted by default in OpenSSH. You could use this instead of rsa if needed:
```bash
ssh-keygen -t ed25519 -a 200 -C "your_email@example.com"
```
## Example
Copy file via a SSH password:
```yaml ```yaml
- name: copy file via ssh password - name: copy file via ssh password
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
host: example.com host: example.com
username: foo username: foo
password: bar password: bar
port: 22 port: 22
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path target: "test"
``` ```
Copy file via a SSH key: Copy file via ssh key
```yaml ```yaml
- name: copy file via ssh key - name: copy file via ssh key
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
key: ${{ secrets.KEY }} key: ${{ secrets.KEY }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path target: "test"
``` ```
Example configuration for ignore list: Example configuration for ignore list:
```yaml ```yaml
- name: copy file via ssh key - name: copy file via ssh key
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
key: ${{ secrets.KEY }} key: ${{ secrets.KEY }}
source: "tests/*.txt,!tests/a.txt" source: "tests/*.txt,!tests/a.txt"
target: your_server_target_folder_path target: "test"
``` ```
Example configuration for multiple servers: Example configuration for multiple server
```diff ```diff
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
- host: "example.com" - host: "example.com"
+ host: "foo.com,bar.com" + host: "foo.com,bar.com"
@ -186,72 +121,25 @@ Example configuration for multiple servers:
password: bar password: bar
port: 22 port: 22
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path target: "test"
``` ```
Example configuration for exclude custom files: remove the specified number of leading path elements
```yaml
uses: appleboy/scp-action@v0.1.7
with:
host: "example.com"
username: foo
password: bar
port: 22
- source: "tests/*.txt"
+ source: "tests/*.txt,!tests/a.txt,!tests/b.txt"
target: your_server_target_folder_path
```
Upload artifact files to remote server:
```yaml
deploy:
name: deploy artifact
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- run: echo hello > world.txt
- uses: actions/upload-artifact@v4
with:
name: my-artifact
path: world.txt
- uses: actions/download-artifact@v4
with:
name: my-artifact
path: distfiles
- name: copy file to server
uses: appleboy/scp-action@v0.1.7
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: distfiles/*
target: your_server_target_folder_path
```
Remove the specified number of leading path elements:
```yaml ```yaml
- name: remove the specified number of leading path elements - name: remove the specified number of leading path elements
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }} key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path target: "foobar"
strip_components: 1 strip_components: 1
``` ```
Old target structure: old target structure:
```sh ```sh
foobar foobar
@ -260,7 +148,7 @@ foobar
└── b.txt └── b.txt
``` ```
New target structure: new target structure:
```sh ```sh
foobar foobar
@ -268,39 +156,11 @@ foobar
└── b.txt └── b.txt
``` ```
Only copy files that are newer than the corresponding destination files:
```yaml
changes:
name: test changed-files
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@v35
with:
since_last_remote_commit: true
separator: ","
- name: copy file to server
uses: appleboy/scp-action@v0.1.7
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: ${{ steps.changed-files.outputs.all_changed_files }}
target: your_server_target_folder_path
```
Protecting a Private Key. The purpose of the passphrase is usually to encrypt the private key. This makes the key file by itself useless to an attacker. It is not uncommon for files to leak from backups or decommissioned hardware, and hackers commonly exfiltrate files from compromised systems. Protecting a Private Key. The purpose of the passphrase is usually to encrypt the private key. This makes the key file by itself useless to an attacker. It is not uncommon for files to leak from backups or decommissioned hardware, and hackers commonly exfiltrate files from compromised systems.
```diff ```diff
- name: ssh key with passphrase - name: ssh key with passphrase
uses: appleboy/scp-action@v0.1.7 uses: appleboy/scp-action@master
with: with:
host: ${{ secrets.HOST }} host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }} username: ${{ secrets.USERNAME }}
@ -308,36 +168,5 @@ Protecting a Private Key. The purpose of the passphrase is usually to encrypt th
+ passphrase: ${{ secrets.PASSPHRASE }} + passphrase: ${{ secrets.PASSPHRASE }}
port: ${{ secrets.PORT }} port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt" source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path target: "test"
```
When copying files from a Linux runner to a Windows server, you should:
1. Download git for Windows
2. Change the default OpenSSH shell to git bach with the following powershell command.
3. Set `tar_dereference` and `rm` variable to `true` in the YAML file
4. Avoid putting the `port` value through a variable
5. Convert the target path to a Unix path: `/c/path/to/target/`
Change the default OpenSSH shell to git bach with the following powershell command.
```powershell
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "$env:Programfiles\Git\bin\bash.exe" -PropertyType String -Force
```
Convert the target path to a Unix path: `/c/path/to/target/`
```diff
- name: Copy to Windows
uses: appleboy/scp-action@v0.1.7
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.SSH_PRIVATE_KEY }}
port: 22
source: 'your_source_path'
- target: 'C:\path\to\target'
+ target: '/c/path/to/target/'
+ tar_dereference: true
+ rm: true
``` ```

View File

@ -25,11 +25,8 @@ inputs:
description: 'ssh key passphrase' description: 'ssh key passphrase'
fingerprint: fingerprint:
description: 'fingerprint SHA256 of the host public key, default is to skip verification' description: 'fingerprint SHA256 of the host public key, default is to skip verification'
use_insecure_cipher:
description: 'include more ciphers with use_insecure_cipher'
default: false
target: target:
description: 'target path on the server, must be a directory path.' description: 'target path on the server'
source: source:
description: 'scp file list' description: 'scp file list'
rm: rm:
@ -42,16 +39,10 @@ inputs:
description: 'remove the specified number of leading path elements' description: 'remove the specified number of leading path elements'
default: 0 default: 0
overwrite: overwrite:
description: 'use --overwrite flag with tar' description: 'use `--overwrite` flag with tar'
default: false
tar_dereference:
description: 'use --dereference flag with tar'
default: false default: false
tar_tmp_path: tar_tmp_path:
description: 'temporary path for tar file on the dest host' description: 'temporary path for tar file on the dest host'
tar_exec:
description: 'temporary path for tar file on the dest host'
default: 'tar'
proxy_host: proxy_host:
description: 'ssh proxy remote host' description: 'ssh proxy remote host'
proxy_port: proxy_port:
@ -72,9 +63,6 @@ inputs:
description: 'path of ssh proxy private key' description: 'path of ssh proxy private key'
proxy_fingerprint: proxy_fingerprint:
description: 'fingerprint SHA256 of the host public key, default is to skip verification' description: 'fingerprint SHA256 of the host public key, default is to skip verification'
proxy_use_insecure_cipher:
description: 'include more ciphers with use_insecure_cipher'
default: false
runs: runs:
using: 'docker' using: 'docker'
image: 'Dockerfile' image: 'Dockerfile'

View File

@ -1,2 +1 @@
foo foo
foobar

View File

@ -1,2 +1 @@
bar bar
foobar

View File

@ -1,3 +1 @@
c c
foobar
test1234

View File

@ -1,3 +1 @@
d d
foobar
foobar