216 lines
8.1 KiB
YAML
216 lines
8.1 KiB
YAML
name: 'Setup SSH Client'
|
|
description: 'Configure SSH client for running remote commands with custom shell wrapper'
|
|
author: 'Karolis Kundrotas'
|
|
branding:
|
|
icon: 'terminal'
|
|
color: 'blue'
|
|
|
|
inputs:
|
|
ssh-private-key:
|
|
description: 'SSH private key for authentication'
|
|
required: true
|
|
ssh-host:
|
|
description: 'SSH host to connect to'
|
|
required: true
|
|
ssh-user:
|
|
description: 'SSH username'
|
|
required: true
|
|
ssh-port:
|
|
description: 'SSH port'
|
|
required: false
|
|
default: '22'
|
|
ssh-known-hosts:
|
|
description: 'Known hosts content (optional, will use ssh-keyscan if not provided)'
|
|
required: false
|
|
default: ''
|
|
strict-host-key-checking:
|
|
description: 'Enable strict host key checking (yes/no/accept-new)'
|
|
required: false
|
|
default: 'accept-new'
|
|
use-shell-wrapper:
|
|
description: 'Create shell wrapper for remote execution (enables shell: ssh-remote)'
|
|
required: false
|
|
default: 'true'
|
|
remote-shell:
|
|
description: 'Shell to use on remote server (bash, sh, zsh, etc.)'
|
|
required: false
|
|
default: 'bash'
|
|
|
|
outputs:
|
|
ssh-config-path:
|
|
description: 'Path to the SSH config file'
|
|
value: ${{ steps.setup-ssh.outputs.ssh-config-path }}
|
|
ssh-key-path:
|
|
description: 'Path to the SSH private key'
|
|
value: ${{ steps.setup-ssh.outputs.ssh-key-path }}
|
|
shell-wrapper-path:
|
|
description: 'Path to the SSH remote shell wrapper script'
|
|
value: ${{ steps.setup-shell-wrapper.outputs.shell-wrapper-path }}
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- name: Setup SSH
|
|
id: setup-ssh
|
|
shell: bash
|
|
run: |
|
|
# Create SSH directory
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
# Ensure ssh client is present. If not, try to install using a known
|
|
# package manager (apt, yum/dnf, apk, brew, pkg). If installation
|
|
# fails, stop early with helpful message.
|
|
if ! command -v ssh >/dev/null 2>&1; then
|
|
echo "SSH client 'ssh' not found. Attempting to install..."
|
|
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
echo "Using apt-get to install openssh-client"
|
|
sudo apt-get update -qq
|
|
DEBIAN_FRONTEND=noninteractive sudo apt-get install -y openssh-client
|
|
|
|
elif command -v yum >/dev/null 2>&1 || command -v dnf >/dev/null 2>&1; then
|
|
echo "Using yum/dnf to install openssh-clients"
|
|
sudo yum install -y openssh-clients || sudo dnf install -y openssh-clients
|
|
|
|
elif command -v apk >/dev/null 2>&1; then
|
|
echo "Using apk to install openssh-client"
|
|
sudo apk add --no-cache openssh-client
|
|
|
|
elif command -v brew >/dev/null 2>&1; then
|
|
echo "Using Homebrew to install openssh"
|
|
brew update >/dev/null || true
|
|
brew install openssh
|
|
|
|
elif command -v pkg >/dev/null 2>&1; then
|
|
echo "Using pkg to install openssh"
|
|
sudo pkg install -y openssh
|
|
|
|
else
|
|
echo "No known package manager found to install SSH client. Please install 'ssh' and rerun." >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Verify the install worked
|
|
if ! command -v ssh >/dev/null 2>&1; then
|
|
echo "Failed to install SSH client automatically — please install 'ssh' and rerun." >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# Setup SSH private key
|
|
SSH_KEY_PATH="$HOME/.ssh/github_action_key"
|
|
echo "${{ inputs.ssh-private-key }}" > "$SSH_KEY_PATH"
|
|
chmod 600 "$SSH_KEY_PATH"
|
|
echo "ssh-key-path=$SSH_KEY_PATH" >> $GITHUB_OUTPUT
|
|
|
|
# Setup known hosts
|
|
if [ -n "${{ inputs.ssh-known-hosts }}" ]; then
|
|
echo "${{ inputs.ssh-known-hosts }}" > ~/.ssh/known_hosts
|
|
chmod 644 ~/.ssh/known_hosts
|
|
else
|
|
if [ "${{ inputs.strict-host-key-checking }}" = "yes" ]; then
|
|
echo "❌ strict-host-key-checking is 'yes' but no ssh-known-hosts provided. Refusing to auto-add host key via ssh-keyscan." >&2
|
|
echo "Provide the host's key (e.g. from a trusted source) via 'ssh-known-hosts' input." >&2
|
|
exit 1
|
|
fi
|
|
echo "Scanning host keys for ${{ inputs.ssh-host }}..."
|
|
ssh-keyscan -p ${{ inputs.ssh-port }} -H "${{ inputs.ssh-host }}" >> ~/.ssh/known_hosts 2>/dev/null || true
|
|
chmod 644 ~/.ssh/known_hosts
|
|
fi
|
|
|
|
# Create SSH config
|
|
SSH_CONFIG_PATH="$HOME/.ssh/config"
|
|
cat >> "$SSH_CONFIG_PATH" << EOF
|
|
Host github-action-host
|
|
HostName ${{ inputs.ssh-host }}
|
|
User ${{ inputs.ssh-user }}
|
|
Port ${{ inputs.ssh-port }}
|
|
IdentityFile $SSH_KEY_PATH
|
|
StrictHostKeyChecking ${{ inputs.strict-host-key-checking }}
|
|
UserKnownHostsFile ~/.ssh/known_hosts
|
|
EOF
|
|
chmod 600 "$SSH_CONFIG_PATH"
|
|
echo "ssh-config-path=$SSH_CONFIG_PATH" >> $GITHUB_OUTPUT
|
|
|
|
echo "✅ SSH client configured successfully"
|
|
echo "Connect using: ssh github-action-host"
|
|
|
|
- name: Test SSH Connection
|
|
shell: bash
|
|
run: |
|
|
echo "Testing SSH connection..."
|
|
if ssh -o ConnectTimeout=10 -o BatchMode=yes github-action-host "echo 'SSH connection successful'" 2>&1; then
|
|
echo "✅ SSH connection test passed"
|
|
else
|
|
echo "⚠️ SSH connection test failed - please verify your credentials and host"
|
|
exit 1
|
|
fi
|
|
|
|
- name: Create SSH Remote Shell Wrapper
|
|
id: setup-shell-wrapper
|
|
shell: bash
|
|
run: |
|
|
# Create a unique temporary directory for the wrapper. Do NOT place
|
|
# the wrapper in the `GITHUB_WORKSPACE` to avoid polluting repo files.
|
|
# Prefer runner-specific temp folders (RUNNER_TEMP), then /tmp.
|
|
TEMP_DIR="${RUNNER_TEMP:-/tmp}"
|
|
WRAPPER_DIR=$(mktemp -d "$TEMP_DIR/setup-ssh-client-XXXXXX")
|
|
mkdir -p "$WRAPPER_DIR"
|
|
WRAPPER_PATH="$(mktemp "$WRAPPER_DIR/ssh-remote-shell-XXXXXX.sh")"
|
|
|
|
cat << 'WRAPPER_EOF' > "$WRAPPER_PATH"
|
|
#!/bin/bash
|
|
set -e
|
|
|
|
# Check if input file is provided
|
|
if [ -z "$1" ]; then
|
|
echo "Error: No script file provided" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SCRIPT_FILE="$1"
|
|
|
|
# Check if script file exists
|
|
if [ ! -f "$SCRIPT_FILE" ]; then
|
|
echo "Error: Script file '$SCRIPT_FILE' not found" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Execute script on remote server
|
|
# Use BatchMode to prevent interactive prompts
|
|
# ConnectTimeout to fail fast if connection issues
|
|
echo "Executing script on remote server '${{ inputs.ssh-host }}' via SSH..."
|
|
ssh -o BatchMode=yes \
|
|
-o ConnectTimeout=10 \
|
|
github-action-host \
|
|
"${{ inputs.remote-shell }} -s" < "$SCRIPT_FILE"
|
|
WRAPPER_EOF
|
|
|
|
chmod +x "$WRAPPER_PATH"
|
|
echo "✅ SSH remote shell wrapper created at $WRAPPER_PATH"
|
|
# We also create symlink without the .sh extension to provide a
|
|
# short executable name inside the wrapper dir (e.g. $WRAPPER_DIR/ssh-remote)
|
|
ln -s "$WRAPPER_PATH" "$WRAPPER_DIR/ssh-remote"
|
|
if [ "${{ inputs.use-shell-wrapper }}" = "true" ]; then
|
|
echo ""
|
|
echo "To use the remote shell in subsequent steps, add:"
|
|
echo " shell: ssh-remote"
|
|
echo ""
|
|
echo "The 'ssh-remote' shell is now available for use."
|
|
fi
|
|
echo "shell-wrapper-dir=$WRAPPER_DIR" >> $GITHUB_OUTPUT
|
|
echo "shell-wrapper-path=$WRAPPER_PATH" >> $GITHUB_OUTPUT
|
|
|
|
|
|
- name: Register Custom Shell
|
|
if: inputs.use-shell-wrapper == 'true'
|
|
shell: bash
|
|
run: |
|
|
SHELL_WRAPPER_PATH="${{ steps.setup-shell-wrapper.outputs.shell-wrapper-path }}"
|
|
# Register custom shell for this job by mapping the shell name to the
|
|
# wrapper path. This is the recommended way to expose a custom shell
|
|
# for `shell: ssh-remote` in subsequent steps. We do this conditionally
|
|
# so `use-shell-wrapper` can be used to opt out.
|
|
echo "ssh-remote=$SHELL_WRAPPER_PATH {0}" >> "$GITHUB_ENV"
|
|
echo "✅ Custom shell 'ssh-remote' registered for this job"
|