From 74f82cb5083881e83282b39595cad946b84923e5 Mon Sep 17 00:00:00 2001 From: Johannes Reker Date: Wed, 19 Mar 2025 16:43:23 +0100 Subject: [PATCH 1/2] feat: added ssh_passphrase for encrypted private key auth --- Dockerfile | 2 +- README.md | 28 +++++++++++++++++++++++++++- action.yml | 5 ++++- entrypoint.sh | 21 +++++++++++++++++++++ 4 files changed, 53 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index cc403bc..c1ff50e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,7 +2,7 @@ FROM alpine:3.18 # Install required packages in one RUN statement to reduce image layers -RUN apk update && apk add --no-cache rsync sshpass openssh +RUN apk update && apk add --no-cache rsync sshpass openssh expect # Copy entrypoint script and set correct permissions COPY entrypoint.sh /entrypoint.sh diff --git a/README.md b/README.md index d79f79e..d23e7e7 100644 --- a/README.md +++ b/README.md @@ -20,8 +20,9 @@ | `sftp_only` | no | | If your port only accepts the sftp protocol, set this option to `true`. However, when set to `true`, the remote folder won't be automatically created. | | `sftpArgs` | no | | Extra arguments you want to pass to `sftp`, for example: `-o ConnectTimeout=5` | | `delete_remote_files` | no | false | Set to `true` to delete the remote path folder and all files in it **before** uploading. | -| `password` | no | | SSH password. If a password is set, `ssh_private_key` is ignored. *(for @v1.2.4 and greater)* | +| `password` | no | | SSH password. If a password is set, `ssh_private_key` and `ssh_passphrase` is ignored. *(for @v1.2.4 and greater)* | | `rsyncArgs` | no | | Additional arguments for the `rsync` command. You can customize file synchronization behavior, such as excluding files or directories. Example: `--exclude=node_modules --exclude=.git --exclude=*.log`. *(for @v1.2.5 and greater)* | +| `ssh_passphrase` | no | | The passphrase for encrypted ssh private-key | > ⚠️ **Warning:** > Be careful when using `delete_remote_files`. This will **permanently delete** the remote path folder and all files in it **before** uploading. @@ -108,6 +109,31 @@ jobs: password: ${{ secrets.FTP_PASSWORD }} ``` + +### **🔹 Example with Encrypted Private Key Authentication** +```yaml +on: [push] + +jobs: + deploy_job: + runs-on: ubuntu-latest + name: Deploy with Password + steps: + - name: Checkout + uses: actions/checkout@v2 + + - name: Deploy with Password + uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + with: + username: ${{ secrets.FTP_USERNAME }} + server: ${{ secrets.FTP_SERVER }} + port: ${{ secrets.FTP_PORT }} + local_path: './static/*' + remote_path: '/var/www/app' + sftp_only: true + ssh_private_key: ${{ secrets.SSH_PRIVATE_KEY }} + ssh_passphrase: ${{ secrets.SSH_PASSPHRASE }} +``` --- ## 🌐 **3. [Deploy React App Example](https://github.com/wlixcc/React-Deploy)** diff --git a/action.yml b/action.yml index 7991210..4bdbdc6 100644 --- a/action.yml +++ b/action.yml @@ -43,7 +43,9 @@ inputs: If set, these arguments will be passed directly to the rsync command." required: false default: "" - + ssh_passphrase: + description: "Passphrase for ssh encrypted private-key. If the private-key is not encrypted, this parameter is not required." + required: false runs: using: 'docker' @@ -60,6 +62,7 @@ runs: - ${{ inputs.delete_remote_files }} - ${{ inputs.password }} - ${{ inputs.rsyncArgs }} + - ${{ inputs.ssh_passphrase }} branding: diff --git a/entrypoint.sh b/entrypoint.sh index ab1189b..a980b1e 100644 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -83,6 +83,20 @@ else ssh -o StrictHostKeyChecking=no -p $3 -i $TEMP_SSH_PRIVATE_KEY_FILE $1@$2 mkdir -p $6 fi +# check if passphrase is set, if yes decrypt the private key +if [ -n "${12}" ]; then + echo 'Use ssh-agent to decrypt private key with passphrase' + # start ssh agent + eval $(ssh-agent -s) + # use expect for ssh passphrase encryption + expect <$TEMP_SFTP_FILE @@ -90,4 +104,11 @@ printf "%s" "put -r $5 $6" >$TEMP_SFTP_FILE sftp -b $TEMP_SFTP_FILE -P $3 $8 -o StrictHostKeyChecking=no -i $TEMP_SSH_PRIVATE_KEY_FILE $1@$2 echo 'Deploy Success' +# if passphrase is set stop ssh-agent after sftp connection +if [ -n "${12}" ]; then + echo 'Clear keys from ssh-agent' + # delete all keys from RAM + ssh-add -D +fi + exit 0 From a2526c619d21758c0a5e4b5f87a1a28c25623f0e Mon Sep 17 00:00:00 2001 From: Johannes Reker Date: Wed, 19 Mar 2025 16:53:16 +0100 Subject: [PATCH 2/2] doc: refined example and changed versions --- README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index d23e7e7..b93e61a 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,7 @@ jobs: uses: actions/checkout@v2 - name: Deploy to Server - uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + uses: wlixcc/SFTP-Deploy-Action@v1.2.6 with: username: 'root' server: 'your server ip' @@ -71,7 +71,7 @@ jobs: uses: actions/checkout@v2 - name: Deploy with Exclude Patterns - uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + uses: wlixcc/SFTP-Deploy-Action@v1.2.6 with: username: 'root' server: 'your server ip' @@ -98,7 +98,7 @@ jobs: uses: actions/checkout@v2 - name: Deploy with Password - uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + uses: wlixcc/SFTP-Deploy-Action@v1.2.6 with: username: ${{ secrets.FTP_USERNAME }} server: ${{ secrets.FTP_SERVER }} @@ -117,13 +117,13 @@ on: [push] jobs: deploy_job: runs-on: ubuntu-latest - name: Deploy with Password + name: Deploy with encrypted private key steps: - name: Checkout uses: actions/checkout@v2 - - name: Deploy with Password - uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + - name: Deploy with encrypted private key + uses: wlixcc/SFTP-Deploy-Action@v1.2.6 with: username: ${{ secrets.FTP_USERNAME }} server: ${{ secrets.FTP_SERVER }} @@ -156,7 +156,7 @@ jobs: run: yarn build - name: Deploy Build Folder - uses: wlixcc/SFTP-Deploy-Action@v1.2.5 + uses: wlixcc/SFTP-Deploy-Action@v1.2.6 with: username: 'root' server: '${{ secrets.SERVER_IP }}'