diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 0000000..5afa8cd --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,19 @@ +name: Test action image + +on: + pull_request: + push: + branches: [master] + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Build with updated certificates + run: docker build --pull -t packagecloud-action:test . + - name: Verify CLI starts + run: docker run --rm --entrypoint package_cloud packagecloud-action:test version diff --git a/Dockerfile b/Dockerfile index e56ce3c..27742ae 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,26 +1,18 @@ -FROM ubuntu:focal -SHELL ["/bin/bash", "-l", "-c"] +FROM ruby:3.4-slim-bookworm -RUN apt-get update +# Debian's security update removes both emSign ECC Root CA - G3 and +# AAA Certificate Services, covering the compromised intermediates' cross-signs. +# https://security-tracker.debian.org/tracker/DLA-4845-1 +RUN apt-get update \ + && apt-get install -y --no-install-recommends ca-certificates build-essential \ + && dpkg --compare-versions "$(dpkg-query -W -f='${Version}' ca-certificates)" ge '20250419~deb12u2' \ + && update-ca-certificates \ + && rm -rf /var/lib/apt/lists/* -# Required to download things from internet -RUN apt-get install -y curl +ENV SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \ + SSL_CERT_DIR=/etc/ssl/certs -# Install build tools required for building native extensions -RUN apt-get install -y build-essential +RUN gem install package_cloud --version 0.3.15 --no-document -# Required for apt-add-repository -RUN DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common - -# Install rvm -RUN gpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB -RUN curl -sSL https://get.rvm.io | bash -s stable --ruby -RUN source /usr/local/rvm/scripts/rvm -RUN rvm install 2.7.5 -RUN rvm use 2.7.5 && gem install package_cloud - -# Copies your code file from your action repository to the filesystem path `/` of the container COPY entrypoint.sh /entrypoint.sh - -# Code file to execute when the docker container starts up (`entrypoint.sh`) ENTRYPOINT ["/entrypoint.sh"] diff --git a/Dockerfile.bullseye b/Dockerfile.bullseye deleted file mode 100644 index 249fa30..0000000 --- a/Dockerfile.bullseye +++ /dev/null @@ -1,21 +0,0 @@ -FROM ruby:3.0.4-bullseye - -RUN apt-get update - -# Required to download things from internet -RUN apt-get install -y curl - -# Install build tools required for building native extensions -RUN apt-get install -y build-essential - -# Required for apt-add-repository -RUN DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common - -# Install package_cloud -RUN gem install package_cloud - -# Copies your code file from your action repository to the filesystem path `/` of the container -COPY entrypoint-bullseye.sh /entrypoint-bullseye.sh - -# Code file to execute when the docker container starts up (`entrypoint.sh`) -ENTRYPOINT ["/entrypoint-bullseye.sh"] diff --git a/README.md b/README.md index bb5b6a2..bdf7c76 100644 --- a/README.md +++ b/README.md @@ -47,7 +47,7 @@ jobs: ##### MODIFY: Add steps to build package or copy package to github action container ##### so it is available to github action to upload to packagecloud - name: push package to packagecloud.io - uses: computology/packagecloud-github-action + uses: computology/packagecloud-github-action@master with: ##### MODIFY: Change to packagecloud username, reponame, distro type ##### To understand the available distro type, see @@ -58,6 +58,29 @@ jobs: PACKAGECLOUD-TOKEN: ${{ secrets.packagecloud_token }} ``` +### Runtime and certificate updates + +The action builds the checked-in Dockerfile on the GitHub runner instead of +pulling the old prebuilt Docker Hub image. This adds image-build time to each +workflow run, but ensures the action uses the runtime and certificate policy in +the selected Git revision. Prefer pinning a reviewed full commit SHA or release +containing this change rather than the moving `master` example above. Existing +older action tags still reference the old image and do not receive this fix. + +The image uses Ruby 3.4 and Debian Bookworm's system certificate store. Builds +require `ca-certificates` version `20250419~deb12u2` or newer, which removes trust +in `emSign ECC Root CA - G3` and `AAA Certificate Services` following the +[eMudhra intermediate CA compromise](https://emudhra.we-have-a-problem.com/). +Certificate and hostname verification remain enabled; the action does not add a +custom certificate blocklist or modify the runner host's trust store. + +To build and check the image locally without uploading a package: + +```bash +docker build --pull -t packagecloud-action:test . +docker run --rm --entrypoint package_cloud packagecloud-action:test version +``` + ## Example * https://github.com/computology/python-github-action-example diff --git a/action.yml b/action.yml index 93610e6..d19b86c 100644 --- a/action.yml +++ b/action.yml @@ -21,7 +21,7 @@ inputs: required: true runs: using: 'docker' - image: 'docker://packagecloud/packagecloud-github-action:0.0.2' + image: 'Dockerfile' env: PACKAGE_NAME: ${{ inputs.package-name }} PACKAGECLOUD_USERNAME: ${{ inputs.packagecloud-username }} diff --git a/entrypoint-bullseye.sh b/entrypoint-bullseye.sh deleted file mode 100755 index e0ce367..0000000 --- a/entrypoint-bullseye.sh +++ /dev/null @@ -1,13 +0,0 @@ -#!/bin/bash -l - -echo "PACKAGECLOUD_USERNAME=${PACKAGECLOUD_USERNAME}" -echo "PACKAGECLOUD_REPONAME=${PACKAGECLOUD_REPONAME}" -echo "PACKAGECLOUD_DISTRO=${PACKAGECLOUD_DISTRO}" -echo "PACKAGE_NAME=${PACKAGE_NAME}" - -UPLOAD_PATH="${PACKAGECLOUD_USERNAME}/${PACKAGECLOUD_REPONAME}/${PACKAGECLOUD_DISTRO}" - -echo "Pushing package: ${PACKAGE_NAME}" -echo "To repository: ${UPLOAD_PATH}" - -/usr/local/bundle/bin/package_cloud push ${UPLOAD_PATH} ${PACKAGE_NAME} diff --git a/entrypoint.sh b/entrypoint.sh index ec6d375..253485a 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,6 +1,9 @@ -#!/bin/bash -l +#!/bin/bash -echo "PACKAGECLOUD_REPO=${PACKAGECLOUD_REPO}" +set -euo pipefail + +echo "PACKAGECLOUD_USERNAME=${PACKAGECLOUD_USERNAME}" +echo "PACKAGECLOUD_REPONAME=${PACKAGECLOUD_REPONAME}" echo "PACKAGECLOUD_DISTRO=${PACKAGECLOUD_DISTRO}" echo "PACKAGE_NAME=${PACKAGE_NAME}" @@ -9,5 +12,6 @@ UPLOAD_PATH="${PACKAGECLOUD_USERNAME}/${PACKAGECLOUD_REPONAME}/${PACKAGECLOUD_DI echo "Pushing package: ${PACKAGE_NAME}" echo "To repository: ${UPLOAD_PATH}" -source /usr/local/rvm/scripts/rvm -rvm use 2.7.5 && package_cloud push ${UPLOAD_PATH} ${PACKAGE_NAME} +# Expand package patterns such as dist/*.tar.gz, as in the action's documented use. +# shellcheck disable=SC2086 +exec package_cloud push "$UPLOAD_PATH" ${PACKAGE_NAME}