Randomize SSH auth socket, kill agent to support non-ephemeral, self hosted runners (@thommyhh, #27)

Thanks to @thommyhh for this contribution!

Unless the `SSH_AUTH_SOCK` is configured explicitly, this change will make the SSH agent use a random file name for the socket. That way, multiple, concurrent SSH agents can be used on non-ephemeral, self-hosted runners.

A new post-action step will automatically clean up the running agent at the end of a job.

Be aware of the possible security implications: Two jobs running on the same runner might be able to access each other's socket and thus access repositories and/or hosts.
This commit is contained in:
Thorben Nissen 2020-05-18 09:08:29 +02:00 committed by GitHub
parent a82ae3cd1a
commit 4fcb25e7ef
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
9 changed files with 424 additions and 20 deletions

View file

@ -6,10 +6,10 @@ inputs:
required: true
ssh-auth-sock:
description: 'Where to place the SSH Agent auth socket'
default: /tmp/ssh-auth.sock
runs:
using: 'node12'
main: 'dist/index.js'
post: 'dist/cleanup.js'
branding:
icon: loader
color: 'yellow'