Release/v5 (#13)

* Reference JoshPiper/rsync-docker @ 1.1.0

* See: https://github.com/JoshPiper/rsync-docker/tree/1.1.0
* New features: Support passphrase protected keys

* supply SSH_PASS (key passphrase) to agent-add

Read more about the behavior: https://github.com/JoshPiper/rsync-docker#agent-askpass

* add new remote_key_pass config option

* Update README.md

* Update README.md

* 2.0 is EOL

* support 5.0, drop 2.0

* default to empty string

* reference JoshPiper/rsync-docker @ v1.2.0

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+ advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+ address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+ professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team via issues. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

CONTRIBUTING.md

@@ -0,0 +1 @@
+Feel free to contribute to this project.

Dockerfile

@@ -1,27 +1,7 @@
-FROM ubuntu:latest
+FROM drinternet/rsync:v1.2.0
-
-
-# Update
-RUN apt-get update
-
-
-# Install packages
-RUN apt-get -yq install rsync openssh-client
-
-
-# Label
-LABEL "com.github.actions.name"="rsync deployments"
-LABEL "com.github.actions.description"="For deploying code to a webserver via rsync over ssh"
-LABEL "com.github.actions.icon"="truck"
-LABEL "com.github.actions.color"="yellow"
-
-LABEL "repository"="https://github.com/Burnett01/rsync-deployments"
-LABEL "homepage"="https://github.com/Burnett01/rsync-deployments"
-LABEL "maintainer"="Contention <hello@contention.agency> & Burnett01"
-
 
 # Copy entrypoint
-ADD entrypoint.sh /entrypoint.sh
+COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]
 
+ENTRYPOINT ["/entrypoint.sh"]

LICENSE

@@ -1,7 +1,7 @@
 MIT License
 
-Copyright (c) 2019 Contention
+Copyright (c) 2019-2021 Contention
-Copyright (c) 2019 Burnett01
+Copyright (c) 2019-2021 Burnett01
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -1,29 +1,46 @@
 # rsync deployments
 
-Forked from [Contention/rsync-deployments](https://github.com/Contention/rsync-deployments)
+This GitHub Action deploys files in `GITHUB_WORKSPACE` to a remote folder via rsync over ssh. 
 
+Use this action in a CD workflow which leaves deployable code in `GITHUB_WORKSPACE`.
 
-This GitHub Action deploys files in `GITHUB_WORKSPACE` to a folder on a server via rsync over ssh. 
+The underlaying base-image of the docker-image is very small (Alpine (no cache)) which results in fast deployments.
 
-Use this action in a build/test workflow which leaves deployable code in `GITHUB_WORKSPACE`.
+---
 
-# Required SECRETs
+## Inputs
 
-This action needs a `DEPLOY_KEY` secret variable. This should be the private key part of a ssh key pair. The public key part should be added to the authorized_keys file on the server that receives the deployment. This should be set in the Github secrets section and then referenced as an `env` variable.
+- `switches`* - The first is for any initial/required rsync flags, eg: `-avzr --delete`
 
-# ARGs
+- `rsh` - Remote shell commands
 
-This action requires 4 args in the `with` block.
+- `path` - The source path. Defaults to GITHUB_WORKSPACE
 
-1. `swtiches` - The first is for any initial/required rsync flags, eg: `-avzr --delete`
+- `remote_path`* - The deployment target path
 
-2. `rsh` - Remote shell commands, eg for using a different SSH port: `"-p ${{ secrets.DEPLOY_PORT }}"`
+- `remote_host`* - The remote host
 
-3. `path` - The source path, if none; use `""`
+- `remote_port` - The remote port. Defaults to 22
 
-4. `upload_path` - The deployment target, and should be in the format: `[USER]@[HOST]:[PATH]`
+- `remote_user`* - The remote user
 
-# Example usage
+- `remote_key`* - The remote ssh key
+
+- `remote_key_pass` - The remote ssh key passphrase (if any)
+
+``* = Required``
+
+## Required secret(s)
+
+This action needs secret variables for the ssh private key of your key pair. The public key part should be added to the authorized_keys file on the server that receives the deployment. The secret variable should be set in the Github secrets section of your org/repo and then referenced as the  `remote_key` input.
+
+> Always use secrets when dealing with sensitive inputs!
+
+For simplicity, we are using `DEPLOY_*` as the secret variables throughout the examples.
+
+## Example usage
+
+Simple:
 
 ```
 name: DEPLOY
@@ -36,22 +53,155 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v1
+    - uses: actions/checkout@v2
     - name: rsync deployments
-      uses: burnett01/rsync-deployments@1.0
+      uses: burnett01/rsync-deployments@5.0
       with:
-        switches: -avzr --delete --exclude="" --include=""
+        switches: -avzr --delete
-        rsh: "-p ${{ secrets.DEPLOY_PORT }}"
         path: src/
-        upload_path: user@example.com:/var/www/html/
+        remote_path: /var/www/html/
-
+        remote_host: example.com
-      env:
+        remote_user: debian
-        DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
+        remote_key: ${{ secrets.DEPLOY_KEY }}
-
 ```
 
-## Disclaimer
+Advanced:
 
-If you're using GitHub Actions, you probably already know that it's still in limited public beta, and GitHub advise against using Actions in production. 
+```
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: rsync deployments
+      uses: burnett01/rsync-deployments@5.0
+      with:
+        switches: -avzr --delete --exclude="" --include="" --filter=""
+        path: src/
+        remote_path: /var/www/html/
+        remote_host: example.com
+        remote_port: 5555
+        remote_user: debian
+        remote_key: ${{ secrets.DEPLOY_KEY }}
+```
 
-So, check your keys. Check your deployment paths. And use at your own risk.
+For better **security**, I suggest you create additional secrets for remote_host, remote_port, remote_user and remote_path inputs.
+
+```
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: rsync deployments
+      uses: burnett01/rsync-deployments@5.0
+      with:
+        switches: -avzr --delete
+        path: src/
+        remote_path: ${{ secrets.DEPLOY_PATH }}
+        remote_host: ${{ secrets.DEPLOY_HOST }}
+        remote_port: ${{ secrets.DEPLOY_PORT }}
+        remote_user: ${{ secrets.DEPLOY_USER }}
+        remote_key: ${{ secrets.DEPLOY_KEY }}
+```
+
+If your private key is passphrase protected you should use:
+
+```
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v2
+    - name: rsync deployments
+      uses: burnett01/rsync-deployments@5.0
+      with:
+        switches: -avzr --delete
+        path: src/
+        remote_path: ${{ secrets.DEPLOY_PATH }}
+        remote_host: ${{ secrets.DEPLOY_HOST }}
+        remote_port: ${{ secrets.DEPLOY_PORT }}
+        remote_user: ${{ secrets.DEPLOY_USER }}
+        remote_key: ${{ secrets.DEPLOY_KEY }}
+        remote_key_pass: ${{ secrets.DEPLOY_KEY_PASS }}
+```
+---
+
+## Version 4.0 & 4.1
+
+Looking for version 4.0 and 4.1?
+
+Check here: 
+
+- https://github.com/Burnett01/rsync-deployments/tree/4.0
+- https://github.com/Burnett01/rsync-deployments/tree/4.1
+
+Version 4.0 & 4.1 use the ``drinternet/rsync:1.0.1`` base-image.
+
+---
+
+## Version 3.0
+
+Looking for version 3.0?
+
+Check here: https://github.com/Burnett01/rsync-deployments/tree/3.0
+
+Version 3.0 uses the ``alpine:latest`` base-image directly.<br>
+Consider upgrading to 4.0 that uses a docker-image ``drinternet/rsync:1.0.1`` that is<br>
+based on ``alpine:latest``and heavily optimized for rsync.
+
+## Version 2.0 (EOL)
+
+Looking for version 2.0?
+
+Check here: https://github.com/Burnett01/rsync-deployments/tree/2.0
+
+Version 2.0 uses a larger base-image (``ubuntu:latest``).<br>
+Consider upgrading to 3.0 for even faster deployments.
+
+## Version 1.0 (EOL)
+
+Looking for version 1.0?
+
+Check here: https://github.com/Burnett01/rsync-deployments/tree/1.0
+
+Please note that version 1.0 has reached end of life state.
+
+---
+
+## Acknowledgements
+
++ This project is a fork of [Contention/rsync-deployments](https://github.com/Contention/rsync-deployments)
++ Base image [JoshPiper/rsync-docker](https://github.com/JoshPiper/rsync-docker)
+
+---
+
+## Media
+
+This action was featured in multiple blogs across the globe:
+
+- https://leobrack.co.uk/blog/2020-02-15-automatically-push-changes-to-your-live-site-with-github-actions
+
+- https://blog.maniak.co/ci-cd-for-wordpress/
+
+- https://elijahverdoorn.com/2020/04/14/automating-deployment-with-github-actions/
+
+- https://www.vektor-inc.co.jp/post/github-actions-deploy/
+
+- https://ews.ink/tech/blog-deploy-2/
+
+- https://webpick.info/automatiser-avec-github-actions/
+
+- https://matthias-andrasch.eu/blog/2021/tutorial-webseite-mittels-github-actions-deployment-zu-uberspace-uebertragen-rsync/
+
+- https://mikael.koutero.me/posts/hugo-github-actions-deploy-rsync/
+
+- https://cdmana.com/2021/02/20210208122400688I.html
+
+- https://jishuin.proginn.com/p/763bfbd38928
+
+- https://cloud.tencent.com/developer/article/1786522
+
+- http://www.ningco.cn/github_action_deploy_blog/
+
+- https://qdmana.com/2021/01/20210127094413405u.html

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions are currently being supported with security updates:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.0   | :white_check_mark: |
+| 4.1   | :white_check_mark: |
+| 4.0   | :white_check_mark: |
+| 3.0   | :white_check_mark: |
+| 2.0   | :x:                |
+| 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+You can report a vulnerability by creating an issue.

action.yml

@@ -13,9 +13,26 @@ inputs:
     description: 'The local path'
     required: false
     default: ''
-  upload_path:
+  remote_path:
     description: 'The remote path'
     required: true
+  remote_host:
+    description: 'The remote host'
+    required: true
+  remote_port:
+    description: 'The remote port'
+    required: false
+    default: 22
+  remote_user:
+    description: 'The remote user'
+    required: true
+  remote_key:
+    description: 'The remote key'
+    required: true
+  remote_key_pass:
+    description: 'The remote key passphrase'
+    required: false
+    default: ''
 runs:
   using: 'docker'
   image: 'Dockerfile'

entrypoint.sh

@@ -1,17 +1,17 @@
 #!/bin/sh
 
+# Start the SSH agent and load key.
+source agent-start "$GITHUB_ACTION"
+echo "$INPUT_REMOTE_KEY" | SSH_PASS="$INPUT_REMOTE_KEY_PASS" agent-add
+
+# Add strict errors.
 set -eu
 
-# Set deploy key
+# Variables.
-SSH_PATH="$HOME/.ssh"
+SWITCHES="$INPUT_SWITCHES"
-# Create .ssh dir if it doesn't exist
+RSH="ssh -o StrictHostKeyChecking=no -p $INPUT_REMOTE_PORT $INPUT_RSH"
-if [ ! -d "$SSH_PATH" ]; then
+LOCAL_PATH="$GITHUB_WORKSPACE/$INPUT_PATH"
-  mkdir "$SSH_PATH"
+DSN="$INPUT_REMOTE_USER@$INPUT_REMOTE_HOST"
-fi
-# Place deploy_key into .ssh dir
-echo "$DEPLOY_KEY" > "$SSH_PATH/deploy_key"
-# Set r+w to user only
-chmod 600 "$SSH_PATH/deploy_key"
 
-# Do deployment
+# Deploy.
-sh -c "rsync $INPUT_SWITCHES -e 'ssh -i $SSH_PATH/deploy_key -o StrictHostKeyChecking=no $INPUT_RSH' $GITHUB_WORKSPACE/$INPUT_PATH $INPUT_UPLOAD_PATH"
+sh -c "rsync $SWITCHES -e '$RSH' $LOCAL_PATH $DSN:$INPUT_REMOTE_PATH"