You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tooling.apache.org by ar...@apache.org on 2026/09/24 09:47:32 UTC
(tooling-actions) branch main updated: Make sure SHA can be specified, for the case where checkout is a different revision
This is an automated email from the ASF dual-hosted git repository.
alitheg pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tooling-actions.git
The following commit(s) were added to refs/heads/main by this push:
new 375cba4 Make sure SHA can be specified, for the case where checkout is a different revision
375cba4 is described below
commit 375cba41b059c1d841d47850024153dec9c0f6cf
Author: Alastair McFarlane <al...@gmail.com>
AuthorDate: Thu Sep 24 10:46:52 2026 +0100
Make sure SHA can be specified, for the case where checkout is a different revision
---
upload-to-atr/README.md | 13 +++++++---
upload-to-atr/action.yml | 64 ++++++++++++++++++++++++++++++++++++++++++------
2 files changed, 67 insertions(+), 10 deletions(-)
diff --git a/upload-to-atr/README.md b/upload-to-atr/README.md
index b027a7d..186eb59 100644
--- a/upload-to-atr/README.md
+++ b/upload-to-atr/README.md
@@ -11,10 +11,11 @@ Status: PRODUCTION
## Inputs
- **project (required)**: Project name segment in the remote path.
-- **version (required)**: Version segment in the remote path.
+- **version (required)**: Version segment in the remote path. This is the ATR version name, which may only contain letters, numbers, `+`, `.` and `-`, so a git ref such as `rel/1.2.3` can't be passed through directly.
- **src**: Local directory to upload. Default: `dist`. A trailing slash will be added automatically if omitted.
-- **atr-host**: ATR host to upload to. Default: `releases.apache.org`.
+- **atr-host**: ATR host to upload to. Must be an `apache.org` host. Default: `releases.apache.org`.
- **ssh-port**: SSH port on ATR. Default: `2222`.
+- **source-commit**: Full 40 character hash of the commit that the upload was built from. Default: `HEAD` of the checkout in `$GITHUB_WORKSPACE`, if that is a checkout of the repository running the workflow, and otherwise nothing.
## Example workflow
@@ -25,6 +26,10 @@ name: Upload to ATR
on:
workflow_dispatch:
+ inputs:
+ version:
+ description: "Version to upload, e.g. 1.2.3-rc1"
+ required: true
jobs:
upload:
@@ -48,7 +53,7 @@ jobs:
uses: apache/tooling-actions/upload-to-atr@<COMMIT>
with:
project: example
- version: ${{ github.ref_name }}
+ version: ${{ inputs.version }}
```
## Further details
@@ -58,3 +63,5 @@ The job must grant `id-token: write` so that this action can request a GitHub OI
This action generates an ephemeral Ed25519 SSH key, registers its public key with ATR using the GitHub JWT, which is checked used JWKS, and discards the key after the job. SSH uses `StrictHostKeyChecking=accept-new` so that the host key is learned on first connection.
The remote path is `/<project>/<version>/`. The contents of `src` are synced to ATR. ATR will create a new revision of the project with the synced files. If `rsync` is missing on the runner, this action installs it.
+
+ATR records the commit that the workflow was triggered on, from the signed GitHub JWT. A workflow can check out a different commit, for example by passing `ref` to `actions/checkout`, so this action also declares the commit that was actually checked out and ATR uses that as the release's source commit. ATR compares source archives against a clone of the repository at that commit, which is how a wrong declaration would be caught. If the workflow checks out the source somewhere other than [...]
diff --git a/upload-to-atr/action.yml b/upload-to-atr/action.yml
index c1ecf51..307734c 100644
--- a/upload-to-atr/action.yml
+++ b/upload-to-atr/action.yml
@@ -26,6 +26,7 @@ inputs:
src: {description: "Local directory", default: "dist"}
atr-host: {description: "ATR host", default: "releases.apache.org"}
ssh-port: {description: "SSH port", default: "2222"}
+ source-commit: {description: "Commit the upload was built from", default: ""}
runs:
using: "composite"
@@ -37,8 +38,24 @@ runs:
INPUTS_ATR_HOST: ${{ inputs.atr-host }}
run: |
set -euo pipefail
+ # Check the host before minting a token, as the token is later sent to it
+ if ! [[ "${INPUTS_ATR_HOST}" =~ ^[A-Za-z0-9.-]+\.apache\.org$ ]]
+ then
+ echo "::error::atr-host must be a host name ending in .apache.org"
+ exit 1
+ fi
+ if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" || -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]]
+ then
+ echo "::error::Unable to request a GitHub OIDC token - the job needs the 'id-token: write' permission"
+ exit 1
+ fi
url="${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=https://${INPUTS_ATR_HOST}/"
- jwt="$(curl -sS --fail-with-body -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "$url" | jq -r .value)"
+ jwt="$(curl -sS --fail-with-body -H "Authorization: bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" "$url" | jq -r '.value // empty')"
+ if [[ -z "$jwt" ]]
+ then
+ echo "::error::GitHub did not return an OIDC token"
+ exit 1
+ fi
echo "::add-mask::$jwt"
echo "jwt=$jwt" >> "$GITHUB_OUTPUT"
@@ -51,24 +68,57 @@ runs:
echo "ssh_private_key_path=$RUNNER_TEMP/ssh_key" >> "$GITHUB_OUTPUT"
echo "ssh_public_key=$(cat "$RUNNER_TEMP/ssh_key.pub")" >> "$GITHUB_OUTPUT"
+ - name: Determine the source commit
+ id: source-commit
+ shell: bash
+ run: |
+ set -euo pipefail
+ commit="${INPUTS_SOURCE_COMMIT,,}"
+ if [[ -z "$commit" ]]
+ then
+ # Only use the workspace checkout if it's of this repository, otherwise we'd declare an unrelated commit
+ if origin="$(git -C "$GITHUB_WORKSPACE" remote get-url origin 2> /dev/null)"
+ then
+ origin="${origin%.git}"
+ if [[ "${origin,,}" == "${GITHUB_SERVER_URL,,}/${GITHUB_REPOSITORY,,}" ]]
+ then
+ commit="$(git -C "$GITHUB_WORKSPACE" rev-parse HEAD)"
+ fi
+ fi
+ fi
+ if [[ -n "$commit" ]]
+ then
+ if ! [[ "$commit" =~ ^[0-9a-f]{40}$ ]]
+ then
+ echo "::error::source-commit must be a 40 character commit hash"
+ exit 1
+ fi
+ if [[ "$commit" != "$GITHUB_SHA" ]]
+ then
+ echo "::notice::Declaring source commit $commit, which differs from the triggering commit $GITHUB_SHA"
+ fi
+ fi
+ echo "source_commit=$commit" >> "$GITHUB_OUTPUT"
+ env:
+ INPUTS_SOURCE_COMMIT: ${{ inputs.source-commit }}
+
- name: Register the ephemeral SSH key with ATR
shell: bash
run: |
- set -euxo pipefail
- case "${INPUTS_ATR_HOST}" in
- *.apache.org) ;;
- *) echo "atr-host must match *.apache.org"; exit 1;;
- esac
+ set -euo pipefail
jq -n --arg publisher github \
--arg jwt "$JWT" \
--arg key "$SSH_PUBLIC_KEY" \
- '{publisher:$publisher, jwt:$jwt, ssh_key:$key}' |
+ --arg commit "$SOURCE_COMMIT" \
+ '{publisher:$publisher, jwt:$jwt, ssh_key:$key}
+ + (if $commit == "" then {} else {source_commit:$commit} end)' |
curl -sS --fail-with-body -X POST -H 'Content-Type: application/json' -d @- \
"https://${INPUTS_ATR_HOST}/api/publisher/ssh/register"
env:
INPUTS_ATR_HOST: ${{ inputs.atr-host }}
JWT: ${{ steps.create-github-jwt.outputs.jwt }}
SSH_PUBLIC_KEY: ${{ steps.generate-ssh-key.outputs.ssh_public_key }}
+ SOURCE_COMMIT: ${{ steps.source-commit.outputs.source_commit }}
- name: Upload to ATR using rsync
shell: bash
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@tooling.apache.org
For additional commands, e-mail: commits-help@tooling.apache.org