porta/action.yml at develop · almide/porta · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
name: porta
description: Install porta, checked against its signature, with what it needs to confine commands on this runner.
author: almide
branding:
  icon: shield
  color: gray-dark

inputs:
  version:
    description: >
      The release to install, as its tag (v0.6.12). Empty installs the tag this
      action was used at (`uses: almide/[email protected]`), or the latest release
      when it was used at a branch.
    default: ""
  namespaces:
    description: >
      On a Linux runner that restricts unprivileged user namespaces through
      AppArmor (Ubuntu 23.10 and later, the hosted runners among them), load
      the profile Ubuntu documents for porta alone, so each command gets its
      own PID, mount and network namespace, and the protections that need
      one. Needs sudo.
    default: "true"
  why:
    description: Install strace, which `porta run --why` traces a Linux run with.
    default: "false"

outputs:
  path:
    description: The installed porta binary.
    value: ${{ steps.install.outputs.path }}

runs:
  using: composite
  steps:
    # The installer checks the release's signature wherever cosign is on the
    # PATH, and PORTA_REQUIRE_SIGNATURE makes a missing one fatal.
    - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
    - id: install
      shell: bash
      env:
        VERSION: ${{ inputs.version }}
        ACTION_REF: ${{ github.action_ref }}
        INSTALL_DIR: ${{ runner.temp }}/porta-bin
      run: |
        tag="$VERSION"
        if [ -z "$tag" ] && [[ "$ACTION_REF" == v* ]]; then tag="$ACTION_REF"; fi
        PORTA_RELEASE_TAG="$tag" PORTA_REQUIRE_SIGNATURE=1 bash "$GITHUB_ACTION_PATH/scripts/install.sh" "$INSTALL_DIR"
        echo "$INSTALL_DIR" >> "$GITHUB_PATH"
        echo "path=$INSTALL_DIR/porta" >> "$GITHUB_OUTPUT"
    - if: runner.os == 'Linux' && inputs.namespaces == 'true'
      shell: bash
      env:
        PORTA: ${{ steps.install.outputs.path }}
      run: |
        if "$PORTA" check | grep -qE '^ok +own PID, mount and network namespace'; then
          echo "this runner already gives porta its namespaces"
        elif command -v apparmor_parser >/dev/null; then
          # A root-owned copy with the profile for it alone (what `porta setup`
          # does, spelled out so any release can use it). The runner's
          # /usr/local/bin is writable by its user, so the copy goes in a
          # directory root alone owns, put first on the PATH.
          sudo install -d -o root -g root -m 0755 /usr/libexec/porta
          sudo install -o root -g root -m 0755 "$PORTA" /usr/libexec/porta/porta
          sudo bash "$GITHUB_ACTION_PATH/scripts/apparmor-userns.sh" /usr/libexec/porta/porta
          echo /usr/libexec/porta >> "$GITHUB_PATH"
        else
          echo "::warning::this runner refuses unprivileged user namespaces and has no AppArmor to grant them; porta runs without them and says what that leaves open"
        fi
    - if: runner.os == 'Linux' && inputs.why == 'true'
      shell: bash
      run: command -v strace >/dev/null || (sudo apt-get update -qq && sudo apt-get install -y -qq strace)
    # The porta the following steps find, which after the profile step is the
    # root-owned copy.
    - shell: bash
      run: |
        porta --version
        porta check