Skip to content

GitHub Actions

Jump to bottom
Márton Elekes edited this page Apr 21, 2023 · 27 revisions

Introduction

Here

Use commit hash instead of tags for actions in untrusted repos

In case of third-party GitHub Actions (not the official actions/...) use commit hash instead of tag names. This way the author cannot change the behaviour unnoticed and it can be reviewed before usage.

uses: maxheld83/ghpages@68f783a4f5313d776c1599e18479607e71c9c738  # v0.3.0

Official guide

Or fork the repository to have control over the tags. (src)

Do not use your classic Personal Access Token (PAT) in CI

Personal access token grants access to all of your repository. Consider using deploy key for Git operations or PAT of a new machine user (bot) for API calls. You can try the new fine-grained personal access token (beta) if applicable.

Official guide

Limit GITHUB_TOKEN permissions

By default GitHub Actions have a GITHUB_TOKEN with write permission to the repo (code, issues, PRs, etc.). (source)

  • if possible, limit to read-only contents and metadata access in repo settings: guide
  • if not, set per workflow and per job permissions
    • limit the workflow to have only read access to contents by default (example) 
      permissions:
  contents: read
    • add extra permissions to jobs needing them
    • permissions key syntax

Deploy to GitHub Pages

If running on master branch, overwrite the content of gh-pages branch with the current out folder.

https://github.com/JamesIves/github-pages-deploy-action

    - name: Deploy 🚀
      uses: JamesIves/github-pages-deploy-action@ba1486788b0490a235422264426c45848eac35c6  # v4.4.1
      with:
        branch: gh-pages
        folder: out
        single-commit: true
      if: github.event_name == 'push' && github.ref == 'refs/heads/master'

Notes:

  • You have to grant write permission to GitHub Actions. Go to repository settings: Settings/Actions/General and set Workflow permissions to Read and write permissions.
  • GitHub Pages in the "Deploy from a branch" setting seems to use the person activated GH Pages as author for the deployment.
    • If this person loses access, turn off and on GH Pages by deleting gh-pages branch then push to the branch and configure Pages settings as previously. (Or try Build and deployment source: GitHub Actions.)

Alternatives (not tested)

Only run job on specific branch

if: github.event_name == 'push' && github.ref == 'refs/heads/master'

(source)

Run GitHub Actions locally

https://github.com/nektos/act
(not tested)

Docker images

Cache Docker image layers

https://github.com/TransformationToolContest/ttc2018liveContest/commit/aa4b6eb54aca939bf345827ca5e30d824b53600a

File permission denied when using Docker images

Official manual suggests avoiding USER instruction in Dockerfile and run as root inside the container to access /github/workspace folder.

When using jobs.<job_id>.container you can set options: --user 1001 like in the following example (cf. 1, 2, 3).

    container:
      image: {hub-user}/{repo}:{tag}
      options: --user root

When using uses: docker://{hub-user}/{repo}:{tag} a workaround could be changing permissions first, then restoring them:

      - name: Change permissions for Docker image
        run: sudo chown -R 1000:100 .
      - name: Run notebook
        uses: docker://jupyter/scipy-notebook
        with:
          entrypoint: /bin/bash
          args: -c "jupyter nbconvert --execute --to notebook notebook.ipynb"
      - name: Restore permissions
        run: sudo chown -R $(id -u):$(id -g) .

Debugging

Possible solutions:

Cross-repository triggers

Possible (untested) solutions:

Running out of disk space (No space left on device)

Try out these:

Clone this wiki locally