Skip to content

feat: add support for SSH deploy keys #64

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 3, 2023
Merged

feat: add support for SSH deploy keys #64

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 34 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ jobs:
name: "Bump version and create changelog with commitizen"
steps:
- name: Check out
uses: actions/checkout@v2
uses: actions/checkout@v3
with:
fetch-depth: 0
token: "${{ secrets.GITHUB_TOKEN }}"
Expand All @@ -66,7 +66,8 @@ jobs:

| Name | Description | Default |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
| `github_token` | Token for the repo. Can be passed in using `${{ secrets.GITHUB_TOKEN }}` **required** | - |
| `github_token` | Token for the repo. Can be passed in using `${{ secrets.GITHUB_TOKEN }}`. Required if `use_ssh: false` | - |
| `use_ssh` | Set to true if ssh-key has been configured for the `actions/checkout` | `false` |
| `dry_run` | Run without creating commit, output to stdout | false |
| `repository` | Repository name to push. Default or empty value represents current github repository | current one |
| `branch` | Destination branch to push changes | Same as the one executing the action by default |
Expand Down Expand Up @@ -94,6 +95,37 @@ jobs:

The new version is also available as an environment variable under `REVISION` or you can access using `${{ steps.cz.outputs.version }}`

## Using SSH with deploy keys

1. Create a [deploy key](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys#deploy-keys) (which is the SSH **public key**)
2. Add the **private key** as a [Secret](https://docs.github.com/en/actions/security-guides/encrypted-secrets#creating-encrypted-secrets-for-a-repository) in your repository, e.g: `COMMIT_KEY`
3. Set up your action

```yaml
name: Bump version

on:
push:
branches:
- main

jobs:
bump-version:
if: "!startsWith(github.event.head_commit.message, 'bump:')"
runs-on: ubuntu-latest
name: "Bump version and create changelog with commitizen"
steps:
- name: Check out
uses: actions/checkout@v3
with:
fetch-depth: 0
ssh-key: '${{ secrets.COMMIT_KEY }}'
- name: Create bump and changelog
uses: commitizen-tools/commitizen-action@master
with:
use_ssh: true
```

## Troubleshooting

### Other actions are not triggered when the tag is pushed
Expand Down
6 changes: 5 additions & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,11 @@ inputs:
required: false
github_token:
description: 'Token for the repo. Can be passed in using $\{{ secrets.GITHUB_TOKEN }}'
required: true
required: false
use_ssh:
description: 'Set to true if ssh-key has been configured for the actions/checkout'
required: false
default: "false"
repository:
description: 'Repository name to push. Default or empty value represents current github repository (${GITHUB_REPOSITORY})'
default: ''
Expand Down
8 changes: 6 additions & 2 deletions entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ set -e
gpg --version
git --version

if [[ -z $INPUT_GITHUB_TOKEN ]]; then
echo 'Missing input "github_token: ${{ secrets.GITHUB_TOKEN }}".' >&2
if [[ -z $INPUT_GITHUB_TOKEN && $INPUT_USE_SSH != "true" ]]; then
echo 'Missing input "github_token: ${{ secrets.GITHUB_TOKEN }}" or "use_ssh", choose one.' >&2
exit 1
fi

Expand Down Expand Up @@ -92,6 +92,10 @@ if [[ $INPUT_PUSH == 'true' ]]; then
if [[ $INPUT_MERGE != 'true' && $GITHUB_EVENT_NAME == 'pull_request' ]]; then
echo "Refusing to push on pull_request event since that would merge the pull request." >&2
echo "You probably want to run on push to your default branch instead." >&2
elif [[ $INPUT_USE_SSH == "true" ]]; then
echo "Pushing to branch using SSH..."
REMOTE_REPO="[email protected]:${INPUT_REPOSITORY}.git"
git push "$REMOTE_REPO" "HEAD:${INPUT_BRANCH}" --tags
else
echo "Pushing to branch..."
REMOTE_REPO="https://${GITHUB_ACTOR}:${INPUT_GITHUB_TOKEN}@github.com/${INPUT_REPOSITORY}.git"
Expand Down