-
Notifications
You must be signed in to change notification settings - Fork 115
/
action.yml
66 lines (60 loc) · 2.11 KB
/
action.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# Copyright 2023 SLSA Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: "Secure folder upload"
description: "Upload a folder as a tarball and outputs its SHA256"
inputs:
name:
description:: >
Artifact name.
The caller is responsible to provide a name that is unique and does not collise with other artifacts.
An example is to use `${RNG}-artifact`.
required: true
path:
description: 'Path to the folder'
required: true
outputs:
sha256:
description: "SHA256 of the uploaded tarball."
value: "${{ steps.upload.outputs.sha256 }}"
runs:
using: "composite"
steps:
- name: Validate the path and create the tarball
id: create
shell: bash
env:
UNTRUSTED_PATH: ${{ inputs.path }}
run: |
set -euo pipefail
if [[ ! -d "${UNTRUSTED_PATH}" ]]; then
echo "'${UNTRUSTED_PATH}' is not a directory"
exit 1
fi
# Ensure no directory traversal.
resolved_dir=$(readlink -m "${UNTRUSTED_PATH}")
wd=$(readlink -m "$PWD")
if [[ "$resolved_dir" != "$wd"/* ]]; then
echo "Path is not in the current directory: ${UNTRUSTED_PATH}"
exit 1
fi
tempdir=$(mktemp -d)
tarball_path="${tempdir}/folder.tgz"
tar -czvf "${tarball_path}" "${UNTRUSTED_PATH}"
echo "tarball-path=${tarball_path}" >> "$GITHUB_OUTPUT"
- name: Upload the artifact
id: upload
uses: slsa-framework/slsa-github-generator/.github/actions/secure-upload-artifact@v1.10.0
with:
name: "${{ inputs.name }}"
path: "${{ steps.create.outputs.tarball-path }}"