Add an environment variable to indicate which repository the currently running Action came from. - #585
Conversation
| // Set GITHUB_ACTION_REPOSITORY if this Action is from a repository | ||
| if (actionStep.Action.Reference is Pipelines.RepositoryPathReference repositoryReference) | ||
| { | ||
| step.ExecutionContext.SetGitHubContext("action_repository", repositoryReference.Name); |
There was a problem hiding this comment.
I notice the RepositoryPathReference also has a Ref field. Would it be ok to also make that available, perhaps as a action_ref var? That would be very useful for code scanning as we've been wanting to include that data in our status reports, but couldn't work out how to get it. Doesn't have to be in this PR if the extra change would slow it down.
There was a problem hiding this comment.
Yes, sure. I've added that field as well.
…y running Action came from.
|
@joshhale Do you know what the best way is to get this reviewed? |
|
@TingluoHuang do you have time to review this PR? |
| private readonly HashSet<string> _contextEnvWhitelist = new HashSet<string>(StringComparer.OrdinalIgnoreCase) | ||
| { | ||
| "action", | ||
| "action_ref", |
There was a problem hiding this comment.
@chrispat any objection to adding these 2 new environment variables?
…ctionRunner.cs`.
| } | ||
|
|
||
| // Set GITHUB_ACTION_REPOSITORY if this Action is from a repository | ||
| if (Action.Reference is Pipelines.RepositoryPathReference repoPathReferenceAction) |
There was a problem hiding this comment.
what's the value would be if i use the action from the checkout repo.
ex:
- use: ./localaction
with:
foo: bar
There was a problem hiding this comment.
It looks like currently they are both set to the empty string. Do you think that's reasonable or should they just not be set at all in that case?
There was a problem hiding this comment.
maybe just not set.
if (Action.Reference is Pipelines.RepositoryPathReference repoPathReferenceAction &&
!string.Equals(repoPathReferenceAction.RepositoryType, Pipelines.PipelineConstants.SelfAlias, StringComparison.OrdinalIgnoreCase))
{
// set action_repo/action_ref
}
|
It looks like retargeting from |
it fine to include that commit. :) |
…y running Action came from. (actions#585) * add `workflow_dispatch` * Add an environment variable to indicate which repository the currently running Action came from. * Expose the Action ref as well. * Move setting `github.action_repository` and `github.action_ref` to `ActionRunner.cs`. * Don't set `action_repository` and `action_ref` for local Actions. Co-authored-by: Tingluo Huang <tingluohuang@github.com>
…y running Action came from. (#585) * add `workflow_dispatch` * Add an environment variable to indicate which repository the currently running Action came from. * Expose the Action ref as well. * Move setting `github.action_repository` and `github.action_ref` to `ActionRunner.cs`. * Don't set `action_repository` and `action_ref` for local Actions. Co-authored-by: Tingluo Huang <tingluohuang@github.com>
…, DinD, GitHub App auth) - Multi-arch (amd64/arm64) Dockerfile based on Ubuntu 24.04 LTS, running the official actions/runner with an internal Docker-in-Docker daemon. - entrypoint.sh + scripts/generate-installation-token.sh + scripts/register-and-run.sh: mint a GitHub App installation token and a fresh runner registration token on every start/stop (repo/org/enterprise scope), configure the runner as --ephemeral, run one job, then deregister via a trap on SIGTERM/SIGINT/EXIT so nothing ever shows up "offline". - CI/CD: hadolint + shellcheck + build smoke-test on PR; multi-arch build/publish to GHCR with Trivy scan gate, cosign keyless signing, SBOM and provenance attestation on push/tag; CodeQL and OpenSSF Scorecard for trust badges; Dependabot for base image and Actions version bumps. - docs/github-app-setup.md walks through creating/installing the App. - README.md, SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, MIT LICENSE. Note: an Alpine-based variant was evaluated and rejected — the official actions/runner release binaries fail at ./config.sh on musl libc even with gcompat installed (known upstream limitation, actions/runner#585), so Ubuntu 24.04 LTS is used as the officially supported platform. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
5 participants
For certain types of Actions, it can be useful for the Action to know what repository it came from. For example the github/codeql-action needs to access binary files stored in GitHub Releases artifacts on its own repository.
Currently if this Action is mirrored on GitHub Enterprise Server under a different name it will be unable to locate its release artifacts as it always expects them to be in the
github/codeql-actionrepository.This change adds a
github.action_repositorycontext variable (and correspondingGITHUB_ACTION_REPOSITORYenvironment variable) that is set to the NWO of the repository which the Action came from. It is not set for script or Container Registry Actions. It is set to the empty string if the Action reference is relative to the checkout repository.This allows Actions to be aware of their own source repository and therefore reach back out to them to do things like downloading extra artifacts.
Apologies if I've missed an existing way of getting this information, but I couldn't find one other than looking at the path which the Action is checked out to; I wasn't sure that this was a stable interface to rely on.