wearerequired / git-mirror-action Goto Github PK

View Code? Open in Web Editor NEW

144.0 4.0 64.0 21 KB

⏭ A GitHub Action for mirroring a git repository to another location via SSH.

License: MIT License

Dockerfile 7.61% Shell 92.39%

github-action workflow ssh

git-mirror-action's Introduction

Git Mirror Action

A GitHub Action for mirroring a git repository to another location via SSH.

Inputs

`source-repo`

Required SSH URL of the source repo.

`destination-repo`

Required SSH URL of the destination repo.

`dry-run`

Optional (default: false) Execute a dry run. All steps are executed, but no updates are pushed to the destination repo.

Environment variables

SSH_PRIVATE_KEY: Create a SSH key without a passphrase which has access to both repositories. On GitHub you can add the public key as a deploy key to the repository. GitLab has also deploy keys with write access and for any other services you may have to add the public key to your personal account.
Store the private key as an encrypted secret and use it in your workflow as seen in the example workflow below.

SSH_KNOWN_HOSTS: Known hosts as used in the known_hosts file. StrictHostKeyChecking is disabled in case the variable isn't available.

If you added the private key or known hosts in an environment make sure to reference the environment name in your workflow otherwise the secret is not passed to the workflow.

Example workflow

name: Mirror to Bitbucket Repo

on: [ push, delete, create ]

# Ensures that only one mirror task will run at a time.
concurrency:
  group: git-mirror

jobs:
  git-mirror:
    runs-on: ubuntu-latest
    steps:
      - uses: wearerequired/git-mirror-action@v1
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
          SSH_KNOWN_HOSTS: ${{ secrets.SSH_KNOWN_HOSTS }}
        with:
          source-repo: "[email protected]:wearerequired/git-mirror-action.git"
          destination-repo: "[email protected]:wearerequired/git-mirror-action.git"

Docker

docker run --rm -e "SSH_PRIVATE_KEY=$(cat ~/.ssh/id_rsa)" $(docker build -q .) "$SOURCE_REPO" "$DESTINATION_REPO"

License

The Dockerfile and associated scripts and documentation in this project are released under the MIT License.

git-mirror-action's People

Contributors

Stargazers

Watchers

git-mirror-action's Issues

need an option to choose branch

need an option to choose branch.
thanks!

关于公钥

在知乎看到了您的文章，请问这句话“然后将公钥（***.pub）的内容添加到github和gitee的可信名单里”，可信名单是指什么功能项吗，没有找到。

If destination-repo has an SSH port other than 22, it is ignored

Hello,

This settings

          destination-repo: "git@gitlab.[REDACTED]:2224/[REDACTED]/[REDACTED]/[REDACTED].git"

leads to

WARNING: StrictHostKeyChecking disabled
[email protected]:[REDACTED]/[REDACTED]git
DESTINATION=git@gitlab.[REDACTED]:2224/[REDACTED]/[REDACTED]/[REDACTED].git
DRY RUN=false
Cloning into bare repository '[REDACTED].git'...
Warning: Permanently added 'github.com' (ED25519) to the list of known hosts.
ssh: connect to host gitlab.[REDACTED] port 22: Address not available
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Maybe I miss or needs to change something? Tnx a lot.

Mirror actions don't work on PRs from Dependabot

Pretty much like the title says, this action doesn't run correctly on PR from Dependabot. As far as I know, this is the only scenario where it fails (i.e., on PR opened by myself it runs smoothly).

The configuration is here https://github.com/stefanobartoletti/bricks/blob/master/.github/workflows/mirror.yml

And this is the output:

Does Dependabot need to be given some permission in some way? Can you help me solve this?

Naturally, feel free to ask for more info if you need them. :)

Option to pass a git hash to clone

There should be a posibility to select specific git hash to checkout on the destination directory. Sometimes its needed to checkout a specific version form git instead of HEAD

Can't push to remote repository because of wrong host

Hi,

It looks like the action added the wrong host so it got rejected. Is it possible to add another host?

Warning: Permanently added 'github.com,140.82.112.3' (RSA) to the list of known hosts.
[email protected]: Permission denied (publickey).
fatal: Could not read from remote repository.

2 个私库之间是是不能同步的吧 / It is not possible to synchronise between 2 private libraries, right?

我试了很多次，不知道是配置问题还是，2 个私库之间同步一直是失败的。github私库到 gitee 私库，请教大佬了

Translation: I've tried many times, I don't know if it's a configuration problem or if the sync between the 2 private repositories keeps failing. github private repository to gitee private repository, please advise me!

Is there a way that I can mirror a repo but not push forcely?

This is the situation: I need synchronize a repository from somewhere to Github, and do it daily or weekly. Using Github actions is a good choice. So I add .github/workflows/main.yml for doing this job after I mirrored the repo. However, every time after mirroring, my .github/workflows/main.yml will vanish dut to it is not in the source repo.

I'm wondering if there's a way that the synchronization is not forcely so that Github actions job keeps safe.

GITHUB_TOKEN permissions used by this action

At https://github.com/step-security/secure-workflows we are building a knowledge-base (KB) of GITHUB_TOKEN permissions needed by different GitHub Actions. When developers try to set minimum token permissions for their workflows, they can use this knowledge-base instead of trying to research permissions needed by each GitHub Action they use.

Below you can see the KB of your GITHUB Action.

name: 'Mirror a repository using SSH' # wearerequired/git-mirror-action
# GITHUB_TOKEN not used

If you think this information is not accurate, or if in the future your GitHub Action starts using a different set of permissions, please create an issue at https://github.com/step-security/secure-workflows/issues to let us know.

This issue is automatically created by our analysis bot, feel free to close after reading :)

References:

GitHub asks users to define workflow permissions, see https://github.blog/changelog/2021-04-20-github-actions-control-permissions-for-github_token/ and https://docs.github.com/en/actions/security-guides/automatic-token-authentication#modifying-the-permissions-for-the-github_token for securing GitHub workflows against supply-chain attacks.

Setting minimum token permissions is also checked for by Open Source Security Foundation (OpenSSF) Scorecards. Scorecards recommend using https://github.com/step-security/secure-workflows so developers can fix this issue in an easier manner.

Can this action be used in private repos?

As the title says, I'm wondering if this action can be used in private repos.

I'm mirroring some of my repos here on GitHub to GitLab, and everything went fine with some that are public.

When I tried to do the same thing to a couple repos that are private here on GitHub, the action fails, giving me this output

Cloning into bare repository 'sb-website-wip.git'...
[email protected]:stefanobartoletti/sb-website-wip.git
[email protected]:stefanobartoletti/sb-website-wip.git
Warning: Permanently added 'github.com,140.82.114.4' (RSA) to the list of known hosts.
ERROR: Repository not found.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
fatal: not a git repository (or any parent up to mount point /github)
Stopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set).

I have configured the repos in the same way of the working public ones, the only difference is that these are private.

Is there a way to solve this?

jobs:
  git-mirror:
    runs-on: ubuntu-latest
    steps:
      - uses: wearerequired/git-mirror-action@v1
        env:
          SSH_PRIVATE_KEY: ${{ secrets.SYNC_REPO_PRIVATE_KEY }}
        with:
          source-repo: "[email protected]:source.git"
          destination-repo: "[email protected]:destination.git"