easingthemes / ssh-deploy

GitHub Action for deploying code via rsync over ssh. (with NodeJS)
MIT License
1.17k stars 144 forks source link

TARGET should not have a default value #176

Closed ashermiddleton closed 3 months ago

ashermiddleton commented 9 months ago

As mentioned in #145 if the TARGET argument is unspecified then the action should exit and return an error before any changes are made to the filesystem. In other words, TARGET should not have a default value. If TARGET is assigned to a non-existent GitHub secret or empty variable then it will proceed to work in the /home/REMOTE_USER directory, in accordance with the docs:

TARGET (optional, default '/home/REMOTE_USER/')

I think it's clear to see why this behaviour is extremely dangerous, as the suggested workflow rsync args will cause the recursive removal of all files and directories in the home directory as well as placing the files in the wrong directory. Even if the docs for this action are read thouroughly and rsync args are handcrafted, if a GitHub secret is removed by accident and this workflow runs then it's likely going to cause headaches. TARGET should always be explicitly defined to prevent this

Relevant code, src/inputs.js#L14

EDIT: Wording, relevant line

github-actions[bot] commented 3 months ago

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days.