Standalone action

[assignUser]

I have created the standalone action and updated the files in inst accordingly. I tested this here: https://github.com/assignUser/simstudy/runs/4740711766?check_suite_focus=true Maybe @lorenzwalthert you can test it with {styler}? But please update your RSPM link, see: https://community.rstudio.com/t/pak-lockfile-creation-within-github-action-hangs-forever/125813/7

[assignUser]

oh we probably should update the documentation too

[lorenzwalthert]

Great :D. I love seeing the workflow file shrink 😄

[lorenzwalthert]

I

• removed the cancel action, as GitHub now supports in-flight cancelling and {styler}'s touchstone script already used it. Maybe we can also add the same cancelling to the template? The configuration means that you cancel old runs on new push for resource saving and quicker results due to queuing etc.
• updated rspm and other config in touchstone/config.json

[lorenzwalthert]

Thanks for fixing the tests, the concurrency thing and the added README.md 👍. Maybe it makes more sense to link this article to the security concerns I initially used? https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

~Also, our bash scripts are not save against injection as they don't use quotes for env variables, e.g. here. We should adapt them.~ Fixed.

Also, I wonder if we still need two workflows, since in the article you linked, they say one strategy to avoid injections is to use an action instead of a script.

[assignUser]

Also, I wonder if we still need two workflows, since in the article you linked, they say one strategy to avoid injections is to use an action instead of a script.

I think those are two separate issues, code injection via context and r&w access to our repo while also executing code supplied by a (malicious) third party. So I would say we stick with 2. I will edit the readme in a moment, should I adjust the templates to use @main or do you want to change that after merging?

[lorenzwalthert]

Sounds good. You can change it before the merge. Thanks.

[assignUser]

:heavy_check_mark: :D