You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
117 lines
4.4 KiB
Bash
117 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
export GITHUB="true"
|
|
|
|
GITHUB_ACTION_PATH="${GITHUB_ACTION_PATH%/}"
|
|
DRONE_SSH_RELEASE_URL="${DRONE_SSH_RELEASE_URL:-https://github.com/appleboy/drone-ssh/releases/download}"
|
|
DRONE_SSH_VERSION="${DRONE_SSH_VERSION:-1.8.2}"
|
|
|
|
# Error codes
|
|
readonly ERR_UNKNOWN_PLATFORM=2
|
|
readonly ERR_UNKNOWN_ARCH=3
|
|
readonly ERR_DOWNLOAD_FAILED=4
|
|
readonly ERR_INVALID_BINARY=5
|
|
readonly ERR_VERSION_CHECK_FAILED=6
|
|
|
|
function log_error() {
|
|
echo "$1" >&2
|
|
exit "$2"
|
|
}
|
|
|
|
function detect_client_info() {
|
|
CLIENT_PLATFORM="${SSH_CLIENT_OS:-$(uname -s | tr '[:upper:]' '[:lower:]')}"
|
|
CLIENT_ARCH="${SSH_CLIENT_ARCH:-$(uname -m)}"
|
|
|
|
case "${CLIENT_PLATFORM}" in
|
|
darwin | linux | windows) ;;
|
|
# Git Bash / MSYS2 / Cygwin on Windows runners report e.g. MINGW64_NT-10.0
|
|
mingw* | msys* | cygwin*) CLIENT_PLATFORM="windows" ;;
|
|
*) log_error "Unknown or unsupported platform: ${CLIENT_PLATFORM}. Supported platforms are Linux, Darwin, and Windows." "${ERR_UNKNOWN_PLATFORM}" ;;
|
|
esac
|
|
|
|
case "${CLIENT_ARCH}" in
|
|
x86_64* | i?86_64* | amd64*) CLIENT_ARCH="amd64" ;;
|
|
aarch64* | arm64*) CLIENT_ARCH="arm64" ;;
|
|
*) log_error "Unknown or unsupported architecture: ${CLIENT_ARCH}. Supported architectures are x86_64, i686, and arm64." "${ERR_UNKNOWN_ARCH}" ;;
|
|
esac
|
|
}
|
|
|
|
detect_client_info
|
|
DOWNLOAD_URL_PREFIX="${DRONE_SSH_RELEASE_URL}/v${DRONE_SSH_VERSION}"
|
|
CLIENT_BINARY="drone-ssh-${DRONE_SSH_VERSION}-${CLIENT_PLATFORM}-${CLIENT_ARCH}"
|
|
# Windows release assets are published with an .exe suffix
|
|
if [[ "${CLIENT_PLATFORM}" == "windows" ]]; then
|
|
CLIENT_BINARY="${CLIENT_BINARY}.exe"
|
|
fi
|
|
TARGET="${GITHUB_ACTION_PATH}/${CLIENT_BINARY}"
|
|
|
|
# Check if binary already exists and is executable (caching)
|
|
if [[ -f "${TARGET}" ]] && [[ -x "${TARGET}" ]]; then
|
|
echo "Binary ${CLIENT_BINARY} already exists, skipping download"
|
|
else
|
|
echo "Downloading ${CLIENT_BINARY} from ${DOWNLOAD_URL_PREFIX}"
|
|
INSECURE_OPTION=""
|
|
if [[ "${INPUT_CURL_INSECURE}" == 'true' ]]; then
|
|
INSECURE_OPTION="--insecure"
|
|
fi
|
|
|
|
# Download with better error handling
|
|
if ! curl -fsSL --retry 5 --keepalive-time 2 --location ${INSECURE_OPTION} \
|
|
"${DOWNLOAD_URL_PREFIX}/${CLIENT_BINARY}" -o "${TARGET}"; then
|
|
log_error "Failed to download ${CLIENT_BINARY} from ${DOWNLOAD_URL_PREFIX}. Please check the URL and your network connection." "${ERR_DOWNLOAD_FAILED}"
|
|
fi
|
|
|
|
# Validate downloaded file
|
|
if [[ ! -f "${TARGET}" ]] || [[ ! -s "${TARGET}" ]]; then
|
|
log_error "Downloaded file is missing or empty: ${TARGET}" "${ERR_INVALID_BINARY}"
|
|
fi
|
|
|
|
# Verify checksum; container jobs may lack shasum (Perl) or sha256sum, so
|
|
# detect an available tool and skip verification with a warning if none exists
|
|
SHA256_CMD=""
|
|
if command -v shasum >/dev/null 2>&1; then
|
|
SHA256_CMD="shasum -a 256"
|
|
elif command -v sha256sum >/dev/null 2>&1; then
|
|
SHA256_CMD="sha256sum"
|
|
else
|
|
echo "Warning: neither shasum nor sha256sum is available, skipping checksum verification" >&2
|
|
fi
|
|
|
|
if [[ -n "${SHA256_CMD}" ]]; then
|
|
CHECKSUMS_FILE="${GITHUB_ACTION_PATH}/checksums.txt"
|
|
if ! curl -fsSL --retry 5 --keepalive-time 2 --location ${INSECURE_OPTION} \
|
|
"${DOWNLOAD_URL_PREFIX}/checksums.txt" -o "${CHECKSUMS_FILE}"; then
|
|
log_error "Failed to download checksums.txt from ${DOWNLOAD_URL_PREFIX}." "${ERR_DOWNLOAD_FAILED}"
|
|
fi
|
|
|
|
EXPECTED_CHECKSUM=$(awk -v bin="${CLIENT_BINARY}" '$2 == bin {print $1}' "${CHECKSUMS_FILE}")
|
|
if [[ -z "${EXPECTED_CHECKSUM}" ]]; then
|
|
log_error "No checksum entry found for ${CLIENT_BINARY} in checksums.txt." "${ERR_INVALID_BINARY}"
|
|
fi
|
|
|
|
ACTUAL_CHECKSUM=$(${SHA256_CMD} "${TARGET}" | awk '{print $1}')
|
|
if [[ "${ACTUAL_CHECKSUM}" != "${EXPECTED_CHECKSUM}" ]]; then
|
|
log_error "Checksum verification failed for ${CLIENT_BINARY}: expected ${EXPECTED_CHECKSUM}, got ${ACTUAL_CHECKSUM}." "${ERR_INVALID_BINARY}"
|
|
fi
|
|
echo "Checksum verification passed for ${CLIENT_BINARY}"
|
|
rm -f "${CHECKSUMS_FILE}"
|
|
fi
|
|
|
|
chmod +x "${TARGET}"
|
|
fi
|
|
|
|
echo "======= CLI Version Information ======="
|
|
if ! "${TARGET}" --version; then
|
|
log_error "Failed to execute ${TARGET} --version. The binary may be corrupted." "${ERR_VERSION_CHECK_FAILED}"
|
|
fi
|
|
echo "======================================="
|
|
if [[ "${INPUT_CAPTURE_STDOUT}" == 'true' ]]; then
|
|
echo 'stdout<<EOF' >> "${GITHUB_OUTPUT}"
|
|
"${TARGET}" "$@" | tee -a "${GITHUB_OUTPUT}"
|
|
echo 'EOF' >> "${GITHUB_OUTPUT}"
|
|
else
|
|
"${TARGET}" "$@"
|
|
fi
|