add ssh support #163

ericsciple · 2020-02-25T15:04:02Z

related to ADR #156

src/git-source-settings.ts

ericsciple · 2020-02-25T15:07:19Z

src/state-helper.ts

@@ -12,6 +11,17 @@ export const IsPost = !!process.env['STATE_isPost']
 export const RepositoryPath =
  (process.env['STATE_repositoryPath'] as string) || ''

+/**


used during POST to cleanup the files on disk

src/git-source-provider.ts

src/git-directory-helper.ts

__test__/git-auth-helper.test.ts

src/git-auth-helper.ts

ericsciple · 2020-02-25T15:18:37Z

src/git-auth-helper.ts

+    sshCommand += ` -o "UserKnownHostsFile=$RUNNER_TEMP/${path.basename(
+      this.sshKnownHostsPath
+    )}"`
+    this.git.setEnvironmentVariable('GIT_SSH_COMMAND', sshCommand)


GIT_SSH_COMMAND takes precedence over git config core.sshCommand

ericsciple · 2020-02-26T20:47:27Z

src/git-auth-helper.ts

+
+    // Configure core.sshCommand
+    if (this.settings.persistCredentials) {
+      await this.git.config(SSH_COMMAND_KEY, sshCommand)


this runs git config --local core.sshCommand "ssh -i path-to-key -o etc"

src/git-auth-helper.ts

src/git-source-provider.ts

thboop

LGTM

__test__/git-auth-helper.test.ts

src/git-auth-helper.ts

src/input-helper.ts

src/git-auth-helper.ts

thboop · 2020-03-11T16:24:33Z

README.md

+    # with the local git config, which enables your scripts to run authenticated git
+    # commands. The post-job step removes the PAT.
+    #
+    # We recommend creating a service account with the least permissions necessary.


NIT: We recommend generating the PAT from a service account with only the necessary permissions.

may read a little better

will follow up on next pr

thboop · 2020-03-11T16:24:57Z

README.md

    # Default: ${{ github.token }}
    token: ''

-    # Whether to persist the token in the git config
+    # SSH key used to fetch the repository. SSH key is configured with the local git


Nit: The SSH Key is configured...

will fix in next pr

thboop · 2020-03-11T16:25:26Z

README.md

+    # config, which enables your scripts to run authenticated git commands. The
+    # post-job step removes the SSH key.
+    #
+    # We recommend creating a service account with the least permissions necessary.


Nit: Same as above

will follow up on next pr

thboop · 2020-03-11T16:26:10Z

README.md

@@ -73,6 +99,10 @@ Refer [here](https://github.com/actions/checkout/blob/v1/README.md) for previous

    # Whether to checkout submodules: `true` to checkout submodules or `recursive` to
    # recursively checkout submodules.
+    #
+    # When the `ssh-key` input is not provided, SSH URLs beginning with
+    # `git@github.com:` are converted to HTTPS.


thboop · 2020-03-11T18:31:24Z

__test__/git-auth-helper.test.ts

+  const configureAuth_copiesUserKnownHosts =
+    'configureAuth copies user known hosts'
+  it(configureAuth_copiesUserKnownHosts, async () => {
+    if (!sshPath) {


NIT: consider a helper function for this

thboop · 2020-03-11T18:33:16Z

__test__/git-auth-helper.test.ts

+    ).toString()
+    expect(actualSshKeyContent).toBe(settings.sshKey + '\n')
+    if (!isWindows) {
+      expect((await fs.promises.stat(actualSshKeyPath)).mode & 0o777).toBe(


NIT: Comment what this is or create a constant with a clear name

will follow up on next pr

thboop · 2020-03-11T18:34:30Z

__test__/git-auth-helper.test.ts

+    }
+  )
+
+  const configureSubmoduleAuth_doesNotConfigureUrlInsteadOfWhenPersistCredentialsTrueAndSshKeySet =


Great coverage across all of these different scenarios!

thboop

LGTM