v1.24.0

Highlights

• A workflow names its external actions once, under actions, and its steps and defaults use the name.
• The dns action asks a DNS server for the records of a name.
• Probe hides the credentials of object storage, and the password in a url.
• The external actions redis and s3 have reference pages.
• For library users: Config.Actions, Workflow.Actions, mask.HoldsURL, mask.Userinfo and expr.ReplaceTemplates are new. Nothing breaks.

actions

A step that runs an external action writes its repository and a 40-character commit in uses, and a job's defaults writes them again as a key. A workflow can now write them once:

actions:
  graphql: github.com/mozership/probe-graphql@41e4ffa222db58c63c7169117c919e6d252bdbf9 # v0.2.0

jobs:
  - name: Countries API
    defaults:
      graphql:
        url: https://countries.trevorblades.com/graphql
    steps:
      - name: Look up Japan
        uses: graphql
        with:
          query: '{ country(code: "JP") { capital } }'
        test: res.data.country.capital == "Tokyo"

• A newer release of an action is a change to one line.
• A name is letters, digits, _ and -, and starts with a letter or a digit.
• A name cannot be that of an action of Probe, such as http or shell: what uses: http runs does not depend on the workflow. A workflow that gives such a name fails to load.
• The value names an external action as uses does: a repository pinned to a full commit SHA, or a local path. It is not a template, and it cannot be another name.
• A step can still name an action in full, and the defaults written by the name apply to it too.
• --allow-action takes the action in full, not the name: a workflow cannot choose what a name the person running Probe has allowed stands for.
• probe check reports a wrong name or value with its line.
• The names belong to the workflow file. A job file run by the embedded action does not see them, and names its external actions in full.

See actions and Naming an External Action.

dns

A built-in action that asks a DNS server for the records of a name, and returns what the server answered: that a name resolves to the addresses expected, that the MX, SPF, DKIM and DMARC records of a mail flow are in place, or that a change to a zone has reached a name server.

- name: Where the mail of example.com goes
  uses: dns
  with:
    name: example.com
    type: MX
  test: res.rcode == "NOERROR" && res.answers[0].host == "mail.example.com"

- name: ns1 serves the new address
  uses: dns
  with:
    name: api.example.com
    server: ns1.example.com
  test: res.authoritative && res.values == ["203.0.113.10"]

• type is A by default, and any type DNS has but AXFR and IXFR. With type: PTR, name may be an address.
• server is the server to ask, and the resolvers of the machine without it. protocol is udp, tcp, or tls for DNS over TLS. An answer cut short over UDP is asked for again over TCP.
• res.answers holds the records, each with name, type, ttl and data, and the parts of an MX, SRV, SOA or CAA by name. res.values holds the data of the answers of the type asked for.
• A server that answers with an error, such as NXDOMAIN, is a result a test can check, with status 1.
• A query writes nothing, so the action runs under --read-only. Under --allow-host, the server asked must be one the run allows.

See DNS.

Credentials passed to an action

Probe showed the value of a password or key_passphrase field of with, and the password in a dsn, as <redacted>. It now does so for more:

• The value of a secret_access_key or session_token field, at any depth of with.
• The password in a url, such as redis://user:password@host. The rest of the URL stays visible.
• When a template in the user info of a url cannot be evaluated, as in redis://app:{{vars.pw}}@host, the error names the value but does not say why, since the template and the error may each quote the password. The error of a template elsewhere in a url is shown.

A credential written straight into a step therefore does not appear in --verbose output or an action's log records, even when it is not listed in secrets. See secrets.

redis and s3 have reference pages

Two external actions are new, each at v0.1.0, with a reference page in English and Japanese that probe guide redis and probe guide s3 print.

• mozership/probe-redis runs commands on a Redis or Valkey server and returns their replies. See Redis.
• mozership/probe-s3 reads and writes objects in S3 and in storage that speaks its protocol. See S3.

actions:
  redis: github.com/mozership/probe-redis@7d60e0699a914e3c987ed5f2403ed8a7f3d176fa # v0.1.0
  s3: github.com/mozership/probe-s3@8d2a120ffe6f2860229f5b6171a3477ed0f07b6d # v0.1.0

Both declare guard: [read-only, allow-host], so they run under a guard without --allow-action.

For library users

Nothing breaks in this release. New public API:

• Workflow.Actions, the names a workflow gives its external actions. Load replaces each name by its action, so a Step.Uses read after it is the action in full.
• Config.Actions, the names of the built-in actions, which a name under actions must not be. With none given, a clash is not checked.
• mask.HoldsURL(key) and mask.Userinfo(rawURL), which tell a key whose value is a URL and find the user info of one.
• expr.ReplaceTemplates(s, repl), which returns s with repl in place of each template.

github.com/miekg/dns is a new dependency, for the dns action.

Changelog

• ac92463 Add the dns action, which asks a DNS server for the records of a name
• a01e0a1 Document redis and s3 as external actions
• 011ef0d Hide the credentials of object storage, and the password in a url
• 159f5fb Hide why a template in the user info of a url could not be evaluated
• 11773a6 Let a workflow name its external actions under actions
• 577e652 Merge pull request #365 from mozership/feat/dns-action
• 78a3f2e Merge pull request #366 from mozership/fix/mask-action-credentials
• d1f8fdd Merge pull request #367 from mozership/feat/action-aliases
• f6829a0 Merge pull request #368 from mozership/docs/redis-s3-actions
• 45df550 Refuse a template in the action a name stands for