Handling passphrase for private keys

.env.example

@@ -0,0 +1,5 @@
+INPUT_TARGET_REPO_URL="[email protected]:<username>/<repository>.git"
+INPUT_SSH_PRIVATE_KEY=
+INPUT_SSH_PRIVATE_KEY_PASSPHRASE=
+INPUT_SSH_USERNAME=git
+HOME=/root

.github/workflows/test.yml

@@ -23,10 +23,11 @@ jobs:
     if: "!contains(needs.check_preconditions.outputs.results, 'failure')"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0
       - uses: ./
         with:
           ssh_private_key: ${{ secrets.SSH_PRIVATE_KEY }}
           target_repo_url: ${{ secrets.TARGET_REPO_URL }}
+          ssh_private_key_passphrase: ${{ secrets.SSH_PRIVATE_KEY_PASSPHRASE }}

.gitignore

@@ -0,0 +1 @@
+.env

Dockerfile

@@ -5,8 +5,10 @@ RUN apk update && apk upgrade && \
 
 RUN git lfs install
 
-COPY setup-ssh.sh /setup-ssh.sh
+RUN mkdir -p /root/.ssh && \
+    touch /root/.ssh/known_hosts && \
+    ssh-keyscan github.com >> /root/.ssh/known_hosts
+
 COPY mirror.sh /mirror.sh
-COPY cleanup.sh /cleanup.sh
 
 ENTRYPOINT ["/mirror.sh"]

README.md

@@ -24,10 +24,26 @@ name: Mirroring
 on: [push, delete]
 
 jobs:
+  to_github:
+    runs-on: ubuntu-latest
+    steps:                                              # <-- must use actions/checkout before mirroring!
+      - uses: actions/[email protected]
+        with:
+          fetch-depth: 0
+      - uses: pixta-dev/repository-mirroring-action@v1
+        with:
+          target_repo_url:
+            [email protected]:<username>/<target_repository_name>.git
+          ssh_private_key:                              # <-- use 'secrets' to pass credential information.
+            ${{ secrets.GITHUB_SSH_PRIVATE_KEY }}
+          ssh_private_key_passphrase:                   # <-- used to allow the private key usage (optional).
+            ${{ secrets.GITHUB_SSH_PRIVATE_KEY_PASSPHRASE }}
+          ssh_username: git                             # <-- do NOT pass this argument unless equal to 'git' for github job.
+
   to_gitlab:
     runs-on: ubuntu-latest
     steps:                                              # <-- must use actions/checkout before mirroring!
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0
       - uses: pixta-dev/repository-mirroring-action@v1
@@ -36,11 +52,13 @@ jobs:
             [email protected]:<username>/<target_repository_name>.git
           ssh_private_key:                              # <-- use 'secrets' to pass credential information.
             ${{ secrets.GITLAB_SSH_PRIVATE_KEY }}
+          ssh_private_key_passphrase:                   # <-- used to allow the private key usage (optional).
+            ${{ secrets.GITLAB_SSH_PRIVATE_KEY_PASSPHRASE }}
 
   to_codecommit:                                        # <-- different jobs are executed in parallel.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4.1.1
         with:
           fetch-depth: 0
       - uses: pixta-dev/repository-mirroring-action@v1
@@ -51,4 +69,6 @@ jobs:
             ${{ secrets.CODECOMMIT_SSH_PRIVATE_KEY }}
           ssh_username:                                 # <-- (for codecommit) you need to specify ssh-key-id as ssh username.
             ${{ secrets.CODECOMMIT_SSH_PRIVATE_KEY_ID }}
+          ssh_private_key_passphrase:                   # <-- used to allow the private key usage (optional).
+            ${{ secrets.CODECOMMIT_SSH_PRIVATE_KEY_PASSPHRASE }}
 ```

action.yml

@@ -4,16 +4,20 @@ branding:
   icon: "archive"
   color: "blue"
 inputs:
-  ssh_private_key:
-    description: "SSH private key for ssh connection to the target repository"
-    required: false
   target_repo_url:
     description: "Target url"
     required: true
+  ssh_private_key:
+    description: "SSH private key for ssh connection to the target repository"
+    required: true
+  ssh_private_key_passphrase:
+    description: "SSH private key passphrase"
+    required: false
   ssh_username:
     description: "Username for ssh connection"
     required: false
     default: "git"
+
 runs:
-  using: 'docker'
-  image: 'Dockerfile'
+  using: "docker"
+  image: "Dockerfile"

docker-compose.yml

@@ -0,0 +1,11 @@
+version: "3.9"
+
+services:
+  repository-mirroring-action:
+    build:
+      dockerfile: Dockerfile
+      context: .
+    image: repository-mirroring-action
+    container_name: mirror
+    env_file:
+      - .env

mirror.sh

@@ -1,12 +1,46 @@
 #!/usr/bin/env sh
-set -eu
+set -xeu
 
-/setup-ssh.sh
+SSH_PRIVATE_KEY_FILE="${HOME}/.ssh/id_ed25519"
+REMOTE_NAME="mirror"
 
-export GIT_SSH_COMMAND="ssh -v -i ~/.ssh/id_rsa -o StrictHostKeyChecking=no -l $INPUT_SSH_USERNAME"
-git remote add mirror "$INPUT_TARGET_REPO_URL"
-git push --tags --force --prune mirror "refs/remotes/origin/*:refs/heads/*"
+function setup_ssh {
+    # Creates the private key file
+    mkdir -p $(dirname "${SSH_PRIVATE_KEY_FILE}")
+    echo "${INPUT_SSH_PRIVATE_KEY}" > "${SSH_PRIVATE_KEY_FILE}"
+    chmod 600 "${SSH_PRIVATE_KEY_FILE}"
 
-# NOTE: Since `post` execution is not supported for local action from './' for now, we need to
-# run the command by hand.
-/cleanup.sh mirror
+    # Unlock the private key in order to avoid the ssh-add prompt
+    if [[ -n "${INPUT_SSH_PRIVATE_KEY_PASSPHRASE}" ]]; then
+        echo "" | ssh-keygen -p -P "${INPUT_SSH_PRIVATE_KEY_PASSPHRASE}" -f "${SSH_PRIVATE_KEY_FILE}"
+    fi
+}
+
+function clean_up {
+    local remote="${1}"
+    git remote remove "${remote}"
+}
+
+function mirror {
+    export GIT_SSH_COMMAND="ssh -v -i ${SSH_PRIVATE_KEY_FILE} -l ${INPUT_SSH_USERNAME} -o StrictHostKeyChecking=no"
+    git remote add "${REMOTE_NAME}" "${INPUT_TARGET_REPO_URL}"
+    git push --tags --force --prune "${REMOTE_NAME}" "refs/remotes/origin/*:refs/heads/*"
+    # NOTE: Since `post` execution is not supported for local action from './' for now, we need to
+    # run the command by hand.
+    clean_up "${REMOTE_NAME}"
+}
+
+function test_clone_with_private_key {
+    export GIT_SSH_COMMAND="ssh -v -i ${SSH_PRIVATE_KEY_FILE} -l git -o StrictHostKeyChecking=no"
+    rm -rf repository
+    git clone "${INPUT_TARGET_REPO_URL}" repository
+    cd repository
+    echo "clone is a success"
+}
+
+function main {
+    setup_ssh
+    mirror
+}
+
+main