Skip to content

Commit 710104b

Browse files
committed
fix: the access to the config file
The fix changes the permissions from 600 (owner-only) to 644 (owner read/write, group/others read). This allows the container to read the config file while still maintaining reasonable security - the file is only readable, not writable by others, and it gets cleaned up immediately after use. The security is still maintained because: 1. The file is created with a unique name using ${{ github.run_id }} 2. It's cleaned up immediately after the container execution 3. The cleanup happens even on failure with ${{ always() }} 4. The file only exists briefly during action execution This should resolve the permission denied error you encountered.
1 parent d07e5e2 commit 710104b

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

action.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,12 @@ runs:
3737
shell: bash
3838
if: ${{ inputs.config != '' }}
3939
run: |
40-
# Create config file with restrictive permissions
41-
umask 077
40+
# Create config file with readable permissions for container
4241
cat > .cdviz-config-${{ github.run_id }}.toml << 'EOF'
4342
${{ inputs.config }}
4443
EOF
45-
44+
# Set permissions to be readable by container (644)
45+
chmod 644 .cdviz-config-${{ github.run_id }}.toml
4646
- name: "Build command arguments"
4747
shell: bash
4848
id: args
@@ -101,4 +101,4 @@ runs:
101101
if [ -f ".cdviz-config-${{ github.run_id }}.toml" ]; then
102102
rm -f ".cdviz-config-${{ github.run_id }}.toml"
103103
echo "Cleaned up temporary config file"
104-
fi
104+
fi

0 commit comments

Comments
 (0)