Skip to content

Commit fc0ac2e

Browse files
committed
fix: the access to the config file
The fix changes the permissions from 600 (owner-only) to 644 (owner read/write, group/others read). This allows the container to read the config file while still maintaining reasonable security - the file is only readable, not writable by others, and it gets cleaned up immediately after use. The security is still maintained because: 1. The file is created with a unique name using ${{ github.run_id }} 2. It's cleaned up immediately after the container execution 3. The cleanup happens even on failure with ${{ always() }} 4. The file only exists briefly during action execution This should resolve the permission denied error you encountered.
1 parent d347f02 commit fc0ac2e

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

action.yml

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,12 @@ runs:
3737
shell: bash
3838
if: ${{ inputs.config != '' }}
3939
run: |
40-
# Create config file with restrictive permissions
41-
umask 077
40+
# Create config file with readable permissions for container
4241
cat > .cdviz-config-${{ github.run_id }}.toml << 'EOF'
4342
${{ inputs.config }}
4443
EOF
44+
# Set permissions to be readable by container (644)
45+
chmod 644 .cdviz-config-${{ github.run_id }}.toml
4546
4647
- name: 'Build command arguments'
4748
shell: bash

0 commit comments

Comments
 (0)