Skip to content

Commit a4af869

Browse files
jiangpengchengjiangpengcheng
authored
Setup ssh access for integration CI (#722)
1 parent 8ef268c commit a4af869

File tree

2 files changed

+157
-2
lines changed

2 files changed

+157
-2
lines changed

‎.github/actions/ssh-access/action.yml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
name: ssh access
21+
description: Sets up SSH access to build VM with upterm
22+
inputs:
23+
action:
24+
description: |
25+
Action to perform: options are "start" and "wait"
26+
"start" will install, configure and start upterm.
27+
"wait" will wait until a connection is established to upterm and will continue to wait until the session is closed.
28+
required: false
29+
default: 'start'
30+
limit-access-to-actor:
31+
description: 'If only the public SSH keys of the user triggering the workflow should be authorized'
32+
required: false
33+
default: 'false'
34+
limit-access-to-users:
35+
description: 'If only the public SSH keys of the listed GitHub users should be authorized. Comma separate list of GitHub user names.'
36+
required: false
37+
default: ''
38+
secure-access:
39+
description: |
40+
Set to false for allowing public access when limit-access-to-actor and limit-access-to-users are unset.
41+
required: false
42+
default: 'true'
43+
timeout:
44+
description: 'When action=wait, the timeout in seconds to wait for the user to connect'
45+
required: false
46+
default: '300'
47+
runs:
48+
using: composite
49+
steps:
50+
- run: |
51+
if [[ "${{ inputs.action }}" == "start" ]]; then
52+
echo "::group::Installing upterm & tmux"
53+
if [[ "$OSTYPE" == "linux-gnu"* ]]; then
54+
# install upterm
55+
curl -sL https://github.com/owenthereal/upterm/releases/download/v0.7.6/upterm_linux_amd64.tar.gz | tar zxvf - -C /tmp upterm && sudo install /tmp/upterm /usr/local/bin/ && rm -rf /tmp/upterm
56+
57+
# install tmux if it's not present
58+
if ! command -v tmux &>/dev/null; then
59+
sudo apt-get -y install tmux
60+
fi
61+
elif [[ "$OSTYPE" == "darwin"* ]]; then
62+
brew install owenthereal/upterm/upterm
63+
# install tmux if it's not present
64+
if ! command -v tmux &>/dev/null; then
65+
brew install tmux
66+
fi
67+
else
68+
echo "Unsupported $OSTYPE"
69+
exit 0
70+
fi
71+
echo '::endgroup::'
72+
echo "::group::Configuring ssh and ssh keys"
73+
# generate ssh key
74+
mkdir -p ~/.ssh
75+
chmod 0700 ~/.ssh
76+
if [ ! -f ~/.ssh/id_rsa ]; then
77+
ssh-keygen -q -t rsa -N "" -f ~/.ssh/id_rsa
78+
fi
79+
if [ ! -f ~/.ssh/id_ed25519 ]; then
80+
ssh-keygen -q -t ed25519 -N "" -f ~/.ssh/id_ed25519
81+
fi
82+
# configure ssh
83+
echo -e "Host *\nStrictHostKeyChecking no\nCheckHostIP no\nTCPKeepAlive yes\nServerAliveInterval 30\nServerAliveCountMax 180\nVerifyHostKeyDNS yes\nUpdateHostKeys yes\n" > ~/.ssh/config
84+
# Auto-generate ~/.ssh/known_hosts by attempting connection to uptermd.upterm.dev
85+
ssh -i ~/.ssh/id_ed25519 uptermd.upterm.dev || true
86+
# @cert-authority entry is a mandatory entry when connecting to upterm. generate the entry based on the known_hosts entry key
87+
cat <(cat ~/.ssh/known_hosts | awk '{ print "@cert-authority * " $2 " " $3 }') >> ~/.ssh/known_hosts
88+
authorizedKeysParameter=""
89+
authorizedKeysFile=${HOME}/.ssh/authorized_keys
90+
if [[ "${{ inputs.secure-access }}" != "false" ]]; then
91+
ssh-keygen -q -t ed25519 -N "$(echo $RANDOM | md5sum | awk '{ print $1 }')" -C "Prevent public access" -f /tmp/dummykey$$
92+
cat /tmp/dummykey$$.pub >> $authorizedKeysFile
93+
rm /tmp/dummykey$$ /tmp/dummykey$$.pub
94+
fi
95+
limit_access_to_actor="${{ inputs.limit-access-to-actor }}"
96+
if [[ "${limit_access_to_actor}" == "true" ]]; then
97+
echo "Adding ${GITHUB_ACTOR} to allowed users (identified by ssh key registered in GitHub)"
98+
curl -s https://github.com/${GITHUB_ACTOR}.keys >> $authorizedKeysFile
99+
fi
100+
limit_access_to_users="${{ inputs.limit-access-to-users }}"
101+
for github_user in ${limit_access_to_users//,/ }; do
102+
if [[ -n "${github_user}" ]]; then
103+
echo "Adding ${github_user} to allowed users (identified by ssh key registered in GitHub)"
104+
curl -s https://github.com/${github_user}.keys >> $authorizedKeysFile
105+
fi
106+
done
107+
if [ -f $authorizedKeysFile ]; then
108+
chmod 0600 $authorizedKeysFile
109+
authorizedKeysParameter="-a $authorizedKeysFile"
110+
echo -e "Using $authorizedKeysFile\nContent:\n---------------------------"
111+
cat $authorizedKeysFile
112+
echo "---------------------------"
113+
fi
114+
echo '::endgroup::'
115+
echo "::group::Starting terminal session and connecting to server"
116+
tmux new -d -s upterm-wrapper -x 132 -y 43 "upterm host ${authorizedKeysParameter} --force-command 'tmux attach -t upterm' -- tmux new -s upterm -x 132 -y 43"
117+
sleep 2
118+
tmux send-keys -t upterm-wrapper q C-m
119+
sleep 1
120+
tmux set -t upterm-wrapper window-size largest
121+
tmux set -t upterm window-size largest
122+
echo '::endgroup::'
123+
echo -e "\nSSH connection information"
124+
shopt -s nullglob
125+
upterm session current --admin-socket ~/.upterm/*.sock
126+
elif [[ "${{ inputs.action }}" == "wait" ]]; then
127+
# only wait if upterm was installed
128+
if command -v upterm &>/dev/null; then
129+
shopt -s nullglob
130+
echo "SSH connection information"
131+
upterm session current --admin-socket ~/.upterm/*.sock || {
132+
echo "upterm isn't running. Not waiting any longer."
133+
exit 0
134+
}
135+
timeout=${{ inputs.timeout }}
136+
echo "Waiting $timeout seconds..."
137+
sleep $timeout
138+
echo "Keep waiting as long as there's a connected session"
139+
while upterm session current --admin-socket ~/.upterm/*.sock|grep Connected &>/dev/null; do
140+
sleep 30
141+
done
142+
echo "No session is connected. Not waiting any longer."
143+
else
144+
echo "upterm isn't installed"
145+
fi
146+
fi
147+
shell: bash

‎.github/workflows/test-integration-skywalking-e2e.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,13 +46,21 @@ jobs:
4646
repository: ${{github.event.pull_request.head.repo.full_name}}
4747
ref: ${{ github.event.pull_request.head.sha }}
4848

49+
- name: Setup ssh access to build runner VM
50+
uses: ./.github/actions/ssh-access
51+
with:
52+
limit-access-to-actor: true
53+
4954
- uses: apache/[email protected]
5055
with:
5156
e2e-file: ${{matrix.case.e2e}}
5257

53-
- name: Setup tmate session
54-
uses: mxschmitt/action-tmate@v3
58+
- name: Wait for ssh connection when build fails
59+
uses: ./.github/actions/ssh-access
5560
if: failure()
61+
continue-on-error: true
62+
with:
63+
action: wait
5664

5765
- name: Cleanup
5866
if: ${{ failure() }}

0 commit comments

Comments
 (0)