Allow a workflow to prematurely run the `post` phase of an action
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 6.3k
- Forks
- 1.4k
- Avg merge
- 1d 16h
- Merged PRs (30d)
- 24
Description
Describe the enhancement
Allow a workflow to prematurely run the post phase of an action.
Code Snippet
- uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ secrets.ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.SECRET_ACCESS_KEY }}
- id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
- run: docker pull some-private/image-from-ECR
# This is new syntax:
- cleanup: aws-actions/configure-aws-credentials
- cleanup: login-ecr
- run: yarn install
Additional information
I am coming from the context of Dependabot update PRs, where sooner or later I will need to run some tests on untrusted and possibly malicious code. This is illustrated by the yarn install step above, which might run malicious lifecycle scripts. It's not the lifecycle scripts per se – there is plenty of ways how code might get run, and I cannot get around all of them. Sooner or later I will have to run the code in question.
Some of these workflows will also have to deal with secrets/sensitive data, for example when I need to pull a Docker image from a private registry in order to run my tests.
In that situation, I'd like to do "trustworthy" things first, then clean up as much as possible before running the "untrusted" parts. In the example, "cleaning up" would mean to run: docker logout and to reset (or even unset) environment variables.
However, it can be hard for me to tell what it takes to clean up an action's results. The action itself should know best. The aws-actions/* from the example already do cleanup homework in their post phase/file. So, let me invoke that at a point before my job terminates, instead of at the end of the job.
In my example above, cleanup: refers to one action by name and to the other one by id. I don't mind – maybe the id is more precise? Surely there is some ambiguity when an action is used several times throughout a workflow.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how the runner schedules an action's post phase and how workflow steps identify actions; the issue names action names and step ids as possible cleanup targets. Resolve repeated-use and ordering semantics, then verify that the proposed cleanup syntax can trigger post phases before later untrusted steps and still preserve normal job-end cleanup.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100