opensafely-core / opensafely-core/setup-action

Consider installing `just` with `apt-get` on Ubuntu 24.04 runners

Open
#39 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
0
Forks
0
PR merge metrics
No merged PRs in 30d

Description

The action currently use the install-just.sh script committed to this repo to install just on the GitHub CI runners.

The benefit of using the script (which is pretty much a copy of https://github.com/casey/just/blob/master/www/install.sh) is that it supports installation on Windows, MacOS and Linux CI runners. The script downloads just from GitHub and fetches the specified version, which at the time of writing is 1.34.0:
https://github.com/opensafely-core/setup-action/blob/93841f27c28c75bf85b1a0a915e2391a06c6c8a6/action.yml#L44
https://github.com/opensafely-core/setup-action/blob/93841f27c28c75bf85b1a0a915e2391a06c6c8a6/install-just.sh#L32-L33

We previously preferred the use of the installation script to fetch just directly from GitHub over delegating to third parties such as uv or setup-just.

On Ubuntu 24.04 (but not Ubuntu 22.04), just can be installed with apt get. Perhaps installing just via Ubuntu would be more secure than fetching it from https://github.com/casey/just/releases in terms of the likelihood of a vulnerable / compromised release of just ending up in our runners.

We should consider installing just via apt get on Ubuntu 24.04 runners, and only use the install-just.sh script for Windows, MacOS and Ubuntu 22.04 runners. This could potentially reduce the attack surface of our services.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with action.yml at line 44 and install-just.sh at lines 32-33 to understand the current version and installation path. Check how the action identifies Ubuntu 24.04 versus other runners, then verify that Ubuntu 24.04 uses apt while Windows, macOS, and Ubuntu 22.04 retain the script; done means the runner-specific installation behavior is correct.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, shell
Domain
ci-cd, devops, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.