chore(#868hja40e): fix cve, migrate to npm and bump node version

.github/workflows/demo.yml

@@ -1,28 +1,36 @@
-on: [push, pull_request]
+name: Demo
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
 
 jobs:
-    single_key_demo:
-        strategy:
-            matrix:
-                os: [ubuntu-latest, macOS-latest]
-        runs-on: ${{ matrix.os }}
-        steps:
-            - uses: actions/checkout@v1
-            - name: Setup key
-              uses: ./
-              with:
-                  ssh-private-key: |
-                    ${{ secrets.DEMO_KEY }}
-                    ${{ secrets.DEMO_KEY_2 }}
+  single_key_demo:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macOS-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup key
+        uses: ./
+        with:
+          ssh-private-key: |
+            ${{ secrets.DEMO_KEY }}
+            ${{ secrets.DEMO_KEY_2 }}
+
+  multiple_keys_demo:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macOS-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v6
 
-    multiple_keys_demo:
-        strategy:
-            matrix:
-                os: [ubuntu-latest, macOS-latest]
-        runs-on: ${{ matrix.os }}
-        steps:
-            - uses: actions/checkout@v1
-            - name: Setup key
-              uses: ./
-              with:
-                  ssh-private-key: ${{ secrets.DEMO_KEY }}
+      - name: Setup key
+        uses: ./
+        with:
+          ssh-private-key: ${{ secrets.DEMO_KEY }}

README.md

@@ -122,7 +122,7 @@ To actually grant the SSH key access, you can – on GitHub – use at least two
 As a note to my future self, in order to work on this repo:
 
 * Clone it
-* Run `yarn install` to fetch dependencies
+* Run `npm install` to fetch dependencies
 * _hack hack hack_
 * `node index.js`. Inputs are passed through `INPUT_` env vars with their names uppercased. Use `env "INPUT_SSH-PRIVATE-KEY=\`cat file\`" node index.js` for this action.
 * Run `npm run build` to update `dist/*`, which holds the files actually run

action.yml

@@ -1,15 +1,15 @@
-name: 'webfactory/ssh-agent'
-description: 'Run `ssh-agent` and load an SSH key to access other private repositories'
+name: webfactory/ssh-agent
+description: Run `ssh-agent` and load an SSH key to access other private repositories
 inputs:
-    ssh-private-key:
-        description: 'Private SSH key to register in the SSH agent'
-        required: true
-    ssh-auth-sock:
-        description: 'Where to place the SSH Agent auth socket'
+  ssh-private-key:
+    description: Private SSH key to register in the SSH agent
+    required: true
+  ssh-auth-sock:
+    description: Where to place the SSH Agent auth socket
 runs:
-    using: 'node12'
-    main: 'dist/index.js'
-    post: 'dist/cleanup.js'
+  using: node24
+  main: dist/index.js
+  post: dist/cleanup.js
 branding:
-    icon: loader
-    color: 'yellow'
+  icon: loader
+  color: yellow

cleanup.js

@@ -3,9 +3,9 @@ const { execSync } = require('child_process')
 
 try {
     // Kill the started SSH agent
-    console.log('Stopping SSH agent')
+    core.info('Stopping SSH agent')
     execSync('kill ${SSH_AGENT_PID}', { stdio: 'inherit' })
 } catch (error) {
-    console.log(error.message);
-    console.log('Error stopping the SSH agent, proceeding anyway');
+    core.warning(error.message);
+    core.warning('Error stopping the SSH agent, proceeding anyway');
 }

index.js

@@ -3,7 +3,6 @@ const child_process = require('child_process');
 const fs = require('fs');
 
 try {
-
     const home = process.env['HOME'];
     const homeSsh = home + '/.ssh';
 
@@ -15,12 +14,12 @@ try {
         return;
     }
 
-    console.log(`Adding GitHub.com keys to ${homeSsh}/known_hosts`);
+    core.info(`Adding GitHub.com keys to ${homeSsh}/known_hosts`);
     fs.mkdirSync(homeSsh, { recursive: true });
     fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==\n');
     fs.appendFileSync(`${homeSsh}/known_hosts`, '\ngithub.com ssh-dss AAAAB3NzaC1kc3MAAACBANGFW2P9xlGU3zWrymJgI/lKo//ZW2WfVtmbsUZJ5uyKArtlQOT2+WRhcg4979aFxgKdcsqAYW3/LS1T2km3jYW/vr4Uzn+dXWODVk5VlUiZ1HFOHf6s6ITcZvjvdbp6ZbpM+DuJT7Bw+h5Fx8Qt8I16oCZYmAPJRtu46o9C2zk1AAAAFQC4gdFGcSbp5Gr0Wd5Ay/jtcldMewAAAIATTgn4sY4Nem/FQE+XJlyUQptPWMem5fwOcWtSXiTKaaN0lkk2p2snz+EJvAGXGq9dTSWHyLJSM2W6ZdQDqWJ1k+cL8CARAqL+UMwF84CR0m3hj+wtVGD/J4G5kW2DBAf4/bqzP4469lT+dF2FRQ2L9JKXrCWcnhMtJUvua8dvnwAAAIB6C4nQfAA7x8oLta6tT+oCk2WQcydNsyugE8vLrHlogoWEicla6cWPk7oXSspbzUcfkjN3Qa6e74PhRkc7JdSdAlFzU3m7LMkXo1MHgkqNX8glxWNVqBSc0YRdbFdTkL0C6gtpklilhvuHQCdbgB3LBAikcRkDp+FCVkUgPC/7Rw==\n');
 
-    console.log("Starting ssh-agent");
+    core.info("Starting ssh-agent");
     const authSock = core.getInput('ssh-auth-sock');
     let sshAgentOutput = ''
     if (authSock && authSock.length > 0) {
@@ -38,12 +37,12 @@ try {
         }
     }
 
-    console.log("Adding private key to agent");
+    core.info("Adding private key to agent");
     privateKey.split(/(?=-----BEGIN)/).forEach(function(key) {
         child_process.execSync('ssh-add -', { input: key.trim() + "\n" });
     });
 
-    console.log("Keys added:");
+    core.info("Keys added:");
     child_process.execSync('ssh-add -l', { stdio: 'inherit' });
 
 } catch (error) {

package.json

@@ -6,9 +6,11 @@
     "main": "index.js",
     "author": "webfactory GmbH <info@webfactory.de>",
     "license": "MIT",
+    "dependencies": {
+        "@actions/core": "^3.0.0"
+    },
     "devDependencies": {
-        "@actions/core": "^1.2.4",
-        "@zeit/ncc": "^0.20.5"
+        "@zeit/ncc": "^0.22.3"
     },
     "scripts": {
         "build": "node scripts/build.js"