RetroSearch Browse

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Showing content from https://github.com/hashicorp/setup-signore-package below:

hashicorp/setup-signore-package: testing the next iteration of setup-signore

A setup-signore alternative for Linux GitHub Runners. Extracts a binary from the Signore Docker image on GitHub Packages to the local disk.

the setup-signore GitHub Action requires users to supply a GitHub personal access token
this version automatically uses the GITHUB_TOKEN vended to a running Action to authenticate to the GitHub container registry (ghcr.io)

Linux only, because macOS workers do not have Docker installed, and Windows workers have other unexplored issues
- Incidentally, look how fun it is to "pull" a Docker image without Docker

One security best practice to keep in mind when configuring your GitHub Actions is least privilege. GitHub grants a wide variety of scopes to a GitHub Action's GITHUB_TOKEN by default. Whenever possible, you should specify granularly scoped permissions to confine your workflows to their intended uses.

If specify granular permissions, be sure to include the package: read scope. This allows your action to use its GITHUB_TOKEN to pull the signore Docker image from the GitHub Container Registry.

permissions:
  packages: read

Add a step to your workflow like so:

    steps:
      - name: install signore
        uses: hashicorp/setup-signore-package@v1

With no inputs, the GITHUB_TOKEN is passed automatically, and a default version of signore is used.

Optionally, token, version, and signer can be set:

    steps:
      - uses: hashicorp/setup-signore-package@v1
        with:
          version: v0
          signer: test_signer
          token: ${{ secrets.GITHUB_TOKEN }}

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4