GitHub Action that copy files and artifacts via SSH.
GitHub Action for copying files and artifacts via SSH.
Important: Only support Linux docker container.
Copy files and artifacts via SSH:
name: scp files
on: [push]
jobs:
build:
name: Build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: copy file via ssh password
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
password: ${{ secrets.PASSWORD }}
port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path
See the action.yml file for more detail information.
22
30s
10m
false
--overwrite
flag with tar, overwrite existing files when extractingtar
--dereference
flag with tar, follow symlinks; archive and dump the files they point toSSH Proxy Setting:
22
30s
Make sure to follow the below steps while creating SSH Keys and using them. The best practice is create the SSH Keys on local machine not remote machine. Login with username specified in Github Secrets. Generate a RSA Key-Pair:
# rsa
ssh-keygen -t rsa -b 4096 -C "[email protected]"
# ed25519
ssh-keygen -t ed25519 -a 200 -C "[email protected]"
Add newly generated key into Authorized keys. Read more about authorized keys here.
# rsa
cat .ssh/id_rsa.pub | ssh b@B 'cat >> .ssh/authorized_keys'
# d25519
cat .ssh/id_ed25519.pub | ssh b@B 'cat >> .ssh/authorized_keys'
Copy Private Key content and paste in Github Secrets.
# rsa
clip < ~/.ssh/id_rsa
# ed25519
clip < ~/.ssh/id_ed25519
See the detail information about SSH login without password.
A note from one of our readers: Depending on your version of SSH you might also have to do the following changes:
.ssh/authorized_keys2
.ssh
to 700.ssh/authorized_keys2
to 640If you are currently using OpenSSH and are getting the following error:
ssh: handshake failed: ssh: unable to authenticate, attempted methods [none publickey]
Make sure that your key algorithm of choice is supported.
On Ubuntu 20.04 or later you must explicitly allow the use of the ssh-rsa algorithm. Add the following line to your OpenSSH daemon file (which is either /etc/ssh/sshd_config
or a drop-in file under /etc/ssh/sshd_config.d/
):
CASignatureAlgorithms +ssh-rsa
Alternatively, ed25519
keys are accepted by default in OpenSSH. You could use this instead of rsa if needed:
ssh-keygen -t ed25519 -a 200 -C "[email protected]"
Copy file via a SSH password:
- name: copy file via ssh password
uses: appleboy/[email protected]
with:
host: example.com
username: foo
password: bar
port: 22
source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path
Copy file via a SSH key:
- name: copy file via ssh key
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
port: ${{ secrets.PORT }}
key: ${{ secrets.KEY }}
source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path
Example configuration for ignore list:
- name: copy file via ssh key
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
port: ${{ secrets.PORT }}
key: ${{ secrets.KEY }}
source: "tests/*.txt,!tests/a.txt"
target: your_server_target_folder_path
Example configuration for multiple servers:
uses: appleboy/[email protected]
with:
- host: "example.com"
+ host: "foo.com,bar.com"
username: foo
password: bar
port: 22
source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path
Example configuration for exclude custom files:
uses: appleboy/[email protected]
with:
host: "example.com"
username: foo
password: bar
port: 22
- source: "tests/*.txt"
+ source: "tests/*.txt,!tests/a.txt,!tests/b.txt"
target: your_server_target_folder_path
Upload artifact files to remote server:
deploy:
name: deploy artifact
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- run: echo hello > world.txt
- uses: actions/upload-artifact@v4
with:
name: my-artifact
path: world.txt
- uses: actions/download-artifact@v4
with:
name: my-artifact
path: distfiles
- name: copy file to server
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: distfiles/*
target: your_server_target_folder_path
Remove the specified number of leading path elements:
- name: remove the specified number of leading path elements
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path
strip_components: 1
Old target structure:
foobar
└── tests
├── a.txt
└── b.txt
New target structure:
foobar
├── a.txt
└── b.txt
Only copy files that are newer than the corresponding destination files:
changes:
name: test changed-files
runs-on: ubuntu-latest
steps:
- name: checkout
uses: actions/checkout@v4
- name: Get changed files
id: changed-files
uses: tj-actions/changed-files@v35
with:
since_last_remote_commit: true
separator: ","
- name: copy file to server
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.KEY }}
port: ${{ secrets.PORT }}
source: ${{ steps.changed-files.outputs.all_changed_files }}
target: your_server_target_folder_path
Protecting a Private Key. The purpose of the passphrase is usually to encrypt the private key. This makes the key file by itself useless to an attacker. It is not uncommon for files to leak from backups or decommissioned hardware, and hackers commonly exfiltrate files from compromised systems.
- name: ssh key with passphrase
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.SSH2 }}
+ passphrase: ${{ secrets.PASSPHRASE }}
port: ${{ secrets.PORT }}
source: "tests/a.txt,tests/b.txt"
target: your_server_target_folder_path
When copying files from a Linux runner to a Windows server, you should:
tar_dereference
and rm
variable to true
in the YAML fileport
value through a variable/c/path/to/target/
Change the default OpenSSH shell to git bach with the following powershell command.
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "$env:Programfiles\Git\bin\bash.exe" -PropertyType String -Force
Convert the target path to a Unix path: /c/path/to/target/
- name: Copy to Windows
uses: appleboy/[email protected]
with:
host: ${{ secrets.HOST }}
username: ${{ secrets.USERNAME }}
key: ${{ secrets.SSH_PRIVATE_KEY }}
port: 22
source: 'your_source_path'
- target: 'C:\path\to\target'
+ target: '/c/path/to/target/'
+ tar_dereference: true
+ rm: true