Skip to content

Use RUNNER_TEMP to export credentials #148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 21, 2020
Merged

Conversation

sethvargo
Copy link
Member

Fixes GH-144

Copy link
Contributor

@bharathkkb bharathkkb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sethvargo sethvargo merged commit 191a0f3 into master Jul 21, 2020
@sethvargo sethvargo deleted the sethvargo/export_path branch July 21, 2020 14:42
@sethvargo sethvargo restored the sethvargo/export_path branch July 22, 2020 11:56
@sethvargo sethvargo deleted the sethvargo/export_path branch July 22, 2020 11:56
sethvargo added a commit that referenced this pull request Jul 22, 2020
sethvargo added a commit that referenced this pull request Jul 22, 2020
* Revert "Use RUNNER_TEMP to export credentials (#148)"

This reverts commit 191a0f3.

* Update README.md
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 10, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 10, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 11, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 11, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 11, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 11, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 11, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
sethvargo added a commit to google-github-actions/auth that referenced this pull request Jul 11, 2025
The GitHub Action currently puts generated credentials into $GITHUB_WORKSPACE (/github/workspace). Unfortunately this is also the working directory of the checkout, so it's too easy to accidentally bundle the generated credentials into Docker containers, binaries, or anything that uses `*` or `.` as a build context.

In the past, we tried to move the exported credentials into RUNNER_TEMP or other directories, but it always introduced incompatibility with the various community workflows (Docker, self-hosted, etc.):

- google-github-actions/setup-gcloud#148
- google-github-actions/setup-gcloud#149
- google-github-actions/setup-gcloud#405
- google-github-actions/setup-gcloud#412

While undocumented, it appears that `/github/home` is an understood path, AND that path is mounted into Docker containers. That means we can export credentials outside of the workspace and still have them available inside the Docker container without users taking manual actions. This comes at three major costs:

1. We have to write the file into two locations. This isn't ideal, but it's also not the end of the world.

2. We would be relying on an undocumented filepath which GitHub could change at any point in the future. Since this is not part of the publicly-documented API, GitHub is within their rights to change this without notice, potentially breaking everyone/everything.

3. Because of the previous point, there are no environment variables that export these paths. We have to dynamically compile them, and it's a bit messy.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

export_default_credentials should place credentials outside of the workspace
2 participants