master: Spawn tmate on failing package build and install jobs with ci-debug branch...

* CI: Simplify now that authorized_keys restriction merged into GitHub Action

* CI: Spawn tmate on failing package build and install jobs with ci-debug branch

diff --git a/.github/workflows/ci-deb.yml b/.github/workflows/ci-deb.yml
index 0cc5b37d0cf236261b95849b06ad8f69848ba5db..6e55481c04137129b6c217ba1826847a67fcb407 100644 (file)
--- a/.github/workflows/ci-deb.yml
+++ b/.github/workflows/ci-deb.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - packaging_test
+      - ci-debug
   schedule:
     - cron: '0 20 * * *'
 
@@ -104,6 +105,23 @@ jobs:
         path: debs
         retention-days: 1
 
+    #
+    #  If the CI has failed and the branch is ci-debug then start a tmate
+    #  session. SSH rendezvous point is emited continuously in the job output.
+    #
+    - name: "Debug: Package dependancies for tmate"
+      run: |
+        apt-get install -y --no-install-recommends xz-utils
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
+
+    - name: "Debug: Start tmate"
+      uses: mxschmitt/action-tmate@v3
+      with:
+        limit-access-to-actor: true
+        sudo: false
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
+
+
   deb-test:
 
     needs:
@@ -186,3 +204,17 @@ jobs:
           freeradius/build/tests/eapol_test
         retention-days: 30
 
+    #
+    #  See above comments for tmate
+    #
+    - name: "Debug: Package dependancies for tmate"
+      run: |
+        apt-get install -y --no-install-recommends xz-utils
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
+
+    - name: "Debug: Start tmate"
+      uses: mxschmitt/action-tmate@v3
+      with:
+        limit-access-to-actor: true
+        sudo: false
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}

diff --git a/.github/workflows/ci-rpm.yml b/.github/workflows/ci-rpm.yml
index 5518236f32ca8efda09ee5377e227e0e267eee9d..366c294765cfdc63b3c33a011eaf3d2f43de08bf 100644 (file)
--- a/.github/workflows/ci-rpm.yml
+++ b/.github/workflows/ci-rpm.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - packaging_test
+      - ci-debug
   schedule:
     - cron: '0 20 * * *'
 
@@ -153,6 +154,24 @@ jobs:
         path: rpms
         retention-days: 1
 
+    #
+    #  If the CI has failed and the branch is ci-debug then start a tmate
+    #  session. SSH rendezvous point is emited continuously in the job output.
+    #
+    - name: "Debug: Package dependancies for tmate"
+      run: |
+        yum install -y xz
+        ln -s /bin/true /bin/apt-get
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
+
+    - name: "Debug: Start tmate"
+      uses: mxschmitt/action-tmate@v3
+      with:
+        limit-access-to-actor: true
+        sudo: false
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
+
+
   rpm-test:
 
     needs:
@@ -261,3 +280,19 @@ jobs:
           /var/log/radius
           freeradius/build/tests/eapol_test
         retention-days: 30
+
+    #
+    #  See above comments for tmate
+    #
+    - name: "Debug: Package dependancies for tmate"
+      run: |
+        yum install -y xz
+        ln -s /bin/true /bin/apt-get
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
+
+    - name: "Debug: Start tmate"
+      uses: mxschmitt/action-tmate@v3
+      with:
+        limit-access-to-actor: true
+        sudo: false
+      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a2c29df22fbf704171ae802f4fc07cf0f5d0b48..e3db38b5de68fa6bdaf1a5c3dc00f101d828110e 100644 (file)
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -352,24 +352,9 @@ jobs:
     #
     #  If the CI has failed and the branch is ci-debug then start a tmate
     #  session. SSH rendezvous point is emited continuously in the job output.
-    #  We restrict access to this session to the job owner's GitHub SSH keys.
     #
-    - name: "Debug: Plant authorized_keys of job owner"
-      run: |
-        umask 077
-        mkdir -p ~/.ssh
-        curl -s https://api.github.com/users/${{ github.actor }}/keys | jq '.[].key + " ${{ github.actor }}"' --raw-output > ~/.ssh/authorized_keys
-        echo 'set tmate-authorized-keys "~/.ssh/authorized_keys"' > ~/.tmate.conf
-      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}
-
-    # Backport of tmate 2.4.0 to Ubuntu-18.04 to support authorized_keys
-    # restriction. Can go away when we upgrade CI to 20.04.
-    - name: "Debug: Install backported tmate 2.4.0 on Ubuntu 18.04"
-      run: |
-        wget -O tmate.deb https://github.com/terryburton/tmate/releases/download/2.4.0/tmate_2.4.0-2_amd64.deb
-        sudo apt-get install -y --no-install-recommends ./tmate.deb
-      if: ${{ github.ref == 'refs/heads/ci-debug' && failure() && matrix.env.OS == 'ubuntu-18.04' }}
-
     - name: "Debug: Start tmate"
       uses: mxschmitt/action-tmate@v3
+      with:
+        limit-access-to-actor: true
       if: ${{ github.ref == 'refs/heads/ci-debug' && failure() }}