What's Changed

• chore(deps): bump alpine from 3.23.2 to 3.23.3 #99 #100

Full Changelog: 8.0.3...8.0.4

Contributors:

• @Burnett01
• @dependabot

What's Changed

Version v8 (8.0.2) offers the following features:

• feat: latest Alpine 3.23.0
• feat: latest Rsync 3.4.1-r1
• feat: integrate rsync-docker 3rd party into this action as 1st party code (no more dependency, better audit, single source of truth)
  • backported:
    • agent-start
    • agent-stop
    • agent-askpass
    • agent-add
    • hosts-add
    • hosts-clear
  • new added:
    • ssh-init
    • hosts-init
  • improved:
    • stricter permissions on .ssh/ folder (700) and known_hosts (600)
    • use set -eu in all scipts
• feat: new strict_host_keys option to enable support for strict host key verification. Default: false (to keep backward compatibility)
• feat: new debug option to see the commands executed (-x) by this action
• feat: this action is now scanned for vulnerabilities by Snyk
• feat; this action is now scanned by CodeQL for Q/A
• feat: this action now performs CI tasks such as Validation, Linting and Unit Tests
• fix: various shell syntax for robustness
• fix: use printf and redirect output to non-stdout instead of echo in sensitive code locations
• refactor: use $HOME instead of tilde ~ for robustness
• feat: cross-platform support
• chore: Deprecate 7.0.2
• chore: EOL 7.0.0 & 7.0.1

New release channels:

From now on you can use @v8 instead of manually pinning to a version like 8.0.2.

The benefit of using v8 is that you will receive future MINOR+PATCH updates automatically, since v8 is a pointer to 8.x.x.

However, of course you are free to use the regular format like 8.0.2 directly.

Full Changelog: 7.1.0...8.0.2

Contributors:

• @Burnett01
• @JoshPiper

What's Changed

3.4.0-r0

• always force-upgrade rsync to get the latest security upgrades

• new version 7.0.2 (with rsync 3.4.0), deprecate old versions, remove dead links

The latest rsync version 3.4.0 fixes a wide variety of CVE's.
See their press release: https://download.samba.org/pub/rsync/NEWS#3.4.0

The latest action version 7.0.2 is using rsync 3.4.0, so please use that.

Full Changelog: 7.0.1...7.0.2

What's Changed

• chore(deps): bump alpine from 3.23.0 to 3.23.2 #97 #98

Full Changelog: 8.0.2...8.0.3

Contributors:

• @Burnett01
• @dependabot

Full Changelog: 8.0.1...8.0.2

Contributors:

• @Burnett01
• @JoshPiper

Full Changelog: 8.0.0...8.0.1

Contributors:

• @Burnett01
• @JoshPiper

This release has a regression, see #90 and #89.

Use @v8 which points to 8.0.1

What's Changed

• Update Alpine from 3.19.1 to 3.22.1 via drinternet/rsync@1.5.1 (hub)

• Update Rsync from 3.4.0-r0 to 3.4.1-r0

• Using Githubs new "immutable releases" feature

• Repo now supports BATS testing the entrypoint shell script, shellsheck and various integration tests

Full Changelog: 7.0.2...7.1.0

• Pin @JoshPiper drinternet/rsync image by SHA-256 hash rather than version. (Immutability)
  Added via #60

The docker image of this action is now pinned to the specific SHA-256 hash of the version rather than just the version.
This means for the latest drinternet/rsync:v1.4.4 the corresponding hash is drinternet/rsync@sha256:15b2949838074bd93c49421c22380396a0cd53a322439e799ac87afcadcfe234

Check for validation: https://hub.docker.com/layers/drinternet/rsync/v1.4.4/images/sha256-15b2949838074bd93c49421c22380396a0cd53a322439e799ac87afcadcfe234

With that, usage of this action is even more secure due to a consistent dependency chain of trust,
since changes accompanied by a docker image hash are immutable.

Thanks to @XComp

What's Changed

• feat: Update base image to latest 1.4.4 (alpine 3.19.1)

JoshPiper/rsync-docker@ba20622
JoshPiper/rsync-docker#25
@JoshPiper

• Merge pull request #24 from jasongill/patch-1

Re-allow RSA host keys with SSH

• feat: Make usage of legacy rsa hostkeys conditional

The usage of RSA host keys introduced with c7baefd
was adjusted to make it conditional/configurable and to keep
backward compatibility

Resolves #49

• feat: configuarable legacy RSA hostkeys support

Ability to configure legacy rsa hostkeys support for
OpenSSH servers >= 8.8.
Related to #24 and 9603fc8

• chore!: Versions 4.x EOL, 5.x DEPRECATED, 6.x MAINTENANCE

All versions 4.x are now EOL and no longer maintained
All versions 5.x are now DEPRECATED and will become EOL within Q2 2024
All versions 6.x are now MAINTENANCE and will become DEPRECATED within Q4 2024

New Contributors

• @jasongill made their first contribution in #24

Full Changelog: 6.0.0...7.0.0