Using a secret, private action

user_6159698 0
Viewed 1778

I am giving a coding lesson where students can upload answers to our quizzes using personal, private repositories. So here's how the repository structure of my organization looks like:

my_organization/student_1_project
my_organization/student_2_project
my_organization/...
my_organization/student_n_project

I would like to run a private GitHub Action at any push on a student repository. This Action would run partial reviews of the student's work, and notify me of stuffs. Its code would need to be unreachable from students, of course, otherwise providing hints & solutions.

I have three questions:

  1. Can my workflow in e.g. my_organization/student_2_project be to use a private action my_organization/my_private_action? It seems like yes thanks to actions/checkout@v2 (see here) but pretty sure that involves playing with keys or tokens or secrets - I'm not so at ease with that and currently get an error although it does exist:
Error: fatal: repository 'https://github.com/my_organization/my_private_action' not found

  1. Can it prevent the student (owner/admin of my_organization/student_2_project) to see the code in my_organization/my_private_action?

  2. With the same constraints, could the private action be hosted in another organization?

Thanks a lot for your help!

github-actions
1 Answers

This is how I understand the restrictions:

  1. Using an action from a private/internal repository currently isn't supported directly, see this issue on the roadmap. A possible workaround is adding a personal access token with access to the private repo that contains the action and then checking it out like this:

    - name: Get private repo with action
  uses: actions/checkout@v2
  with:
    repository: yourorg/privateactionrepo
    ref: master
    token: ${{ secrets.PAT_TOKEN }}
    path: .github/actions

    You can then use the action in another step like

    uses: ./.github/actions/actionname

    The PAT can be a secret on the org level so you don't have to add it to every single student repo.

  2. Since the student's repo has access to the PAT, they can use it to create a workflow that checks out the private repo and does whatever they want with it – upload its contents, print every file etc.

  3. As long as the PAT has the permissions to check out the repo containing the action, the action can live anywhere, including in another organization.

Alternatively, if you want to prevent your students from seeing your action, you could add a workflow to your students' repositories that sends a request to the GitHub API and then have a trigger in your action on the repository_dispatch event.

user_32668470
Related