capistrano-ssh-authorized-keys-github 1.0.0 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 41ee42118dfd41d9d4a887f6eddfca038538c4459bcab645728d0018806e0cca
-  data.tar.gz: fcbb145178fbed5ad4a2330a077157504241d5d098fcc7644a00e9bfc7b46aca
+  metadata.gz: fdeace2093ea8dd5b0326e751fe39daaf0976d9815949063d0a041b579637db4
+  data.tar.gz: 5dcd586bbab56363ee751a3379354bfb93861e6dff1e645d78194eb530d86945
 SHA512:
-  metadata.gz: 87bbbea33b64d90acc1bf51c838244729e155a2dedd3072cc477456157becbbb7875294b90ddc42ee4636a7882de9457535c12ba61fa0b3ae2f099391b34f6db
-  data.tar.gz: 6e3ab035c7330d900da7d03aeee4b6d26a5464c6416cb52795372966f723462ea4767ea848625cea5257bbaf10ed1be7d660ee769226d04e332dc464861e292e
+  metadata.gz: f5e563b6bcb8f601cb0d31c846869c8d62bff34d2154fd356c0c6596f695ed2238a152abfb3e50871ab1b20b8d581f5e17734a88a9af2770351c58bacc3f4fa5
+  data.tar.gz: e740b5181dcf8f7eb9915d9395c7bef55c222249980c3866cb771d2cc151c7ee61ef948b14b081e9562dec467314f21fe5207140b55f298dc359b3a04d5d0fd0

data/.travis.yml

@@ -0,0 +1,5 @@
+before_install:
+  - gem install bundler
+rvm:
+  - 2.7.0
+  - 3

data/README.md

@@ -1,7 +1,9 @@
-# Capistrano Cloudwatch [![Build Status](https://travis-ci.com/olioex/capistrano-ssh-authorized-keys-github.svg)](https://travis-ci.com/olioex/capistrano-ssh-authorized-keys-github) [![Gem Version](https://badge.fury.io/rb/capistrano-ssh-authorized-keys-github.svg)](http://badge.fury.io/rb/capistrano-ssh-authorized-keys-github)
+# Capistrano Cloudwatch [![Build Status](https://app.travis-ci.com/OLIOEX/capistrano-ssh-authorized-keys-github.svg?branch=main)](https://app.travis-ci.com/olioex/capistrano-ssh-authorized-keys-github) [![Gem Version](https://badge.fury.io/rb/capistrano-ssh-authorized-keys-github.svg)](http://badge.fury.io/rb/capistrano-ssh-authorized-keys-github)
 
 Sync organisation SSH public keys to server `authorized_keys` file so they are able to SSH into OS - for [Capistrano v3](https://github.com/capistrano/capistrano).
 
+Note: The authorized keys file is generated locally before being uploaded to the server(s).
+
 ## Installation
 
 Add this line to your application's Gemfile:
@@ -27,6 +29,9 @@ And then set the variables in `config/deploy.rb`:
     set :github_org, 'olioex'
     # ...or... (takes priority)
     set :github_orgs, ['olioex', 'github']
+    # Optional for Github rate limits (oauth application)
+    set :github_app_id, '12345'
+    set :github_app_secret, 'abcdef'
 
 The task will run automatically on successful deploy. Alternatively, you can notify of a deploy starting manually by using:
 
@@ -34,7 +39,9 @@ The task will run automatically on successful deploy. Alternatively, you can not
 
 ### Notes
 
-Users in your organisation will need to have their membership public in order for SSH public keys to be sync'd to the server
+Users in your organisation will need to have their membership public in order for SSH public keys to be sync'd to the server.
+
+Github rate limits aren't currently respected. They are limited to 60 per hour. if you have a large number of users and are doing regular syncing from an IP address then you will be rate limited.
 
 ## Copyright
 

data/capistrano-ssh-authorized-keys-github.gemspec

@@ -4,7 +4,7 @@ $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 
 Gem::Specification.new do |spec|
   spec.name          = 'capistrano-ssh-authorized-keys-github'
-  spec.version       = '1.0.0'
+  spec.version       = '1.1.0'
   spec.authors       = ['lloydwatkin']
   spec.email         = ['lloyd@olioex.com']
   spec.summary       = %q{Sync Github organisation public SSH keys to `server authorized_keys` file}

data/lib/capistrano/tasks/ssh-authorized-keys-github.cap

@@ -8,18 +8,19 @@ NO_ORGANISATION_MEMBER_KEYS_FOUND = 'There are no public members for this Github
 namespace :security do
   desc 'Cycle SSH key logins'
   task :update_ssh_keys do
-    on roles(:all) do
+    on roles(:all) do |host|
       organisations = fetch(:github_orgs) || fetch(:github_org) || raise(NO_GITHUB_ORGANISATION_PROVIDED)
       keys = ""
-      user = `whoami`.chomp
+      authentication = ''
+      if fetch(:github_app_id) && fetch(:github_app_secret)
+        authentication = "#{fetch(:github_app_id)}:#{fetch(:github_app_secret)}@"
+      end
 
       [*organisations].each do |organisation|
-        url = URI("https://api.github.com/orgs/#{organisation}")
+        url = URI("https://#{authentication}api.github.com/orgs/#{organisation}")
         organisation_details = JSON.parse(Net::HTTP.get_response(url).body, symbolize_names: true)
-        puts organisation_details
-        members_url = URI(organisation_details[:members_url].gsub("{/member}", ""))
+        members_url = URI(organisation_details[:members_url].gsub("{/member}", "").gsub('https://', "https://#{authentication}"))
         members = JSON.parse(Net::HTTP.get_response(members_url).body, symbolize_names: true)
-        puts members
         keys += "      #
         # #{organisation_details[:name]} keys
         # #{members_url}
@@ -29,7 +30,7 @@ namespace :security do
         "
         member_details = members.map { |member| member[:login].downcase }.sort
         member_details.each do |member|
-          member_keys = URI("https://github.com/#{member}.keys")
+          member_keys = URI("https://#{authentication}github.com/#{member}.keys")
           info = "      #
       # @#{member}
       # #{member_keys}
@@ -40,9 +41,11 @@ namespace :security do
       end
 
       if keys.scan(/ssh-(rsa|ed25519)/).count > 0
-        File.open("/home/#{user}/.ssh/authorized_keys", "w") do |f|
+        File.open("./tmp/authorized_keys", "w") do |f|
           f.write(keys)
         end
+        upload! './tmp/authorized_keys', "/tmp/authorized_keys"
+        execute :mv, "/tmp/authorized_keys", "~/.ssh/authorized_keys"
       else
         raise NO_ORGANISATION_MEMBER_KEYS_FOUND
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-ssh-authorized-keys-github
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.1.0
 platform: ruby
 authors:
 - lloydwatkin
@@ -75,6 +75,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".gitignore"
+- ".travis.yml"
 - Gemfile
 - LICENSE
 - README.md