Self-Hosted Github runner, how do privileged commands work?

Question

What I'm trying to achieve:

A fully automated deployment for a React App, on any commit to the live branch, by my own defined Github Runner, which is running Ubuntu Server 20.04, with npm 6.14.8

What I have so far:

autodeploy.yml

name: AutoDeploy
on:
  push:
    branches: [live]
jobs:
  build:
    name: Deploy Client App
    runs-on: self-hosted
    steps:
    - uses: actions/checkout@v2
    - uses: actions/setup-node@v1
      with:
        node-version: '12'
        
    - name: Fetch latest version
      uses: actions/checkout@v1

    - name: Install Dependencies
      run: npm install
      working-directory: ./Code/client-app-react

    - name: Build project
      run: npm run build
      working-directory: ./Code/client-app-react

    - name: Copy build to webserver
      run: sudo cp -r ./ /var/www/domains/react.app.public
      working-directory: ./Code/client-app-react/build

    - name: Copy .htaccess to webserver
      run: sudo cp .htaccess /var/www/domains/react.app.public/.htaccess
      working-directory: ./Media/Server

Everything seems to work until I get to the Copy/Paste step by

sudo cp -r ./ /var/www/domains/react.app.public

The message I get is:

sudo: no tty present and no askpass program specified
Error: Process completed with exit code 1.

I have no clue of what AskPass is or how to open a TTY. I expected this to work according to this article:

https://stackoverflow.com/questions/57830375/github-actions-workflow-error-permission-denied

How do I execute privileged or elevated commands from the Github Action configuration file autodeploy.yml?

score 0 · Answer 1 · answered Nov 20 '20 at 22:53

There are two possible solutions for this:

Change permissions of /var/www/domains/react.app.public directory so that the user can write into the directory. Then you can remove the sudo away from the command.
Configure sudo to not ask password when executing the command. This can be implemented with the following line in /etc/sudoers.d/autodeploy

user ALL = (root) NOPASSWD: /usr/bin/cp -r ./ /var/www/domains/react.app.public
user ALL = (root) NOPASSWD: /usr/bin/cp .htaccess /var/www/domains/react.app.public/.htaccess

Here the user is the name of the user that runs the deployment process.

Self-Hosted Github runner, how do privileged commands work?

1 Answers1