Using GitHub Actions as a Temporary Shell

This article provides a straightforward method for utilizing GitHub actions to create a temporary SSH shell that can be used for testing on different platforms. The conclusion of this article includes security concern regarding this technique.

Introduction

GitHub has been offering actions for a few years now. These actions are typically used to build software or run tasks associated with a repository. All actions run on a dedicated virtual machine under Ubuntu or macOS, which lasts for up to 6 hours before being terminated.

The purpose of this article is to demonstrate how to use tmate to share a session on that virtual machine as a temporary shell.

Share the GitHub virtual machine

One example of a simple workflow is to use a VM that has been prepared by GitHub. One example of a simple workflow:

on:
  workflow_dispatch:
    inputs:
      os:
        description: 'macOS version'
        required: true
        default: 'latest'
        type: choice
        options:
          - 11
          - 12
          - 13
          - 14
          - latest
jobs:
  runshell:
    runs-on: macos-${{ inputs.os }}
    steps:
    - name: Install tmate
      run:
        brew install tmate
    - name: Run tmate
      run:
        tmate -F

defines a job which should be run manually inside Actions tab with specified version of macOS. After a few minutes, it becomes stuck with output similar to:

To connect to the session locally, run: tmate -S /tmp/tmate-0/nmAwtR attach
Connecting to ssh.tmate.io...
web session read only: https://tmate.io/t/ro-gkRuawjAS4zSBENGSWzfjVz5j
ssh session read only: ssh ro-gkRuawjAS4zSBENGSWzfjVz5j@nyc1.tmate.io
web session: https://tmate.io/t/2RamqT7nLqYnywJjJ7vyYNsBa
ssh session: ssh 2RamqT7nLqYnywJjJ7vyYNsBa@nyc1.tmate.io

which provides instructions on how to connect to the machine via SSH or HTTP.

The machine will be terminated in 6 hours, but you may terminate it early by logging in via SSH and killing the tmate process by using the command killall tmate.

Share nested virtual machine

The same approach can be used to share almost any virtual machine (VM). The only requirements that VM should be available as GitHub action¹.

An example how to run OpenBSD as a GitHub action:

on:
  workflow_dispatch:
    inputs:
      os:
        description: 'OpenBSD version'
        required: true
        default: '7.4'
        type: choice
        options:
          - 7.2
          - 7.3
          - 7.4
jobs:
  runshell:
    runs-on: ubuntu-latest
    steps:
    - name: Install OpenBSD VM
      uses: vmactions/openbsd-vm@v1
      with:
        release: ${{ inputs.os }}
        mem: 13312
        sync: no
        prepare:
          pkg_add curl
    - name: Install tmate
      run:
        ssh openbsd pkg_add tmate
    - name: Run tmate
      run:
        ssh openbsd tmate -F

Ready-to-use shells collections

Here is a collection of my VMs that I use for development from time to time: https://github.com/catap/shell.

To use it, you need to fork it into your account and run it.

Security concern

However, please note that this solution has a security flaw as it is publicly available.

Once you run an action, anyone can access it and get the connection link, and connect to your machine.

You can reduce the risk by keeping your repository private. However, anyone who knows the connection link can connect to it without any restrictions.

tmate supports a white list of allowed keys, but using it kills the simplicity of this solution.