About

This opens a reverse-shell in a GitHub Actions job to aid you troublshooting odd behaviours.

Since GitHub Actions cannot be directly accessed from the internet (only outbound connections are allowed), we need a way to expose individual services to our local machine. For this we are going to use the fatedier/frp reverse proxy and our local machine that is indirectly accessible from the internet. Something alike:

NB This also applies to Windows based GitHub Actions, but using RDP instead of SSH.

Usage

Generate the TLS certificates:

export FRPS_DOMAIN=frps.example.com
./generate-certificates.sh

Start the server with the corresponding frps.ini configuration file:

./frp/frps -c ./frps.ini

Temporarily run the client in our machine to test everything with the corresponding frpc.ini configuration file:

./frp/frpc -c ./frpc.ini

Connect to the client SSH server:

ssh -o Port=6000 127.0.0.1

Stop the frpc client.

You are now almost ready to run frpc inside your GitHub Action job; before doing that, you need to create the following repository encrypted secrets:

Secret Name	Value
RUNNER_PASSWORD	runner account password (it will be reset to this value)
FRPS_DOMAIN	your frps domain
FRPC_TLS_KEY	paste the contents of the ca/github-key.pem file
FRPC_TLS_CERTIFICATE	paste the contents of the ca/github.pem file
FRPC_TLS_CA_CERTIFICATE	paste the contents of the ca/ca.pem file
SSH_PUBLIC_KEY	paste the contents of the ~/.ssh/id_rsa.pub file

You can now run the GitHub Action.

NB frpc will keep the Action running until GitHub expires it after 6h (as per the usage limits) or you cancel it.

Connect to the Ubuntu based GitHub Action SSH server:

ssh -o Port=6000 [email protected]
#killall frpc # terminate frpc from the shell.

Connect to the Windows based GitHub Action RDP server:

sudo apt-get install -y freerdp2-x11
xfreerdp /v:127.0.0.1:6001 /u:runneradmin "/p:$RUNNER_PASSWORD" /size:1440x900 +clipboard

And that's it... You now have a way to troubleshoot your GitHub Actions.

For more details see this repository action workflows.

Alternatives

• Chisel