The action currently use the install-just.sh script committed to this repo to install just on the GitHub CI runners.
The benefit of using the script (which is pretty much a copy of https://github.com/casey/just/blob/master/www/install.sh) is that it supports installation on Windows, MacOS and Linux CI runners. The script downloads just from GitHub and fetches the specified version, which at the time of writing is 1.34.0:
|
bash "${{ github.action_path }}"/install-just.sh --to "$HOME/bin" --tag 1.34.0 |
|
url=https://github.com/casey/just |
|
releases=$url/releases |
We previously preferred the use of the installation script to fetch just directly from GitHub over delegating to third parties such as uv or setup-just.
On Ubuntu 24.04 (but not Ubuntu 22.04), just can be installed with apt get. Perhaps installing just via Ubuntu would be more secure than fetching it from https://github.com/casey/just/releases in terms of the likelihood of a vulnerable / compromised release of just ending up in our runners.
We should consider installing just via apt get on Ubuntu 24.04 runners, and only use the install-just.sh script for Windows, MacOS and Ubuntu 22.04 runners. This could potentially reduce the attack surface of our services.
The action currently use the install-just.sh script committed to this repo to install
juston the GitHub CI runners.The benefit of using the script (which is pretty much a copy of https://github.com/casey/just/blob/master/www/install.sh) is that it supports installation on Windows, MacOS and Linux CI runners. The script downloads
justfrom GitHub and fetches the specified version, which at the time of writing is1.34.0:setup-action/action.yml
Line 44 in 93841f2
setup-action/install-just.sh
Lines 32 to 33 in 93841f2
We previously preferred the use of the installation script to fetch
justdirectly from GitHub over delegating to third parties such asuvorsetup-just.On Ubuntu 24.04 (but not Ubuntu 22.04),
justcan be installed withapt get. Perhaps installingjustvia Ubuntu would be more secure than fetching it from https://github.com/casey/just/releases in terms of the likelihood of a vulnerable / compromised release ofjustending up in our runners.We should consider installing
justviaapt geton Ubuntu 24.04 runners, and only use theinstall-just.shscript for Windows, MacOS and Ubuntu 22.04 runners. This could potentially reduce the attack surface of our services.