Skip to content

Consider installing just with apt-get on Ubuntu 24.04 runners #39

Description

@alarthast

The action currently use the install-just.sh script committed to this repo to install just on the GitHub CI runners.

The benefit of using the script (which is pretty much a copy of https://github.com/casey/just/blob/master/www/install.sh) is that it supports installation on Windows, MacOS and Linux CI runners. The script downloads just from GitHub and fetches the specified version, which at the time of writing is 1.34.0:

bash "${{ github.action_path }}"/install-just.sh --to "$HOME/bin" --tag 1.34.0

url=https://github.com/casey/just
releases=$url/releases

We previously preferred the use of the installation script to fetch just directly from GitHub over delegating to third parties such as uv or setup-just.

On Ubuntu 24.04 (but not Ubuntu 22.04), just can be installed with apt get. Perhaps installing just via Ubuntu would be more secure than fetching it from https://github.com/casey/just/releases in terms of the likelihood of a vulnerable / compromised release of just ending up in our runners.

We should consider installing just via apt get on Ubuntu 24.04 runners, and only use the install-just.sh script for Windows, MacOS and Ubuntu 22.04 runners. This could potentially reduce the attack surface of our services.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions