Send a workflow warning when changing file permissions

Pages DFS needs the "group read" permission set on any file it serves,
so add read permission before tarring to prevent unreadable files from
being deployed.

This only applies to files that are built on an actions runner, not
files that are cloned from a git repoitory, because git's permissions
are limited to the equivalents of chmod 644 and 755.

.github/workflows/draft-release.yml

@@ -8,7 +8,7 @@ jobs:
   draft-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
       - uses: release-drafter/release-drafter@v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -1,7 +1,7 @@
 name: Release
 on:
   release:
-    types: [edited]
+    types: [released]
   workflow_dispatch:
     inputs:
       TAG_NAME:

.github/workflows/test-hosted-runners.yml

@@ -0,0 +1,52 @@
+name: Run Tests
+
+#
+# Create some files with script/new-artifact.sh and confirm they are properly packaged and uploaded
+# as artifacts with the actions.
+#
+# This is tested on all OS platforms where we have hosted runners.
+#
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  test:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Generate files
+      run: mkdir artifact && mkdir artifact2 && cd artifact && ../script/new-artifact.sh
+      shell: bash
+
+    - name: Upload Pages artifact
+      uses: ./
+      with:
+        path: artifact
+
+    - name: Download artifact
+      uses: actions/download-artifact@v3
+      with:
+          name: github-pages
+          path: artifact2
+
+    - name: Extract artifact
+      run: tar -xf artifact2/artifact.tar -C artifact2 && rm artifact2/artifact.tar
+      shell: bash
+
+    - name: Compare files
+      run: diff -qr artifact artifact2
+      shell: bash
+
+    - name: Check for absence of symlinks
+      run: if [ $(find artifact2 -type l | wc -l) != 0 ]; then echo "Symlinks found"; exit 1; fi
+      shell: bash

action.yml

@@ -14,29 +14,41 @@ runs:
   using: composite
   steps:
     - name: Archive artifact
-      shell: bash
+      shell: sh
       if: runner.os == 'Linux'
       run: |
+        for f in $(chmod -c -R +r . | awk '{print substr($3, 2, length($3)-2)}')
+        do
+          echo "::warning::Added read permission to $f"
+        done
         tar \
           --dereference --hard-dereference \
-          --directory ${{ inputs.path }} \
-          -cvf ${{ runner.temp }}/artifact.tar \
+          --directory "$INPUT_PATH" \
+          -cvf "$RUNNER_TEMP/artifact.tar" \
           --exclude=.git \
           --exclude=.github \
           .
+      env:
+        INPUT_PATH: ${{ inputs.path }}
 
     # Switch to gtar (GNU tar instead of bsdtar which is the default in the MacOS runners so we can use --hard-dereference)
     - name: Archive artifact
-      shell: bash
+      shell: sh
       if: runner.os == 'macOS'
       run: |
+        for f in $(gchmod -c -R +r . | awk '{print substr($3, 2, length($3)-2)}')
+        do
+          echo "::warning::Added read permission to $f"
+        done
         gtar \
           --dereference --hard-dereference \
-          --directory ${{ inputs.path }} \
-          -cvf ${{ runner.temp }}/artifact.tar \
+          --directory "$INPUT_PATH" \
+          -cvf "$RUNNER_TEMP/artifact.tar" \
           --exclude=.git \
           --exclude=.github \
           .
+      env:
+        INPUT_PATH: ${{ inputs.path }}
 
     # Massage the paths for Windows only
     - name: Archive artifact
@@ -45,12 +57,14 @@ runs:
       run: |
         tar \
           --dereference --hard-dereference \
-          --directory "${{ inputs.path }}" \
-          -cvf "${{ runner.temp }}\artifact.tar" \
+          --directory "$INPUT_PATH" \
+          -cvf "$RUNNER_TEMP\artifact.tar" \
           --exclude=.git \
           --exclude=.github \
           --force-local \
           "."
+      env:
+        INPUT_PATH: ${{ inputs.path }}
 
     - name: Upload artifact
       uses: actions/upload-artifact@main

script/new-artifact.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env sh
+
+# Create some files and directories in the current folder
+echo 'hello' > hello.txt
+mkdir subdir
+echo 'world' > subdir/world.txt
+
+# Add some symlinks (which we should dereference properly when archiving)
+ln -s subdir subdir-link
+ln -s hello.txt bonjour.txt