From 09db868176a396015a200d76f1c4ee8585a97320 Mon Sep 17 00:00:00 2001 From: Andrew Brandt Date: Thu, 27 Aug 2026 10:42:11 -0400 Subject: [PATCH 1/2] feat: add kubectl support Signed-off-by: Andrew Brandt --- .github/workflows/test.yml | 57 ++++++++++++++++++++++++++++++++++++++ README.md | 9 +++++- action.yml | 24 ++++++++++++++++ 3 files changed, 89 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c9ab7c9..00a7365 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -66,6 +66,8 @@ jobs: setup-jq: true setup-semver: true setup-deterministic-zip: true + setup-kubectl: true + kubectl-version: 'v1.33.0' - name: Verify Setup run: | @@ -132,6 +134,9 @@ jobs: echo "::group::Verify deterministic-zip Installation" deterministic-zip --version echo "::endgroup::" + echo "::group::Verify kubectl Installation" + kubectl version --client + echo "::endgroup::" test-egress-policy: name: Test Egress Policy Input @@ -613,3 +618,55 @@ jobs: - name: Verify deterministic-zip Installation run: | deterministic-zip --version + + test-setup-kubectl: + name: Test Setup kubectl + runs-on: ubuntu-latest + steps: + - name: Harden Runner + id: harden-runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Checkout Repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Run Setup kubectl Action + uses: ./ + with: + setup-kubectl: true + + - name: Verify kubectl Installation + run: | + kubectl version --client + + test-setup-kubectl-custom-version: + name: Test Setup kubectl (custom version) + runs-on: ubuntu-latest + steps: + - name: Harden Runner + id: harden-runner + uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 + with: + egress-policy: audit + + - name: Checkout Repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + - name: Run Setup kubectl Action (non-default version) + uses: ./ + with: + setup-kubectl: true + kubectl-version: 'v1.31.0' + + - name: Verify kubectl Version Matches Input + env: + EXPECTED_VERSION: v1.31.0 + run: | + ACTUAL="$(kubectl version --client)" + echo "kubectl reported: ${ACTUAL}" + if ! echo "${ACTUAL}" | grep -qF "${EXPECTED_VERSION}"; then + echo "Expected kubectl version ${EXPECTED_VERSION}, got: ${ACTUAL}" + exit 1 + fi diff --git a/README.md b/README.md index 84099cf..986e1c6 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ Common steps for initializing a job for GitHub actions. This composite action co - Security hardening with Step Security's Harden Runner (configurable egress policy) - Repository checkout with configurable options - Multi-language support (Node.js, Java, Python, Go, Rust, Swift) -- Build tool setup (Gradle, Task, gomplate, jq) +- Build tool setup (Gradle, Task, gomplate, jq, kubectl) - Automatic caching for dependencies and build artifacts ## Usage @@ -175,6 +175,13 @@ Common steps for initializing a job for GitHub actions. This composite action co > per-platform SHA-256 (fail-closed) rather than the release's own `.sha256` sidecar, so an > upstream asset swap is rejected. Supports Linux/macOS on `amd64`/`arm64`. +**kubectl** + +| Input | Description | Required | Default | +|-----------------|---------------------------|----------|---------| +| setup-kubectl | Whether to setup kubectl | No | false | +| kubectl-version | kubectl version to use | No | v1.33.0 | + ### Outputs **Checkout Outputs** diff --git a/action.yml b/action.yml index 23d4a30..88b081d 100644 --- a/action.yml +++ b/action.yml @@ -182,6 +182,14 @@ inputs: description: 'Whether to setup deterministic-zip' required: false default: 'false' + setup-kubectl: + description: 'Whether to setup kubectl' + required: false + default: 'false' + kubectl-version: + description: 'kubectl version to use (e.g. v1.33.0)' + required: false + default: 'v1.33.0' # expose outputs from the sub-actions outputs: @@ -657,6 +665,22 @@ runs: deterministic-zip --version echo "::endgroup::" + - name: Set Up KubeCtl Parameters + id: setup-kubectl-params + if: ${{ inputs.setup-kubectl == 'true' }} + shell: bash + run: | + echo "::group::Setting up KubeCtl" + echo "Version: ${{ inputs.kubectl-version }}" + echo "::endgroup::" + + - name: Install KubeCtl + id: setup-kubectl + if: ${{ inputs.setup-kubectl == 'true' }} + uses: step-security/setup-kubectl@2edbf6aff97d814e9dc52827498ac51fe972e6d0 # v4.0.0 + with: + version: ${{ inputs.kubectl-version }} + branding: icon: 'arrow-up-right' color: 'green' From 5d8e7071f4af67b3ad07112cd5cc4f1ef7d91789 Mon Sep 17 00:00:00 2001 From: Andrew Brandt Date: Thu, 27 Aug 2026 11:03:01 -0400 Subject: [PATCH 2/2] update Signed-off-by: Andrew Brandt --- action.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/action.yml b/action.yml index 88b081d..0bf5d20 100644 --- a/action.yml +++ b/action.yml @@ -677,7 +677,7 @@ runs: - name: Install KubeCtl id: setup-kubectl if: ${{ inputs.setup-kubectl == 'true' }} - uses: step-security/setup-kubectl@2edbf6aff97d814e9dc52827498ac51fe972e6d0 # v4.0.0 + uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0 with: version: ${{ inputs.kubectl-version }}