Allow more control over how reusable Github actions are cloned

[mtrmarko]

Act version

0.2.74

Feature description

Running into an issue where I am trying to use docker/scout-action@v1 Github reusable action. On first workflow execution, act tries to clone this action's repository. Well, the repository is over 6GB in size and cloning kept going very slowly even though I am on a 1Gbps fiber connection. Then after about an hour watch du -s stopped incrementing on the repo directory .cache/act/docker-scout-action@v1 while act kept sitting on ☁ git clone 'https://github.com/docker/scout-action' # ref=v1 step. Trying to do CTRL+C did not immediately stop the run. Took several tries. This repo appears to be large because Docker folks are committing a dist folder with all the pre-compiled binaries of Docker Scout CLI. This adds up. It would be nice to have something like a --action-fetch-depth parameter, or similar that would essentially allow act to run something like git clone --depth 1 --branch v1 https://github.com/docker/scout-action.git docker-scout-action@v1. Not sure if this fits act design goals or if the request even makes sense. For now, I am going to resort to installing Docker Scout CLI manually and running it as a bash step instead. This is what part of my workflow looked like when using the reusable action:

      - name: Run Scout Scan
        uses: docker/scout-action@v1
        with:
          command: cves
          image: ${{ env.DOCKER_ORG }}/${{ env.DOCKER_IMAGE }}:latest
          only-fixed: true
          exit-code: true
          sbom: true
          attestation-add: true

[ChristopherHX]

Thanks for your suggestion.

Shallow fetch seems to be reasonable to do here, my linked PR only applies this for a currently disabled backend of actions caching.

By more control you want to provide custom git cli arguments? we use go-git not git cli this is not straight forward

[mtrmarko]

@ChristopherHX thank you so much for the quick response and for the referenced PR. How do I best take advantage of the change for my use case?

As for my original suggestion, I only gave an example of a git cli command to better explain what I think could solve the issue. While I am not a golang developer, in your PR, I think you seem to be using go-git's Depth option to accomplish the shallow clone, which should do. As for making this configurable, my suggestion of using --action-fetch-depth was in reference to act argument we could pass from command line (ie act --action-fetch-dept 1 or from .actrc file kind of thing. Please let me know if I can provide any additional information, and thanks again.

[ChristopherHX]

The code of my PR is behind cli --use-new-action-cache (or if you activate the local repository feature), you currently need the snapshot of that PR to see it.

If you are using docker container actions (running job in container is ok) I still advice not to activate this toggle at the moment.

Since actions itself are send as tar/zip archives if we make GitHub Actions Runner as example.

To be considered

[mtrmarko]

Got it. Thank you!