Excludes specified in FLAGS don't work

[yourcelf]

It appears that the action is not honoring "--exclude" flags in the FLAGS value. Neither the default --exclude=".*", nor custom patterns defined with --exclude in a FLAGS override are excluding any files.

Using this workflow step:

    - name: Deploy to WPEngine
      uses: wpengine/github-action-wpe-site-deploy@v3
      with:
        WPE_SSHG_KEY_PRIVATE: ${{ secrets.WPE_SSHG_KEY_PRIVATE }}
        WPE_ENV: ${{ inputs.wpe-env }}
        SRC_PATH: ${{ inputs.src-path }}
        REMOTE_PATH: ${{ inputs.remote-path }}
        PHP_LINT: TRUE

and providing no override for FLAGS, here is snipped output from the workflow in github actions. (I've replaced the environment and plugin names here):

Run wpengine/github-action-wpe-site-deploy@v3
  with:
    WPE_SSHG_KEY_PRIVATE: ***
    WPE_ENV: ourenvironment
    SRC_PATH: ourplugin/
    REMOTE_PATH: wp-content/plugins/ourplugin/
    PHP_LINT: true
    FLAGS: -azvr --inplace --exclude=".*"
    CACHE_CLEAR: true
/usr/local/bin/docker run --name wpenginesitedeploy102_43585a --label 9cd919 --workdir /github/workspace --rm -e "INPUT_WPE_SSHG_KEY_PRIVATE" -e "INPUT_WPE_ENV" -e "INPUT_SRC_PATH" -e "INPUT_REMOTE_PATH" -e "INPUT_PHP_LINT" -e "INPUT_FLAGS" -e "INPUT_CACHE_CLEAR" -e "INPUT_PRD_ENV" -e "INPUT_STG_ENV" -e "INPUT_DEV_ENV" -e "INPUT_SCRIPT" -e "WPE_SSHG_KEY_PRIVATE" -e "WPE_ENV" -e "PRD_ENV" -e "STG_ENV" -e "DEV_ENV" -e "REMOTE_PATH" -e "SRC_PATH" -e "FLAGS" -e "PHP_LINT" -e "CACHE_CLEAR" -e "SCRIPT" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_WORKSPACE" -e "GITHUB_EVENT_PATH" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "GITHUB_ACTION" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e "ACTIONS_RESULTS_URL" -e GITHUB_ACTIONS=true -e CI=true --network github_network_2919263ad1ce466bbe55af395a1b42f9 -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/runner/_work/_temp/_github_home":"/github/home" -v "/runner/_work/_temp/_github_workflow":"/github/workflow" -v "/runner/_work/_temp/_runner_file_commands":"/github/file_commands" -v "/runner/_work/ourrepo/ourrepo":"/github/workspace" wpengine/site-deploy:1.0.2

... [skip 120 lines] ...

!!! MULTIPLEX SSH CONNECTION ESTABLISHED !!!
OpenSSH_9.3p2, OpenSSL 3.1.3 19 Sep 2023
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: multiplexing control connection
debug1: channel 1: new mux-control [mux-control] (inactive timeout: 0)
debug1: channel 2: new session [client-session] (inactive timeout: 0)
debug1: Sending command: rsync --server -vlogDtprze.iLsfxCIvu --inplace . sites/ourenvironment/wp-content/plugins/ourplugin/
debug1: mux_client_request_session: master session id: 2
sending incremental file list
./
.eslintrc
.prettierignore
.prettierrc
.stylelintrc
... [skip remaining lines] ...

Note that:

• the debug output reports the FLAGS value as -azvr --inplace --exclude=".*". This should exclude all files starting with a dot.
• The debug output shows the command rsync --server -vlogDtprze.iLsfxClvu --inplace is being called. if that's the rsync call that is transferring files from the action runner to WPE, it is not including the flags in FLAGS.
• The rsync "incremental file list" that follows includes files that should be excluded by the default flag --exclude=".*" (including .eslintrc, .prettierignore, etc).

Those files are indeed transferred to the WPE host; so even if that debug output is misleading and describes some other rsync operation that is happening, one way or the other the files that should be excluded are included.

To reproduce

Define a github actions workflow to deploy a particular source directory to a particular destination. Either define a FLAGS value with custom --exclude flags, or leave it as the default value. Note that files in the repository that should be excluded are sent to the WPE host.

Expected behavior

Including an --exclude=<pattern> flag in FLAGS should prevent files matching the pattern from being sent to WPE.

Version information

• Action version: v3

[yourcelf]

One more data-point: excluding using --exclude-from=<file> rather than --exclude=<pattern> works as expected. Looks like there may be something in the way rsync is invoked with the flags that causes --exclude flags to get ignored/pre-empted.

But only if you don't wrap the filename in double-quotes. Wrap it in doulequotes and this breaks. :(

[apmatthews]

Thanks for the report! I was able to reproduce the behavior you're seeing and traced it back to the quotes around the default --exclude=".*" flag.

I'm not sure when it will be released, but I plan on working on the fix today. In the meantime, you can override the default flags by setting your own - just remove the double quotes that were in the --exclude flag and the dotfile exclusion should work.

- name: GitHub Action Deploy to WP Engine
      uses: wpengine/github-action-wpe-site-deploy@v3
      with:
        WPE_SSHG_KEY_PRIVATE: ${{ secrets.WPE_SSHG_KEY_PRIVATE }}
        WPE_ENV: ${{ inputs.wpe-env }}
        SRC_PATH: ${{ inputs.src-path }}
        REMOTE_PATH: ${{ inputs.remote-path }}
        PHP_LINT: TRUE
        FLAGS: -azvr --inplace --exclude=.*

[kmaling]

Has this been fixed, or do we still need to remove the double quotes that were in the --exclude flag?

[koloml]

This should be fixed. I've spent a literal day to just figure out that all my --exclude rules do not work because of the quotes. Also, it looks like both double- and single-quotes are broken. I've made several --include and one --exclude rules with quotes but my pipeline just ignored everything, until I removed them.

[yourcelf]

A workaround I've used: instead of using --exclude directly within FLAGS, use --exclude-from with a filename. That helps avoid all the quoting issues for the excluded globs themselves, since they're isolated to the file. For convenience, you can write the contents of that file in the pipeline. Example:

jobs:
  deploy:
    steps:
      - name: Write excludes file
        run: |
          cat << EOF > .deploy-wpengine-ignore
          .*
          package.*
          tests
          README.md
          EOF
      - name: Deploy to WPEngine
        uses: wpengine/github-action-wpe-site-deploy@v3
        with:
          FLAGS: -azvr --inplace --exclude-from=.deploy-wpengine-ignore

[koloml]

Well, yeah, this is a way to do it. The main problem here is a documentation showing the examples with quotes. That's a little bit misleading.

[apmatthews]

In addition to the docs update in #94, a complete fix for this issue was released in v1.0.4 of the wpengine/site-deploy image. It has been released in v3.2.6 of this action. You will get this automatically if you're running wpengine/github-action-wpe-site-deploy@v3.

Quotes (both single and double) are now automatically stripped from FLAGS. Only use them when you have a flag that contains whitespace in its value.

For example, you need single quotes for the --filter flag in the following:

 - name: Deploy to WPEngine
      uses: wpengine/github-action-wpe-site-deploy@v3
      with:
        ...
        FLAGS: -azvr --inplace --delete --exclude=.* --filter=':- .gitignore'

Full details of the fix are available in wpengine/site-deploy#32.

More documentation updates coming in #105.

---

The debug output shows the command rsync --server -vlogDtprze.iLsfxClvu --inplace is being called. if that's the rsync call that is transferring files from the action runner to WPE, it is not including the flags in FLAGS.

This is not the call that transfers files from the action runner to WPE. It's something rsync does under the hood to start the rsync process on the receiving end.

The command that's responsible for initiating the sync wasn't previously available in the action's output. However, it has been added in v3.2.6 of the action. You should now see a line in your action's output that starts with + rsync. That's the full rsync command as the action runner sees it.

+ rsync '--rsh=ssh -v -p 22 -i /github/home/.ssh/wpe_id_rsa -o StrictHostKeyChecking=no -o '\''ControlPath=/github/home/.ssh/ctl/%C'\''' -azvr --inplace --delete '--exclude=.*' --exclude-from=/exclude.txt --chmod=D775,F664 tests/data/plugins/test-plugin [email protected]:sites/myenv/wp-content/plugins/

Additionally, we've added some more information to the action log to help with debugging flags. It looks something like this:

Deploying your code to:
	myenv
with the following 4 rsync argument(s):
	-azvr
	--inplace
	--delete
	--exclude=.*