chore: bump go directive to 1.25.10

- Update go.mod go directive from 1.25.9 to 1.25.10
ci: bump golangci-lint to v2.12
2026-06-04 18:24:01 +08:00 · 2026-05-08 21:19:20 +08:00 · 2026-05-08 20:13:40 +08:00 · 2026-04-25 16:51:03 +08:00 · 2026-04-16 23:01:13 +08:00 · 2026-04-16 21:11:23 +08:00
16 changed files with 1132 additions and 285 deletions
@@ -0,0 +1,2 @@
+*
+!release/
@@ -38,11 +38,11 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}
          # If you wish to specify custom queries, you can do so here or in a config file.
@@ -51,4 +51,4 @@ jobs:
          # queries: ./path/to/local/query, your-org/your-repo/queries@main

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
@@ -10,15 +10,20 @@ on:
    branches:
      - "master"

+permissions:
+  contents: read
+  packages: write
+  security-events: write
+
 jobs:
  build-docker:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true
@@ -29,19 +34,19 @@ jobs:
          make build_linux_arm64

      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4

      - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
@@ -49,7 +54,7 @@ jobs:

      - name: Docker meta
        id: docker-meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@v6
        with:
          images: |
            ${{ github.repository }}
@@ -60,8 +65,34 @@ jobs:
            type=semver,pattern={{major}}.{{minor}}
            type=semver,pattern={{major}}

+      - name: Build image for scanning
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: drone-ssh:scan
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "drone-ssh:scan"
+          format: "sarif"
+          output: "trivy-image-results.sarif"
+          severity: "CRITICAL,HIGH"
+          exit-code: '1'
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-image-results.sarif"
+          category: "trivy-docker-image"
+
      - name: Build and push
-        uses: docker/build-push-action@v6
+        if: success()
+        uses: docker/build-push-action@v7
        with:
          context: .
          platforms: linux/amd64,linux/arm64
@@ -13,18 +13,18 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true

      - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@v7
        with:
          # either 'goreleaser' (default) or 'goreleaser-pro'
          distribution: goreleaser
@@ -9,37 +9,40 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: Setup go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
          check-latest: true

      - name: Setup golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
        with:
-          version: latest
+          version: v2.12
          args: --verbose

-      - uses: hadolint/hadolint-action@v3.1.0
+      - uses: hadolint/hadolint-action@v3.3.0
        name: hadolint for Dockerfile
        with:
          dockerfile: docker/Dockerfile

  testing:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        go-version: ["1.25", "1.26"]
    container:
-      image: golang:1.23-alpine
+      image: golang:${{ matrix.go-version }}-alpine
      options: --sysctl net.ipv6.conf.all.disable_ipv6=0
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6

      - name: setup sshd server
        run: |
-          apk add git make curl perl bash build-base zlib-dev ucl-dev sudo
+          apk add git make curl perl bash build-base zlib-dev ucl-dev sudo gpg
          make ssh-server

      - name: testing
@@ -47,4 +50,6 @@ jobs:
          make test

      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@v6
+        with:
+          flags: go-${{ matrix.go-version }}
@@ -0,0 +1,85 @@
+name: Trivy Security Scan
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+  schedule:
+    # Run daily at 00:00 UTC
+    - cron: "0 0 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy-repo-scan:
+    name: Trivy Repository Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Run Trivy vulnerability scanner (repo)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: "fs"
+          scan-ref: "."
+          format: "sarif"
+          output: "trivy-repo-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-repo-results.sarif"
+
+  trivy-image-scan:
+    name: Trivy Image Scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+          check-latest: true
+
+      - name: Build binary
+        run: |
+          make build_linux_amd64
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build Docker image for scanning
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: docker/Dockerfile
+          platforms: linux/amd64
+          push: false
+          load: true
+          tags: drone-ssh:scan
+
+      - name: Run Trivy vulnerability scanner (image)
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: "drone-ssh:scan"
+          format: "sarif"
+          output: "trivy-image-results.sarif"
+          severity: "CRITICAL,HIGH"
+
+      - name: Upload Trivy image scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        if: always()
+        with:
+          sarif_file: "trivy-image-results.sarif"
+          category: "trivy-image"
@@ -1,42 +1,114 @@
-run:
-  timeout: 5m
+version: "2"
+output:
+  sort-order:
+    - file
 linters:
+  default: none
  enable:
-    - asciicheck
-    - durationcheck
+    - bidichk
+    - bodyclose
+    - depguard
    - errcheck
-    - errorlint
-    - exportloopref
-    - gci
-    - gofmt
-    - goimports
-    - gosec
-    - misspell
+    - forbidigo
+    - gocheckcompilerdirectives
+    - gocritic
+    - govet
+    - ineffassign
+    - mirror
+    - modernize
    - nakedret
-    - nilerr
+    - nilnil
    - nolintlint
    - perfsprint
    - revive
+    - staticcheck
+    - testifylint
+    - unconvert
+    - unparam
+    - unused
    - usestdlibvars
+    - usetesting
    - wastedassign
-
-linters-settings:
-  gosec:
-    # To select a subset of rules to run.
-    # Available rules: https://github.com/securego/gosec#available-rules
-    # Default: [] - means include all rules
-    includes:
-      - G102
-      - G106
-      - G108
-      - G109
-      - G111
-      - G112
-      - G201
-      - G203
-  perfsprint:
-    err-error: true
-    errorf: true
-    int-conversion: true
-    sprintf1: true
-    strconcat: true
+  settings:
+    depguard:
+      rules:
+        main:
+          deny:
+            - pkg: io/ioutil
+              desc: use os or io instead
+            - pkg: golang.org/x/exp
+              desc: it's experimental and unreliable
+            - pkg: github.com/pkg/errors
+              desc: use builtin errors package instead
+    nolintlint:
+      allow-unused: false
+      require-explanation: true
+      require-specific: true
+    gocritic:
+      enabled-checks:
+        - equalFold
+      disabled-checks: []
+    revive:
+      severity: error
+      rules:
+        - name: blank-imports
+        - name: constant-logical-expr
+        - name: context-as-argument
+        - name: context-keys-type
+        - name: dot-imports
+        - name: empty-lines
+        - name: error-return
+        - name: error-strings
+        - name: exported
+        - name: identical-branches
+        - name: if-return
+        - name: increment-decrement
+        - name: modifies-value-receiver
+        - name: package-comments
+        - name: redefines-builtin-id
+        - name: superfluous-else
+        - name: time-naming
+        - name: unexported-return
+        - name: var-declaration
+        - name: var-naming
+          disabled: true
+    staticcheck:
+      checks:
+        - all
+    testifylint: {}
+    usetesting:
+      os-temp-dir: true
+    perfsprint:
+      concat-loop: false
+    govet:
+      enable:
+        - nilness
+        - unusedwrite
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - errcheck
+          - staticcheck
+          - unparam
+        path: _test\.go
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+formatters:
+  enable:
+    - gofmt
+    - gofumpt
+    - golines
+  settings:
+    gofumpt:
+      extra-rules: true
+  exclusions:
+    generated: lax
+run:
+  timeout: 10m
@@ -1,24 +1,37 @@
 # drone-ssh

+> **English** | [繁體中文](./README.zh-tw.md) | [简体中文](./README.zh-cn.md)
+
 ![sshlog](images/ssh.png)

 [![GitHub tag](https://img.shields.io/github/tag/appleboy/drone-ssh.svg)](https://github.com/appleboy/drone-ssh/releases)
 [![GoDoc](https://godoc.org/github.com/appleboy/drone-ssh?status.svg)](https://godoc.org/github.com/appleboy/drone-ssh)
 [![Lint and Testing](https://github.com/appleboy/drone-ssh/actions/workflows/testing.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-ssh/actions/workflows/testing.yml)
+[![Trivy Security Scan](https://github.com/appleboy/drone-ssh/actions/workflows/trivy.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-ssh/actions/workflows/trivy.yml)
 [![codecov](https://codecov.io/gh/appleboy/drone-ssh/branch/master/graph/badge.svg)](https://codecov.io/gh/appleboy/drone-ssh)
 [![Go Report Card](https://goreportcard.com/badge/github.com/appleboy/drone-ssh)](https://goreportcard.com/report/github.com/appleboy/drone-ssh)
 [![Docker Pulls](https://img.shields.io/docker/pulls/appleboy/drone-ssh.svg)](https://hub.docker.com/r/appleboy/drone-ssh/)

-Drone plugin to execute commands on a remote host through SSH. For the usage
-information and a listing of the available options please take a look at [the docs](http://plugins.drone.io/appleboy/drone-ssh/).
+A Drone plugin for executing commands on remote hosts via SSH. For usage instructions and a list of available options, please refer to [the documentation](http://plugins.drone.io/appleboy/drone-ssh/).

-**Note: Please update your image config path to `appleboy/drone-ssh` for drone. `plugins/ssh` is no longer maintained.**
+**Note: Please update your Drone image config path to `appleboy/drone-ssh`. The `plugins/ssh` image is no longer maintained.**

 ![demo](./images/demo2017.05.10.gif)

-## Breaking changes
+## Table of Contents

-`v1.5.0`: change command timeout flag to `Duration`. See the following setting:
+- [drone-ssh](#drone-ssh)
+  - [Table of Contents](#table-of-contents)
+  - [Breaking Changes](#breaking-changes)
+  - [Build or Download a Binary](#build-or-download-a-binary)
+  - [Docker](#docker)
+  - [Usage](#usage)
+  - [Mount Key from File Path](#mount-key-from-file-path)
+  - [Configuration](#configuration)
+
+## Breaking Changes
+
+As of `v1.5.0`, the command timeout flag has changed to use the `Duration` format. See the following example:

 ```diff
 pipeline:
@@ -38,21 +51,21 @@ pipeline:
        - echo "Hello World"
 ```

-## Build or Download a binary
+## Build or Download a Binary

-The pre-compiled binaries can be downloaded from [release page](https://github.com/appleboy/drone-ssh/releases). Support the following OS type.
+Pre-compiled binaries are available on the [releases page](https://github.com/appleboy/drone-ssh/releases), supporting the following operating systems:

-* Windows amd64/386
-* Linux arm/amd64/386
-* Darwin amd64/386
+- Windows amd64/386
+- Linux arm/amd64/386
+- macOS (Darwin) amd64/386

-With `Go` installed
+If you have `Go` installed:

 ```sh
 go install github.com/appleboy/drone-ssh@latest
 ```

-or build the binary with the following command:
+Or build the binary manually with the following commands:

 ```sh
 export GOOS=linux
@@ -67,7 +80,7 @@ go build -v -a -tags netgo -o release/linux/amd64/drone-ssh .

 ## Docker

-Build the docker image with the following commands:
+Build the Docker image with the following command:

 ```sh
 make docker
@@ -75,7 +88,7 @@ make docker

 ## Usage

-Execute from the working directory:
+Run from your working directory:

 ```sh
 docker run --rm \
@@ -88,13 +101,13 @@ docker run --rm \
  ghcr.io/appleboy/drone-ssh
 ```

-## Mount key from file path
+## Mount Key from File Path

-Please make sure that enable the `trusted` mode in project setting for [drone 0.8 version](https://0-8-0.docs.drone.io/).
+Make sure to enable `trusted` mode in your project settings (for [Drone 0.8 version](https://0-8-0.docs.drone.io/)).

 ![trusted mode](./images/trust.png)

-Mount private key in `volumes` setting of `.drone.yml` config
+Mount the private key in the `volumes` section of your `.drone.yml` config:

 ```diff
 pipeline:
@@ -109,16 +122,16 @@ pipeline:
      - echo "test ssh"
 ```

-See the detail of [issue comment](https://github.com/appleboy/drone-ssh/issues/51#issuecomment-336732928).
+See details in [this issue comment](https://github.com/appleboy/drone-ssh/issues/51#issuecomment-336732928).

 ## Configuration

-See [DOCS.md](./DOCS.md) for examples and full configuration options
+See [DOCS.md](./DOCS.md) for examples and full configuration options.

 Configuration options are loaded from multiple sources:

-0. Hardcoded drone-ssh defaults.  See [main.go CLI Flags](https://github.com/appleboy/drone-ssh/blob/6d9d6acc6aef1f9166118c6ba8bd214d3a582bdb/main.go#L39) for more information.
+0. Hardcoded drone-ssh defaults. See [main.go CLI Flags](https://github.com/appleboy/drone-ssh/blob/6d9d6acc6aef1f9166118c6ba8bd214d3a582bdb/main.go#L39) for more information.
 1. From a dotenv file at a path specified by the `PLUGIN_ENV_FILE` environment variable.
 2. From your `.drone.yml` Drone configuration.

-Later sources override previous sources, i.e. if `PORT` is set in an `.env` file committed in the repository or created by previous test steps, it will override the default set `main.go`.
+Later sources override earlier ones. For example, if `PORT` is set in an `.env` file committed in the repository or created by previous test steps, it will override the default set in `main.go`.
@@ -0,0 +1,141 @@
+# drone-ssh
+
+> [English](./README.md) | [繁體中文](./README.zh-tw.md) | **简体中文**
+
+![sshlog](images/ssh.png)
+
+<!-- 图片说明：SSH 日志画面，内容与原文一致 -->
+
+[![GitHub tag](https://img.shields.io/github/tag/appleboy/drone-ssh.svg)](https://github.com/appleboy/drone-ssh/releases)
+[![GoDoc](https://godoc.org/github.com/appleboy/drone-ssh?status.svg)](https://godoc.org/github.com/appleboy/drone-ssh)
+[![Lint and Testing](https://github.com/appleboy/drone-ssh/actions/workflows/testing.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-ssh/actions/workflows/testing.yml)
+[![Trivy Security Scan](https://github.com/appleboy/drone-ssh/actions/workflows/trivy.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-ssh/actions/workflows/trivy.yml)
+[![codecov](https://codecov.io/gh/appleboy/drone-ssh/branch/master/graph/badge.svg)](https://codecov.io/gh/appleboy/drone-ssh)
+[![Go Report Card](https://goreportcard.com/badge/github.com/appleboy/drone-ssh)](https://goreportcard.com/report/github.com/appleboy/drone-ssh)
+[![Docker Pulls](https://img.shields.io/docker/pulls/appleboy/drone-ssh.svg)](https://hub.docker.com/r/appleboy/drone-ssh/)
+
+Drone 插件，可通过 SSH 在远程主机执行命令。使用方法和可用选项请参考[官方文档](http://plugins.drone.io/appleboy/drone-ssh/)。
+
+**注意：请将 Drone 的 image config 路径更新为 `appleboy/drone-ssh`。`plugins/ssh` 已不再维护。**
+
+![demo](./images/demo2017.05.10.gif)
+
+<!-- 图片说明：SSH 命令执行演示动画，内容与原文一致 -->
+
+## 目录
+
+- [drone-ssh](#drone-ssh)
+  - [目录](#目录)
+  - [重大变更](#重大变更)
+  - [构建或下载二进制文件](#构建或下载二进制文件)
+  - [Docker](#docker)
+  - [使用方法](#使用方法)
+  - [通过文件路径挂载密钥](#通过文件路径挂载密钥)
+  - [配置说明](#配置说明)
+
+## 重大变更
+
+`v1.5.0`：将命令超时参数更改为 `Duration` 格式。设置示例如下：
+
+```diff
+pipeline:
+  scp:
+    image: ghcr.io/appleboy/drone-ssh
+    settings:
+      host:
+        - example1.com
+        - example2.com
+      username: ubuntu
+      password:
+        from_secret: ssh_password
+      port: 22
+-     command_timeout: 120
+     command_timeout: 2m
+      script:
+        - echo "Hello World"
+```
+
+## 构建或下载二进制文件
+
+可在[发布页面](https://github.com/appleboy/drone-ssh/releases)下载预编译的二进制文件，支持以下操作系统：
+
+- Windows amd64/386
+- Linux arm/amd64/386
+- macOS (Darwin) amd64/386
+
+如已安装 `Go`，可执行：
+
+```sh
+go install github.com/appleboy/drone-ssh@latest
+```
+
+或使用以下命令手动构建二进制文件：
+
+```sh
+export GOOS=linux
+export GOARCH=amd64
+export CGO_ENABLED=0
+export GO111MODULE=on
+
+go test -cover ./...
+
+go build -v -a -tags netgo -o release/linux/amd64/drone-ssh .
+```
+
+## Docker
+
+可使用以下命令构建 Docker 镜像：
+
+```sh
+make docker
+```
+
+## 使用方法
+
+在工作目录下执行：
+
+```sh
+docker run --rm \
+  -e PLUGIN_HOST=foo.com \
+  -e PLUGIN_USERNAME=root \
+  -e PLUGIN_KEY="$(cat ${HOME}/.ssh/id_rsa)" \
+  -e PLUGIN_SCRIPT=whoami \
+  -v $(pwd):$(pwd) \
+  -w $(pwd) \
+  ghcr.io/appleboy/drone-ssh
+```
+
+## 通过文件路径挂载密钥
+
+请确保已在项目设置中启用 `trusted` 模式（适用于 [Drone 0.8 版本](https://0-8-0.docs.drone.io/)）。
+
+![trusted mode](./images/trust.png)
+
+在 `.drone.yml` 配置文件的 `volumes` 部分挂载私钥：
+
+```diff
+pipeline:
+  ssh:
+    image: ghcr.io/appleboy/drone-ssh
+    host: xxxxx.com
+    username: deploy
+   volumes:
+     - /root/drone_rsa:/root/ssh/drone_rsa
+    key_path: /root/ssh/drone_rsa
+    script:
+      - echo "test ssh"
+```
+
+详情请参考 [此 issue comment](https://github.com/appleboy/drone-ssh/issues/51#issuecomment-336732928)。
+
+## 配置说明
+
+更多示例和完整配置选项请参考 [DOCS.md](./DOCS.md)。
+
+配置选项来源如下：
+
+0. 内置 drone-ssh 默认值。详见 [main.go CLI Flags](https://github.com/appleboy/drone-ssh/blob/6d9d6acc6aef1f9166118c6ba8bd214d3a582bdb/main.go#L39)。
+1. 由 `PLUGIN_ENV_FILE` 环境变量指定的 dotenv 文件。
+2. `.drone.yml` Drone 配置文件。
+
+后面的来源会覆盖前面的设置。例如，`.env` 文件中的 `PORT` 会覆盖 main.go 的默认值。
@@ -0,0 +1,141 @@
+# drone-ssh
+
+> [English](./README.md) | **繁體中文** | [简体中文](./README.zh-cn.md)
+
+![sshlog](images/ssh.png)
+
+<!-- 圖片說明：SSH 日誌畫面，圖片內容與原文相同 -->
+
+[![GitHub tag](https://img.shields.io/github/tag/appleboy/drone-ssh.svg)](https://github.com/appleboy/drone-ssh/releases)
+[![GoDoc](https://godoc.org/github.com/appleboy/drone-ssh?status.svg)](https://godoc.org/github.com/appleboy/drone-ssh)
+[![Lint and Testing](https://github.com/appleboy/drone-ssh/actions/workflows/testing.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-ssh/actions/workflows/testing.yml)
+[![Trivy Security Scan](https://github.com/appleboy/drone-ssh/actions/workflows/trivy.yml/badge.svg?branch=master)](https://github.com/appleboy/drone-ssh/actions/workflows/trivy.yml)
+[![codecov](https://codecov.io/gh/appleboy/drone-ssh/branch/master/graph/badge.svg)](https://codecov.io/gh/appleboy/drone-ssh)
+[![Go Report Card](https://goreportcard.com/badge/github.com/appleboy/drone-ssh)](https://goreportcard.com/report/github.com/appleboy/drone-ssh)
+[![Docker Pulls](https://img.shields.io/docker/pulls/appleboy/drone-ssh.svg)](https://hub.docker.com/r/appleboy/drone-ssh/)
+
+Drone 外掛程式，可透過 SSH 在遠端主機執行指令。使用方式與可用選項請參考[官方文件](http://plugins.drone.io/appleboy/drone-ssh/)。
+
+**注意：請將 Drone 的 image config 路徑更新為 `appleboy/drone-ssh`。`plugins/ssh` 已不再維護。**
+
+![demo](./images/demo2017.05.10.gif)
+
+<!-- 圖片說明：SSH 指令執行示意動畫，內容與原文相同 -->
+
+## 目錄
+
+- [drone-ssh](#drone-ssh)
+  - [目錄](#目錄)
+  - [重大變更](#重大變更)
+  - [建置或下載執行檔](#建置或下載執行檔)
+  - [Docker](#docker)
+  - [使用方式](#使用方式)
+  - [以檔案路徑掛載金鑰](#以檔案路徑掛載金鑰)
+  - [設定說明](#設定說明)
+
+## 重大變更
+
+`v1.5.0`：將指令逾時參數改為 `Duration` 格式。設定範例如下：
+
+```diff
+pipeline:
+  scp:
+    image: ghcr.io/appleboy/drone-ssh
+    settings:
+      host:
+        - example1.com
+        - example2.com
+      username: ubuntu
+      password:
+        from_secret: ssh_password
+      port: 22
+-     command_timeout: 120
+     command_timeout: 2m
+      script:
+        - echo "Hello World"
+```
+
+## 建置或下載執行檔
+
+可於[發行頁面](https://github.com/appleboy/drone-ssh/releases)下載預先編譯的執行檔，支援以下作業系統：
+
+- Windows amd64/386
+- Linux arm/amd64/386
+- macOS (Darwin) amd64/386
+
+若已安裝 `Go`，可執行：
+
+```sh
+go install github.com/appleboy/drone-ssh@latest
+```
+
+或使用下列指令手動建置執行檔：
+
+```sh
+export GOOS=linux
+export GOARCH=amd64
+export CGO_ENABLED=0
+export GO111MODULE=on
+
+go test -cover ./...
+
+go build -v -a -tags netgo -o release/linux/amd64/drone-ssh .
+```
+
+## Docker
+
+可使用下列指令建置 Docker 映像檔：
+
+```sh
+make docker
+```
+
+## 使用方式
+
+於工作目錄下執行：
+
+```sh
+docker run --rm \
+  -e PLUGIN_HOST=foo.com \
+  -e PLUGIN_USERNAME=root \
+  -e PLUGIN_KEY="$(cat ${HOME}/.ssh/id_rsa)" \
+  -e PLUGIN_SCRIPT=whoami \
+  -v $(pwd):$(pwd) \
+  -w $(pwd) \
+  ghcr.io/appleboy/drone-ssh
+```
+
+## 以檔案路徑掛載金鑰
+
+請確認已於專案設定中啟用 `trusted` 模式（適用於 [Drone 0.8 版本](https://0-8-0.docs.drone.io/)）。
+
+![trusted mode](./images/trust.png)
+
+於 `.drone.yml` 設定檔的 `volumes` 區段掛載私鑰：
+
+```diff
+pipeline:
+  ssh:
+    image: ghcr.io/appleboy/drone-ssh
+    host: xxxxx.com
+    username: deploy
+   volumes:
+     - /root/drone_rsa:/root/ssh/drone_rsa
+    key_path: /root/ssh/drone_rsa
+    script:
+      - echo "test ssh"
+```
+
+詳情請參考 [此 issue comment](https://github.com/appleboy/drone-ssh/issues/51#issuecomment-336732928)。
+
+## 設定說明
+
+更多範例與完整設定選項請參考 [DOCS.md](./DOCS.md)。
+
+設定選項來源如下：
+
+0. 內建 drone-ssh 預設值。詳見 [main.go CLI Flags](https://github.com/appleboy/drone-ssh/blob/6d9d6acc6aef1f9166118c6ba8bd214d3a582bdb/main.go#L39)。
+1. 由 `PLUGIN_ENV_FILE` 環境變數指定的 dotenv 檔案。
+2. `.drone.yml` Drone 設定檔。
+
+後面的來源會覆蓋前面的設定。例如，`.env` 檔案中的 `PORT` 會覆蓋 main.go 的預設值。
@@ -1,4 +1,4 @@
-FROM alpine:3.20
+FROM alpine:3.21

 ARG TARGETOS
 ARG TARGETARCH
@@ -1,24 +1,69 @@
 module github.com/appleboy/drone-ssh

-go 1.23.0
+go 1.25.10

 require (
-	github.com/appleboy/easyssh-proxy v1.5.0
+	github.com/appleboy/easyssh-proxy v1.5.2
 	github.com/joho/godotenv v1.5.1
-	github.com/stretchr/testify v1.8.4
-	github.com/urfave/cli/v2 v2.27.5
+	github.com/stretchr/testify v1.11.1
+	github.com/testcontainers/testcontainers-go v0.42.0
+	github.com/urfave/cli/v2 v2.27.7
 	github.com/yassinebenaid/godump v0.11.1
-	golang.org/x/crypto v0.36.0
+	golang.org/x/crypto v0.49.0
 )

 require (
-	github.com/ScaleFT/sshkeys v1.2.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/ScaleFT/sshkeys v1.4.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/cpuguy83/dockercfg v0.3.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/ebitengine/purego v0.10.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-ole/go-ole v1.2.6 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/klauspost/compress v1.18.5 // indirect
+	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
+	github.com/magiconair/properties v1.8.10 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.2.0 // indirect
+	github.com/moby/moby/api v1.54.1 // indirect
+	github.com/moby/moby/client v0.4.0 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
+	github.com/moby/sys/sequential v0.6.0 // indirect
+	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
-	golang.org/x/sys v0.31.0 // indirect
+	github.com/shirou/gopsutil/v4 v4.26.3 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/tklauser/go-sysconf v0.3.16 // indirect
+	github.com/tklauser/numcpus v0.11.0 // indirect
+	github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
+	github.com/yusufpapurcu/wmi v1.2.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.41.0 // indirect
+	go.opentelemetry.io/otel/metric v1.41.0 // indirect
+	go.opentelemetry.io/otel/trace v1.41.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -1,45 +1,153 @@
-github.com/ScaleFT/sshkeys v1.2.0 h1:5BRp6rTVIhJzXT3VcUQrKgXR8zWA3sOsNeuyW15WUA8=
-github.com/ScaleFT/sshkeys v1.2.0/go.mod h1:gxOHeajFfvGQh/fxlC8oOKBe23xnnJTif00IFFbiT+o=
-github.com/appleboy/easyssh-proxy v1.5.0 h1:OYdSPvYQN3mhnsMH5I2OF1TgwSEcSq33kvjQfTwvZww=
-github.com/appleboy/easyssh-proxy v1.5.0/go.mod h1:zcEMrStH91/tcUn3gUGP0KpQwUYLm8tX/Ook1AH98uc=
-github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
-github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
+dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/ScaleFT/sshkeys v1.4.0 h1:Yqd0cKA5PUvwV0dgRI67BDHGTsMHtGQBZbLXh1dthmE=
+github.com/ScaleFT/sshkeys v1.4.0/go.mod h1:GineMkS8SEiELq8q5DzA2Wnrw65SqdD9a+hm8JOU1I4=
+github.com/appleboy/easyssh-proxy v1.5.2 h1:Fe4/RMNtoU/l36w5DvOEyMX3VcpwUbqZYBdPugqODOs=
+github.com/appleboy/easyssh-proxy v1.5.2/go.mod h1:cv8OlpCbAdxVNYgY/vQcM7f/Ep51UG5oyLK+J2kZhEc=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
+github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
+github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
+github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
+github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
+github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a h1:saTgr5tMLFnmy/yg3qDTft4rE5DY2uJ/cCxCe3q0XTU=
 github.com/dchest/bcrypt_pbkdf v0.0.0-20150205184540-83f37f9c154a/go.mod h1:Bw9BbhOJVNR+t0jCqx2GC6zv0TGBsShs56Y3gfSCvl0=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/ebitengine/purego v0.10.0 h1:QIw4xfpWT6GWTzaW5XEKy3HXoqrJGx1ijYHzTF0/ISU=
+github.com/ebitengine/purego v0.10.0/go.mod h1:iIjxzd6CiRiOG0UyXP+V1+jWqUXVjPKLAI0mRfJZTmQ=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-ole/go-ole v1.2.6/go.mod h1:pprOEPIfldk/42T2oK7lQ4v4JSDwmV0As9GaiUsvbm0=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
 github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
+github.com/klauspost/compress v1.18.5 h1:/h1gH5Ce+VWNLSWqPzOVn6XBO+vJbCNGvjoaGBFW2IE=
+github.com/klauspost/compress v1.18.5/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
+github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE=
+github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0=
+github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
+github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
+github.com/moby/go-archive v0.2.0 h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
+github.com/moby/go-archive v0.2.0/go.mod h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/moby/api v1.54.1 h1:TqVzuJkOLsgLDDwNLmYqACUuTehOHRGKiPhvH8V3Nn4=
+github.com/moby/moby/api v1.54.1/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
+github.com/moby/moby/client v0.4.0 h1:S+2XegzHQrrvTCvF6s5HFzcrywWQmuVnhOXe2kiWjIw=
+github.com/moby/moby/client v0.4.0/go.mod h1:QWPbvWchQbxBNdaLSpoKpCdf5E+WxFAgNHogCWDoa7g=
+github.com/moby/patternmatcher v0.6.1 h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
+github.com/moby/patternmatcher v0.6.1/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
+github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
+github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
+github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
+github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
+github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
+github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/urfave/cli/v2 v2.27.5 h1:WoHEJLdsXr6dDWoJgMq/CboDmyY/8HMMH1fTECbih+w=
-github.com/urfave/cli/v2 v2.27.5/go.mod h1:3Sevf16NykTbInEnD0yKkjDAeZDS0A6bzhBH5hrMvTQ=
-github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
-github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/shirou/gopsutil/v4 v4.26.3 h1:2ESdQt90yU3oXF/CdOlRCJxrP+Am1aBYubTMTfxJ1qc=
+github.com/shirou/gopsutil/v4 v4.26.3/go.mod h1:LZ6ewCSkBqUpvSOf+LsTGnRinC6iaNUNMGBtDkJBaLQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
+github.com/stretchr/objx v0.5.3 h1:jmXUvGomnU1o3W/V5h2VEradbpJDwGrzugQQvL0POH4=
+github.com/stretchr/objx v0.5.3/go.mod h1:rDQraq+vQZU7Fde9LOZLr8Tax6zZvy4kuNKF+QYS+U0=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/testcontainers/testcontainers-go v0.42.0 h1:He3IhTzTZOygSXLJPMX7n44XtK+qhjat1nI9cneBbUY=
+github.com/testcontainers/testcontainers-go v0.42.0/go.mod h1:vZjdY1YmUA1qEForxOIOazfsrdyORJAbhi0bp8plN30=
+github.com/tklauser/go-sysconf v0.3.16 h1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=
+github.com/tklauser/go-sysconf v0.3.16/go.mod h1:/qNL9xxDhc7tx3HSRsLWNnuzbVfh3e7gh/BmM179nYI=
+github.com/tklauser/numcpus v0.11.0 h1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=
+github.com/tklauser/numcpus v0.11.0/go.mod h1:z+LwcLq54uWZTX0u/bGobaV34u6V7KNlTZejzM6/3MQ=
+github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
+github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
+github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 h1:FnBeRrxr7OU4VvAzt5X7s6266i6cSVkkFPS0TuXWbIg=
+github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yassinebenaid/godump v0.11.1 h1:SPujx/XaYqGDfmNh7JI3dOyCUVrG0bG2duhO3Eh2EhI=
 github.com/yassinebenaid/godump v0.11.1/go.mod h1:dc/0w8wmg6kVIvNGAzbKH1Oa54dXQx8SNKh4dPRyW44=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+github.com/yusufpapurcu/wmi v1.2.4 h1:zFUKzehAFReQwLys1b/iSMl+JQGSCSjtVqQn9bBrPo0=
+github.com/yusufpapurcu/wmi v1.2.4/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
+go.opentelemetry.io/otel v1.41.0 h1:YlEwVsGAlCvczDILpUXpIpPSL/VPugt7zHThEMLce1c=
+go.opentelemetry.io/otel v1.41.0/go.mod h1:Yt4UwgEKeT05QbLwbyHXEwhnjxNO6D8L5PQP51/46dE=
+go.opentelemetry.io/otel/metric v1.41.0 h1:rFnDcs4gRzBcsO9tS8LCpgR0dxg4aaxWlJxCno7JlTQ=
+go.opentelemetry.io/otel/metric v1.41.0/go.mod h1:xPvCwd9pU0VN8tPZYzDZV/BMj9CM9vs00GuBjeKhJps=
+go.opentelemetry.io/otel/sdk v1.35.0 h1:iPctf8iprVySXSKJffSS79eOjl9pvxV9ZqOWT0QejKY=
+go.opentelemetry.io/otel/sdk v1.35.0/go.mod h1:+ga1bZliga3DxJ3CQGg3updiaAJoNECOgJREo9KHGQg=
+go.opentelemetry.io/otel/sdk/metric v1.35.0 h1:1RriWBmCKgkeHEhM7a2uMjMUfP7MsOF5JpUCaEqEI9o=
+go.opentelemetry.io/otel/sdk/metric v1.35.0/go.mod h1:is6XYCUMpcKi+ZsOvfluY5YstFnhW0BidkR+gL+qN+w=
+go.opentelemetry.io/otel/trace v1.41.0 h1:Vbk2co6bhj8L59ZJ6/xFTskY+tGAbOnCtQGVVa9TIN0=
+go.opentelemetry.io/otel/trace v1.41.0/go.mod h1:U1NU4ULCoxeDKc09yCWdWe+3QoyweJcISEVa1RBzOis=
+golang.org/x/crypto v0.49.0 h1:+Ng2ULVvLHnJ/ZFEq4KdcDd/cfjrrjjNSXNzxg0Y4U4=
+golang.org/x/crypto v0.49.0/go.mod h1:ErX4dUh2UM+CFYiXZRTcMpEcN8b/1gxEuv3nODoYtCA=
+golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
+golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
@@ -84,9 +84,14 @@ func main() {
 			EnvVars: []string{"PLUGIN_SSH_KEY", "PLUGIN_KEY", "SSH_KEY", "INPUT_KEY"},
 		},
 		&cli.StringFlag{
-			Name:    "ssh-passphrase",
-			Usage:   "The purpose of the passphrase is usually to encrypt the private key.",
-			EnvVars: []string{"PLUGIN_SSH_PASSPHRASE", "PLUGIN_PASSPHRASE", "SSH_PASSPHRASE", "INPUT_PASSPHRASE"},
+			Name:  "ssh-passphrase",
+			Usage: "The purpose of the passphrase is usually to encrypt the private key.",
+			EnvVars: []string{
+				"PLUGIN_SSH_PASSPHRASE",
+				"PLUGIN_PASSPHRASE",
+				"SSH_PASSPHRASE",
+				"INPUT_PASSPHRASE",
+			},
 		},
 		&cli.StringFlag{
 			Name:    "key-path",
@@ -100,9 +105,13 @@ func main() {
 			EnvVars: []string{"PLUGIN_CIPHERS", "SSH_CIPHERS", "INPUT_CIPHERS"},
 		},
 		&cli.BoolFlag{
-			Name:    "useInsecureCipher",
-			Usage:   "include more ciphers with use_insecure_cipher",
-			EnvVars: []string{"PLUGIN_USE_INSECURE_CIPHER", "SSH_USE_INSECURE_CIPHER", "INPUT_USE_INSECURE_CIPHER"},
+			Name:  "useInsecureCipher",
+			Usage: "include more ciphers with use_insecure_cipher",
+			EnvVars: []string{
+				"PLUGIN_USE_INSECURE_CIPHER",
+				"SSH_USE_INSECURE_CIPHER",
+				"INPUT_USE_INSECURE_CIPHER",
+			},
 		},
 		&cli.StringFlag{
 			Name:    "fingerprint",
@@ -118,8 +127,12 @@ func main() {
 			Name:    "command.timeout",
 			Aliases: []string{"T"},
 			Usage:   "command timeout",
-			EnvVars: []string{"PLUGIN_COMMAND_TIMEOUT", "SSH_COMMAND_TIMEOUT", "INPUT_COMMAND_TIMEOUT"},
-			Value:   10 * time.Minute,
+			EnvVars: []string{
+				"PLUGIN_COMMAND_TIMEOUT",
+				"SSH_COMMAND_TIMEOUT",
+				"INPUT_COMMAND_TIMEOUT",
+			},
+			Value: 10 * time.Minute,
 		},
 		&cli.StringSliceFlag{
 			Name:    "script",
@@ -154,36 +167,63 @@ func main() {
 			Value:   "22",
 		},
 		&cli.StringFlag{
-			Name:    "proxy.protocol",
-			Usage:   "The IP protocol to use for the proxy. Valid values are \"tcp\". \"tcp4\" or \"tcp6\". Default to tcp.",
-			EnvVars: []string{"PLUGIN_PROXY_PROTOCOL", "SSH_PROXY_PROTOCOL", "INPUT_PROXY_PROTOCOL"},
-			Value:   "tcp",
+			Name:  "proxy.protocol",
+			Usage: "The IP protocol to use for the proxy. Valid values are \"tcp\". \"tcp4\" or \"tcp6\". Default to tcp.",
+			EnvVars: []string{
+				"PLUGIN_PROXY_PROTOCOL",
+				"SSH_PROXY_PROTOCOL",
+				"INPUT_PROXY_PROTOCOL",
+			},
+			Value: "tcp",
 		},
 		&cli.StringFlag{
-			Name:    "proxy.username",
-			Usage:   "connect as user of proxy",
-			EnvVars: []string{"PLUGIN_PROXY_USERNAME", "PLUGIN_PROXY_USER", "PROXY_SSH_USERNAME", "INPUT_PROXY_USERNAME"},
-			Value:   "root",
+			Name:  "proxy.username",
+			Usage: "connect as user of proxy",
+			EnvVars: []string{
+				"PLUGIN_PROXY_USERNAME",
+				"PLUGIN_PROXY_USER",
+				"PROXY_SSH_USERNAME",
+				"INPUT_PROXY_USERNAME",
+			},
+			Value: "root",
 		},
 		&cli.StringFlag{
-			Name:    "proxy.password",
-			Usage:   "user password of proxy",
-			EnvVars: []string{"PLUGIN_PROXY_PASSWORD", "PROXY_SSH_PASSWORD", "INPUT_PROXY_PASSWORD"},
+			Name:  "proxy.password",
+			Usage: "user password of proxy",
+			EnvVars: []string{
+				"PLUGIN_PROXY_PASSWORD",
+				"PROXY_SSH_PASSWORD",
+				"INPUT_PROXY_PASSWORD",
+			},
 		},
 		&cli.StringFlag{
-			Name:    "proxy.ssh-key",
-			Usage:   "private ssh key of proxy",
-			EnvVars: []string{"PLUGIN_PROXY_SSH_KEY", "PLUGIN_PROXY_KEY", "PROXY_SSH_KEY", "INPUT_PROXY_KEY"},
+			Name:  "proxy.ssh-key",
+			Usage: "private ssh key of proxy",
+			EnvVars: []string{
+				"PLUGIN_PROXY_SSH_KEY",
+				"PLUGIN_PROXY_KEY",
+				"PROXY_SSH_KEY",
+				"INPUT_PROXY_KEY",
+			},
 		},
 		&cli.StringFlag{
-			Name:    "proxy.ssh-passphrase",
-			Usage:   "The purpose of the passphrase is usually to encrypt the private key.",
-			EnvVars: []string{"PLUGIN_PROXY_SSH_PASSPHRASE", "PLUGIN_PROXY_PASSPHRASE", "PROXY_SSH_PASSPHRASE", "INPUT_PROXY_PASSPHRASE"},
+			Name:  "proxy.ssh-passphrase",
+			Usage: "The purpose of the passphrase is usually to encrypt the private key.",
+			EnvVars: []string{
+				"PLUGIN_PROXY_SSH_PASSPHRASE",
+				"PLUGIN_PROXY_PASSPHRASE",
+				"PROXY_SSH_PASSPHRASE",
+				"INPUT_PROXY_PASSPHRASE",
+			},
 		},
 		&cli.StringFlag{
-			Name:    "proxy.key-path",
-			Usage:   "ssh private key path of proxy",
-			EnvVars: []string{"PLUGIN_PROXY_KEY_PATH", "PROXY_SSH_KEY_PATH", "INPUT_PROXY_KEY_PATH"},
+			Name:  "proxy.key-path",
+			Usage: "ssh private key path of proxy",
+			EnvVars: []string{
+				"PLUGIN_PROXY_KEY_PATH",
+				"PROXY_SSH_KEY_PATH",
+				"INPUT_PROXY_KEY_PATH",
+			},
 		},
 		&cli.DurationFlag{
 			Name:    "proxy.timeout",
@@ -196,14 +236,23 @@ func main() {
 			EnvVars: []string{"PLUGIN_PROXY_CIPHERS", "PROXY_SSH_CIPHERS", "INPUT_PROXY_CIPHERS"},
 		},
 		&cli.BoolFlag{
-			Name:    "proxy.useInsecureCipher",
-			Usage:   "include more ciphers with use_insecure_cipher",
-			EnvVars: []string{"PLUGIN_PROXY_USE_INSECURE_CIPHER", "PROXY_SSH_USE_INSECURE_CIPHER", "INPUT_PROXY_USE_INSECURE_CIPHER"},
+			Name:  "proxy.useInsecureCipher",
+			Usage: "include more ciphers with use_insecure_cipher",
+			EnvVars: []string{
+				"PLUGIN_PROXY_USE_INSECURE_CIPHER",
+				"PROXY_SSH_USE_INSECURE_CIPHER",
+				"INPUT_PROXY_USE_INSECURE_CIPHER",
+			},
 		},
 		&cli.StringFlag{
-			Name:    "proxy.fingerprint",
-			Usage:   "fingerprint SHA256 of the host public key, default is to skip verification",
-			EnvVars: []string{"PLUGIN_PROXY_FINGERPRINT", "PROXY_SSH_FINGERPRINT", "PROXY_FINGERPRINT", "INPUT_PROXY_FINGERPRINT"},
+			Name:  "proxy.fingerprint",
+			Usage: "fingerprint SHA256 of the host public key, default is to skip verification",
+			EnvVars: []string{
+				"PLUGIN_PROXY_FINGERPRINT",
+				"PROXY_SSH_FINGERPRINT",
+				"PROXY_FINGERPRINT",
+				"INPUT_PROXY_FINGERPRINT",
+			},
 		},
 		&cli.StringSliceFlag{
 			Name:    "envs",
@@ -14,10 +14,12 @@ import (
 )

 var (
-	errMissingHost          = errors.New("Error: missing server host")
-	errMissingPasswordOrKey = errors.New("Error: can't connect without a private SSH key or password")
-	errCommandTimeOut       = errors.New("Error: command timeout")
-	envsFormat              = "export {NAME}={VALUE}"
+	errMissingHost          = errors.New("error: missing server host")
+	errMissingPasswordOrKey = errors.New(
+		"error: can't connect without a private SSH key or password",
+	)
+	errCommandTimeOut = errors.New("error: command timeout")
+	envsFormat        = "export {NAME}={VALUE}"
 )

 type (
@@ -55,7 +57,7 @@ type (
 )

 func escapeArg(arg string) string {
-	return "'" + strings.Replace(arg, "'", `'\''`, -1) + "'"
+	return "'" + strings.ReplaceAll(arg, "'", `'\''`) + "'"
 }

 func (p Plugin) hostPort(host string) (string, string) {
@@ -119,19 +121,26 @@ func (p Plugin) exec(host string, wg *sync.WaitGroup, errChannel chan error) {
 	for _, key := range p.Config.Envs {
 		key = strings.ToUpper(key)
 		if val, found := os.LookupEnv(key); found {
-			env = append(env, p.format(p.Config.EnvsFormat, "{NAME}", key, "{VALUE}", escapeArg(val)))
+			env = append(
+				env,
+				p.format(p.Config.EnvsFormat, "{NAME}", key, "{VALUE}", escapeArg(val)),
+			)
 		}
 	}

-	p.Config.Script = append(env, p.scriptCommands()...)
-
 	if p.Config.Debug && len(env) > 0 {
 		p.log(host, "======ENV======")
 		p.log(host, strings.Join(env, "\n"))
 		p.log(host, "======END======")
 	}

-	stdoutChan, stderrChan, doneChan, errChan, err := ssh.Stream(strings.Join(p.Config.Script, "\n"), p.Config.CommandTimeout)
+	env = append(env, p.scriptCommands()...)
+	p.Config.Script = env
+
+	stdoutChan, stderrChan, doneChan, errChan, err := ssh.Stream(
+		strings.Join(p.Config.Script, "\n"),
+		p.Config.CommandTimeout,
+	)
 	if err != nil {
 		errChannel <- err
 		return
@@ -172,17 +181,22 @@ func (p Plugin) format(format string, args ...string) string {
 	return r.Replace(format)
 }

-// log output to console
-func (p Plugin) log(host string, message ...interface{}) {
-	if p.Writer == nil {
-		p.Writer = os.Stdout
+func (p Plugin) getWriter() io.Writer {
+	if p.Writer != nil {
+		return p.Writer
 	}
+	return os.Stdout
+}
+
+// log output to console
+func (p Plugin) log(host string, message ...any) {
+	w := p.getWriter()
 	if count := len(p.Config.Host); count == 1 {
-		fmt.Fprintf(p.Writer, "%s", fmt.Sprintln(message...))
+		fmt.Fprintf(w, "%s", fmt.Sprintln(message...))
 		return
 	}

-	fmt.Fprintf(p.Writer, "%s: %s", host, fmt.Sprintln(message...))
+	fmt.Fprintf(w, "%s: %s", host, fmt.Sprintln(message...))
 }

 // Exec executes the plugin.
@@ -230,9 +244,10 @@ func (p Plugin) Exec() error {
 		}
 	}

-	fmt.Println("===============================================")
-	fmt.Println("✅ Successfully executed commands to all hosts.")
-	fmt.Println("===============================================")
+	w := p.getWriter()
+	fmt.Fprintln(w, "===============================================")
+	fmt.Fprintln(w, "✅ Successfully executed commands to all hosts.")
+	fmt.Fprintln(w, "===============================================")

 	return nil
 }
@@ -257,7 +272,10 @@ func (p Plugin) scriptCommands() []string {
 		}
 		commands = append(commands, cmd)
 		if p.Config.ScriptStop && cmd[(len(cmd)-1):] != "\\" {
-			commands = append(commands, "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;")
+			commands = append(
+				commands,
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+			)
 		}
 	}

@@ -2,6 +2,7 @@ package main

 import (
 	"bytes"
+	"context"
 	"io"
 	"os"
 	"reflect"
@@ -11,6 +12,9 @@ import (

 	"github.com/appleboy/easyssh-proxy"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/testcontainers/testcontainers-go"
+	"github.com/testcontainers/testcontainers-go/wait"
 	"golang.org/x/crypto/ssh"
 )

@@ -19,7 +23,7 @@ func TestMissingHostOrUser(t *testing.T) {

 	err := plugin.Exec()

-	assert.NotNil(t, err)
+	require.Error(t, err)
 	assert.Equal(t, errMissingHost, err)
 }

@@ -34,7 +38,7 @@ func TestMissingKeyOrPassword(t *testing.T) {

 	err := plugin.Exec()

-	assert.NotNil(t, err)
+	require.Error(t, err)
 	assert.Equal(t, errMissingPasswordOrKey, err)
 }

@@ -51,7 +55,7 @@ func TestIncorrectPassword(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func TestSSHScriptFromRawKey(t *testing.T) {
@@ -94,7 +98,7 @@ ib4KbP5ovZlrjL++akMQ7V2fHzuQIFWnCkDA5c2ZAqzlM+ZN+HRG7gWur7Bt4XH1
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSSHScriptFromKeyFile(t *testing.T) {
@@ -110,7 +114,7 @@ func TestSSHScriptFromKeyFile(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSSHIPv4Only(t *testing.T) {
@@ -127,7 +131,7 @@ func TestSSHIPv4Only(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSSHIPv6OnlyError(t *testing.T) {
@@ -144,23 +148,27 @@ func TestSSHIPv6OnlyError(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func TestStreamFromSSHCommand(t *testing.T) {
 	plugin := Plugin{
 		Config: Config{
-			Host:           []string{"localhost", "127.0.0.1"},
-			Username:       "drone-scp",
-			Port:           22,
-			KeyPath:        "./tests/.ssh/id_rsa",
-			Script:         []string{"whoami", "for i in {1..5}; do echo ${i}; sleep 1; done", "echo 'done'"},
+			Host:     []string{"localhost", "127.0.0.1"},
+			Username: "drone-scp",
+			Port:     22,
+			KeyPath:  "./tests/.ssh/id_rsa",
+			Script: []string{
+				"whoami",
+				"for i in {1..5}; do echo ${i}; sleep 1; done",
+				"echo 'done'",
+			},
 			CommandTimeout: 60 * time.Second,
 		},
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSSHScriptWithError(t *testing.T) {
@@ -177,7 +185,7 @@ func TestSSHScriptWithError(t *testing.T) {

 	err := plugin.Exec()
 	// Process exited with status 1
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func TestSSHCommandTimeOut(t *testing.T) {
@@ -193,7 +201,7 @@ func TestSSHCommandTimeOut(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func TestProxyCommand(t *testing.T) {
@@ -215,7 +223,7 @@ func TestProxyCommand(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSSHCommandError(t *testing.T) {
@@ -231,7 +239,7 @@ func TestSSHCommandError(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func TestSSHCommandExitCodeError(t *testing.T) {
@@ -253,11 +261,11 @@ func TestSSHCommandExitCodeError(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func TestSetENV(t *testing.T) {
-	os.Setenv("FOO", `'  1)  '`)
+	t.Setenv("FOO", `'  1)  '`)
 	plugin := Plugin{
 		Config: Config{
 			Host:           []string{"localhost"},
@@ -278,21 +286,28 @@ func TestSetENV(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSetExistingENV(t *testing.T) {
-	os.Setenv("FOO", "Value for foo")
-	os.Setenv("BAR", "")
+	t.Setenv("FOO", "Value for foo")
+	t.Setenv("BAR", "")
 	plugin := Plugin{
 		Config: Config{
-			Host:           []string{"localhost"},
-			Username:       "drone-scp",
-			Port:           22,
-			KeyPath:        "./tests/.ssh/id_rsa",
-			Envs:           []string{"foo", "bar", "baz"},
-			Debug:          true,
-			Script:         []string{"export FOO", "export BAR", "export BAZ", "env | grep -q '^FOO=Value for foo$'", "env | grep -q '^BAR=$'", "if env | grep -q BAZ; then false; else true; fi"},
+			Host:     []string{"localhost"},
+			Username: "drone-scp",
+			Port:     22,
+			KeyPath:  "./tests/.ssh/id_rsa",
+			Envs:     []string{"foo", "bar", "baz"},
+			Debug:    true,
+			Script: []string{
+				"export FOO",
+				"export BAR",
+				"export BAZ",
+				"env | grep -q '^FOO=Value for foo$'",
+				"env | grep -q '^BAR=$'",
+				"if env | grep -q BAZ; then false; else true; fi",
+			},
 			CommandTimeout: 1 * time.Second,
 			Proxy: easyssh.DefaultConfig{
 				Server:  "localhost",
@@ -304,24 +319,28 @@ func TestSetExistingENV(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func TestSyncMode(t *testing.T) {
 	plugin := Plugin{
 		Config: Config{
-			Host:           []string{"localhost", "127.0.0.1"},
-			Username:       "drone-scp",
-			Port:           22,
-			KeyPath:        "./tests/.ssh/id_rsa",
-			Script:         []string{"whoami", "for i in {1..3}; do echo ${i}; sleep 1; done", "echo 'done'"},
+			Host:     []string{"localhost", "127.0.0.1"},
+			Username: "drone-scp",
+			Port:     22,
+			KeyPath:  "./tests/.ssh/id_rsa",
+			Script: []string{
+				"whoami",
+				"for i in {1..3}; do echo ${i}; sleep 1; done",
+				"echo 'done'",
+			},
 			CommandTimeout: 60 * time.Second,
 			Sync:           true,
 		},
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	assert.NoError(t, err)
 }

 func Test_escapeArg(t *testing.T) {
@@ -376,6 +395,9 @@ func TestCommandOutput(t *testing.T) {
 			127.0.0.1: /home/drone-scp
 			127.0.0.1: drone-scp
 			127.0.0.1: Linux
+			===============================================
+			✅ Successfully executed commands to all hosts.
+			===============================================
 		`
 	)

@@ -398,7 +420,7 @@ func TestCommandOutput(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	require.NoError(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
@@ -421,7 +443,7 @@ func TestWrongFingerprint(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	assert.Error(t, err)
 }

 func getHostPublicKeyFile(keypath string) (ssh.PublicKey, error) {
@@ -445,11 +467,14 @@ func TestFingerprint(t *testing.T) {
 		buffer   bytes.Buffer
 		expected = `
 			drone-scp
+			===============================================
+			✅ Successfully executed commands to all hosts.
+			===============================================
 		`
 	)

 	hostKey, err := getHostPublicKeyFile("/etc/ssh/ssh_host_rsa_key.pub")
-	assert.NoError(t, err)
+	require.NoError(t, err)

 	plugin := Plugin{
 		Config: Config{
@@ -467,7 +492,7 @@ func TestFingerprint(t *testing.T) {
 	}

 	err = plugin.Exec()
-	assert.Nil(t, err)
+	require.NoError(t, err)
 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }

@@ -497,7 +522,7 @@ func TestScriptStopWithMultipleHostAndSyncMode(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	require.Error(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
@@ -527,7 +552,7 @@ func TestScriptStop(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	require.Error(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
@@ -557,7 +582,7 @@ func TestNoneScriptStop(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	require.Error(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
@@ -591,16 +616,19 @@ func TestEnvOutput(t *testing.T) {
 			[test']
 			[test"]
 			[test,!#;?.@$~'"]
+			===============================================
+			✅ Successfully executed commands to all hosts.
+			===============================================
 		`
 	)

-	os.Setenv("ENV_1", `test`)
-	os.Setenv("ENV_2", `test test`)
-	os.Setenv("ENV_3", `test `)
-	os.Setenv("ENV_4", `  test  test  `)
-	os.Setenv("ENV_5", `test'`)
-	os.Setenv("ENV_6", `test"`)
-	os.Setenv("ENV_7", `test,!#;?.@$~'"`)
+	t.Setenv("ENV_1", `test`)
+	t.Setenv("ENV_2", `test test`)
+	t.Setenv("ENV_3", `test `)
+	t.Setenv("ENV_4", `  test  test  `)
+	t.Setenv("ENV_5", `test'`)
+	t.Setenv("ENV_6", `test"`)
+	t.Setenv("ENV_7", `test,!#;?.@$~'"`)

 	plugin := Plugin{
 		Config: Config{
@@ -632,13 +660,14 @@ func TestEnvOutput(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	require.NoError(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }

 func unindent(text string) string {
-	return strings.TrimSpace(strings.Replace(text, "\t", "", -1))
+	text = strings.ReplaceAll(text, "\r\n", "\n")
+	return strings.TrimSpace(strings.ReplaceAll(text, "\t", ""))
 }

 func TestPlugin_scriptCommands(t *testing.T) {
@@ -668,7 +697,12 @@ func TestPlugin_scriptCommands(t *testing.T) {
 					ScriptStop: true,
 				},
 			},
-			want: []string{"mkdir a", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;", "mkdir b", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;"},
+			want: []string{
+				"mkdir a",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+				"mkdir b",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+			},
 		},
 		{
 			name: "normal testing 2",
@@ -678,7 +712,14 @@ func TestPlugin_scriptCommands(t *testing.T) {
 					ScriptStop: true,
 				},
 			},
-			want: []string{"mkdir a", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;", "mkdir c", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;", "mkdir b", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;"},
+			want: []string{
+				"mkdir a",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+				"mkdir c",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+				"mkdir b",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+			},
 		},
 		// See: https://github.com/appleboy/ssh-action/issues/75#issuecomment-668314271
 		{
@@ -689,7 +730,13 @@ func TestPlugin_scriptCommands(t *testing.T) {
 					ScriptStop: true,
 				},
 			},
-			want: []string{"ls \\", "-lah", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;", "mkdir a", "DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;"},
+			want: []string{
+				"ls \\",
+				"-lah",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+				"mkdir a",
+				"DRONE_SSH_PREV_COMMAND_EXIT_CODE=$? ; if [ $DRONE_SSH_PREV_COMMAND_EXIT_CODE -ne 0 ]; then exit $DRONE_SSH_PREV_COMMAND_EXIT_CODE; fi;",
+			},
 		},
 		{
 			name: "trim space",
@@ -741,7 +788,7 @@ func TestUseInsecureCipher(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.NotNil(t, err)
+	require.Error(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
@@ -821,49 +868,37 @@ func TestPlugin_hostPort(t *testing.T) {
 }

 func TestFindEnvs(t *testing.T) {
-	testEnvs := []string{
-		"INPUT_FOO",
-		"INPUT_BAR",
-		"NO_PREFIX",
-		"INPUT_FOOBAR",
-	}
-
-	origEnviron := os.Environ()
-	os.Clearenv()
-	for _, env := range testEnvs {
-		os.Setenv(env, "dummyValue")
-	}
-
-	defer func() {
-		os.Clearenv()
-		for _, env := range origEnviron {
-			pair := strings.SplitN(env, "=", 2)
-			os.Setenv(pair[0], pair[1])
-		}
-	}()
+	t.Setenv("DRONETEST_INPUT_FOO", "dummyValue")
+	t.Setenv("DRONETEST_INPUT_BAR", "dummyValue")
+	t.Setenv("DRONETEST_NO_PREFIX", "dummyValue")
+	t.Setenv("DRONETEST_INPUT_FOOBAR", "dummyValue")

 	t.Run("Find single prefix", func(t *testing.T) {
-		expected := []string{"INPUT_FOO", "INPUT_BAR", "INPUT_FOOBAR"}
-		result := findEnvs("INPUT_")
-		if !reflect.DeepEqual(result, expected) {
-			t.Errorf("Expected %v, but got %v", expected, result)
-		}
+		result := findEnvs("DRONETEST_INPUT_")
+		assert.ElementsMatch(
+			t,
+			[]string{"DRONETEST_INPUT_FOO", "DRONETEST_INPUT_BAR", "DRONETEST_INPUT_FOOBAR"},
+			result,
+		)
 	})

 	t.Run("Find multiple prefixes", func(t *testing.T) {
-		expected := []string{"INPUT_FOO", "INPUT_BAR", "NO_PREFIX", "INPUT_FOOBAR"}
-		result := findEnvs("INPUT_", "NO_PREFIX")
-		if !reflect.DeepEqual(result, expected) {
-			t.Errorf("Expected %v, but got %v", expected, result)
-		}
+		result := findEnvs("DRONETEST_INPUT_", "DRONETEST_NO_PREFIX")
+		assert.ElementsMatch(
+			t,
+			[]string{
+				"DRONETEST_INPUT_FOO",
+				"DRONETEST_INPUT_BAR",
+				"DRONETEST_NO_PREFIX",
+				"DRONETEST_INPUT_FOOBAR",
+			},
+			result,
+		)
 	})

 	t.Run("Find non-existing prefix", func(t *testing.T) {
-		expected := []string{}
-		result := findEnvs("NON_EXISTING_")
-		if !reflect.DeepEqual(result, expected) {
-			t.Errorf("Expected %v, but got %v", expected, result)
-		}
+		result := findEnvs("ZZZZNONEXISTING_")
+		assert.Empty(t, result)
 	})
 }

@@ -874,12 +909,15 @@ func TestAllEnvs(t *testing.T) {
 [foobar]
 [foobar]
 [foobar]
+===============================================
+✅ Successfully executed commands to all hosts.
+===============================================
 		`
 	)

-	os.Setenv("INPUT_1", `foobar`)
-	os.Setenv("GITHUB_2", `foobar`)
-	os.Setenv("PLUGIN_3", `foobar`)
+	t.Setenv("INPUT_1", `foobar`)
+	t.Setenv("GITHUB_2", `foobar`)
+	t.Setenv("PLUGIN_3", `foobar`)

 	plugin := Plugin{
 		Config: Config{
@@ -906,36 +944,132 @@ func TestAllEnvs(t *testing.T) {
 	}

 	err := plugin.Exec()
-	assert.Nil(t, err)
+	require.NoError(t, err)

 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }

-func TestSudoCommand(t *testing.T) {
-	var (
-		buffer   bytes.Buffer
-		expected = `
-			root
-		`
+type SSHTestConfig struct {
+	Env            map[string]string
+	AuthMethod     string // "key" or "password"
+	KeyPath        string
+	Password       string
+	Script         []string
+	Expected       string
+	SudoAccess     bool
+	InsecureCipher bool
+	RequireTty     bool
+	CommandTimeout time.Duration
+}
+
+func runSSHContainerTest(t *testing.T, cfg SSHTestConfig) {
+	t.Helper()
+	ctx := context.Background()
+
+	req := testcontainers.ContainerRequest{
+		Image:        "linuxserver/openssh-server:latest",
+		ExposedPorts: []string{"2222/tcp"},
+		Env:          cfg.Env,
+		WaitingFor:   wait.ForListeningPort("2222/tcp").WithStartupTimeout(180 * time.Second),
+	}
+
+	sshContainer, err := testcontainers.GenericContainer(
+		ctx,
+		testcontainers.GenericContainerRequest{
+			ContainerRequest: req,
+			Started:          true,
+		},
 	)
+	if err != nil {
+		t.Skipf(
+			"Could not start container with image %s: %v. Check Docker environment and image availability. Skipping test.",
+			req.Image,
+			err,
+		)
+	}
+	defer func() {
+		if err := sshContainer.Terminate(ctx); err != nil {
+			t.Logf("Could not terminate container: %v", err)
+		}
+	}()
+
+	host, err := sshContainer.Host(ctx)
+	if err != nil {
+		t.Fatalf("Could not get container host: %v", err)
+	}
+	port, err := sshContainer.MappedPort(ctx, "2222/tcp")
+	if err != nil {
+		t.Fatalf("Could not get container mapped port 2222/tcp: %v", err)
+	}
+
+	var buffer bytes.Buffer
+
+	pluginCfg := Config{
+		Host:              []string{host},
+		Username:          "testuser",
+		Port:              int(port.Num()),
+		Script:            cfg.Script,
+		CommandTimeout:    cfg.CommandTimeout,
+		UseInsecureCipher: cfg.InsecureCipher,
+		RequireTty:        cfg.RequireTty,
+	}
+	if pluginCfg.CommandTimeout == 0 {
+		pluginCfg.CommandTimeout = 10 * time.Second
+	}
+	switch cfg.AuthMethod {
+	case "key":
+		pluginCfg.KeyPath = cfg.KeyPath
+	case "password":
+		pluginCfg.Password = cfg.Password
+	}

 	plugin := Plugin{
-		Config: Config{
-			Host:     []string{"localhost"},
-			Username: "drone-scp",
-			Port:     22,
-			KeyPath:  "./tests/.ssh/id_rsa",
-			Script: []string{
-				`sudo su - -c "whoami"`,
-			},
-			CommandTimeout: 10 * time.Second,
-			RequireTty:     true,
-		},
+		Config: pluginCfg,
 		Writer: &buffer,
 	}

-	assert.Nil(t, plugin.Exec())
-	assert.Equal(t, unindent(expected), unindent(buffer.String()))
+	require.NoError(t, plugin.Exec())
+	assert.Equal(t, unindent(cfg.Expected), unindent(buffer.String()))
+}
+
+func TestSudoCommand(t *testing.T) {
+	pubKey, err := os.ReadFile("./tests/.ssh/id_rsa.pub")
+	if err != nil {
+		t.Fatalf("Could not read public key file: %v", err)
+	}
+	runSSHContainerTest(t, SSHTestConfig{
+		Env: map[string]string{
+			"USER_NAME":       "testuser",
+			"PASSWORD_ACCESS": "false",
+			"SUDO_ACCESS":     "true",
+			"PUBLIC_KEY":      string(pubKey),
+		},
+		AuthMethod:     "key",
+		KeyPath:        "./tests/.ssh/id_rsa",
+		Script:         []string{`sudo su - -c "whoami"`},
+		Expected:       "root\n===============================================\n✅ Successfully executed commands to all hosts.\n===============================================",
+		SudoAccess:     true,
+		InsecureCipher: true,
+		RequireTty:     true,
+		CommandTimeout: 10 * time.Second,
+	})
+}
+
+func TestSSHWithTestcontainers(t *testing.T) {
+	runSSHContainerTest(t, SSHTestConfig{
+		Env: map[string]string{
+			"USER_NAME":       "testuser",
+			"USER_PASSWORD":   "testpass",
+			"PASSWORD_ACCESS": "true",
+			"SUDO_ACCESS":     "false",
+		},
+		AuthMethod:     "password",
+		Password:       "testpass",
+		Script:         []string{"whoami"},
+		Expected:       "testuser\n===============================================\n✅ Successfully executed commands to all hosts.\n===============================================",
+		InsecureCipher: true,
+		CommandTimeout: 60 * time.Second,
+	})
 }

 func TestCommandWithIPv6(t *testing.T) {
@@ -943,6 +1077,9 @@ func TestCommandWithIPv6(t *testing.T) {
 		buffer   bytes.Buffer
 		expected = `
 			drone-scp
+			===============================================
+			✅ Successfully executed commands to all hosts.
+			===============================================
 		`
 	)

@@ -960,6 +1097,6 @@ func TestCommandWithIPv6(t *testing.T) {
 		},
 		Writer: &buffer,
 	}
-	assert.Nil(t, plugin.Exec())
+	require.NoError(t, plugin.Exec())
 	assert.Equal(t, unindent(expected), unindent(buffer.String()))
 }
Author	SHA1	Message	Date
Bo-Yi Wu	008d03ed09	chore: bump go directive to 1.25.10 - Update go.mod go directive from 1.25.9 to 1.25.10	2026-05-08 21:19:20 +08:00
Bo-Yi Wu	8ae378cba1	ci: bump golangci-lint to v2.12 - Upgrade golangci-lint version from v2.11 to v2.12	2026-05-08 20:13:40 +08:00
Bo-Yi Wu	bc57ffe8ae	ci(actions): bump trivy-action to v0.36.0 and codecov-action to v6	2026-04-25 16:51:03 +08:00
Bo-Yi Wu	16a892b3a7	ci(docker): fail push when trivy finds CRITICAL/HIGH issues	2026-04-16 23:01:13 +08:00
Bo-Yi Wu	8265cc3fb1	ci: pin golangci-lint to v2.11	2026-04-16 21:11:23 +08:00
Bo-Yi Wu	c0ae39b308	chore: bump go directive to 1.25.9	2026-04-16 20:58:02 +08:00
Bo-Yi Wu	ed85f7ef5e	ci(docker): add Trivy image scan before pushing Docker image - Add Trivy vulnerability scanner step before Docker image push - Upload SARIF results to GitHub Security tab	2026-04-16 18:10:07 +08:00
Bo-Yi Wu	5f79a61f89	fix: restore v1.8.2 debug ENV section behavior Move ENV debug logging before appending scriptCommands to env slice, so ======ENV====== only appears when Envs are configured and only contains export statements, matching v1.8.2 behavior. - revert TestCommandOutput: remove ENV section (no Envs configured) - revert TestEnvOutput: remove echo commands from ENV section	2026-04-16 17:04:53 +08:00
Bo-Yi Wu	8fdd1a1911	fix(test): normalize CRLF in unindent and update ENV section expected output - normalize \r\n to \n in unindent to handle TTY output from RequireTty tests - add script commands to ======ENV====== expected section in TestEnvOutput	2026-04-16 16:02:23 +08:00
Bo-Yi Wu	513c612eae	fix(test): update expected output for success summary footer across all tests - add success footer to TestFingerprint, TestEnvOutput, TestAllEnvs, TestCommandWithIPv6 - add success footer to TestSudoCommand and TestSSHWithTestcontainers container tests	2026-04-16 15:51:09 +08:00
Bo-Yi Wu	20f72fc53f	fix(test): update TestCommandOutput expected output for new debug and summary sections - add ======ENV====== section to expected output when Debug is true - add success summary footer to expected output	2026-04-16 13:08:25 +08:00
Bo-Yi Wu	faabdc094a	fix(test): replace deprecated port.Int() with int(port.Num()) - replace port.Int() with int(port.Num()) to match updated moby network.Port API	2026-04-16 12:19:32 +08:00
Bo-Yi Wu	3e1551c174	fix(deps): upgrade golang.org/x/crypto to fix CVE vulnerabilities - bump golang.org/x/crypto to v0.45.0 (fixes CVE-2024-45337 CRITICAL, CVE-2025-22869 HIGH, CVE-2025-47914 MEDIUM, CVE-2025-58181 MEDIUM) - bump golang.org/x/sys to v0.38.0	2026-04-16 12:13:16 +08:00
Bo-Yi Wu	a0516e06f2	ci(actions): upgrade GitHub Actions to latest versions - bump actions/checkout to v6 - bump actions/setup-go to v6 - bump actions/cache to v5 - bump goreleaser/goreleaser-action to v7 - bump golangci/golangci-lint-action to v9 - bump github/codeql-action/* to v4 - bump codecov/codecov-action to v5 - bump docker/build-push-action to v7 - bump docker/login-action to v4 - bump docker/metadata-action to v6 - bump docker/setup-buildx-action to v4 - bump docker/setup-qemu-action to v4 - bump hadolint/hadolint-action to v3.3.0 - bump aquasecurity/trivy-action to v0.35.0	2026-04-16 12:06:53 +08:00
Bo-Yi Wu	eb4331a438	chore: upgrade docker/docker and testcontainers-go for CVE-2024-41110 - Upgrade docker/docker from v28.0.1 to v28.5.2 to fix AuthZ bypass - Upgrade testcontainers-go from v0.36.0 to v0.41.0 - Update all transitive dependencies to latest compatible versions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 23:22:25 +08:00
Bo-Yi Wu	ec330bc0b9	chore: upgrade Go to 1.25 and update dependencies - Bump minimum Go version from 1.24 to 1.25 - Update CI test matrix to Go 1.25 and 1.26, drop 1.24 - Upgrade easyssh-proxy to v1.5.2, urfave/cli to v2.27.7 - Upgrade golang.org/x/crypto to v0.49.0 and other x/ packages Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 23:10:00 +08:00
Bo-Yi Wu	c20e983535	refactor: extract getWriter helper to deduplicate writer init - Add getWriter method to centralize writer-nil-check logic - Replace inline writer initialization in log and Exec methods Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 23:05:25 +08:00
Bo-Yi Wu	c7548576f0	fix: resolve all golangci-lint errors for stricter linter config - Replace interface{} with any and fix value receiver mutation in log method - Use fmt.Fprintln instead of forbidden fmt.Println in Exec output - Fix appendAssign by splitting append and assignment into two lines - Replace assert.Nil/NotNil with assert.NoError/Error for error checks - Upgrade error assertions to require when followed by dependent assertions - Replace os.Setenv with t.Setenv in all test functions - Restructure TestFindEnvs to use t.Setenv with unique prefixes Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-08 23:01:00 +08:00
appleboy	9d94a36c84	ci: remove Trivy vulnerability scanning from CI workflow - Remove Trivy vulnerability scanning and upload of scan results to GitHub Security tab from the workflow Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 22:10:49 +08:00
appleboy	f5af77d622	ci: correct platforms field indentation in Docker workflow - Fix indentation for the platforms field in the Docker workflow configuration Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 22:05:25 +08:00
appleboy	235847ea23	ci: update scan steps to use drone-ssh Docker image - Change docker image tag from repository name to drone-ssh for scan steps Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:58:35 +08:00
appleboy	a934a831d2	ci: improve CI environment and reporting for Go tests - Add gpg to the list of installed packages for testing - Specify Codecov upload flags based on Go version Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:50:25 +08:00
appleboy	732c7194bd	ci: add dynamic Go version selection for CI testing - Enable testing across Go 1.24 and 1.25 using a matrix strategy - Update the container image to dynamically use the selected Go version Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:47:08 +08:00
appleboy	8de6c4fd43	docs: add Trivy security scan badges to documentation - Add Trivy Security Scan badges to the documentation files Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:45:26 +08:00
appleboy	36b01aed49	style: improve code readability with consistent multi-line formatting - Add golines to the list of golangci-lint formatters - Format multi-line env variable declarations for CLI flags for consistency - Split string slice initializations onto multiple lines for improved readability in tests - Use multi-line function calls for better readability in plugin and test code - Improve readability of script command appends in logic and tests Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:44:27 +08:00
appleboy	7a94dda076	ci: integrate automated Trivy security scanning in CI workflows - Add explicit permissions for contents, packages, and security-events to the Docker GitHub Actions workflow - Integrate Trivy vulnerability scanning and results upload into the Docker workflow - Add a dedicated GitHub Actions workflow for Trivy security scanning of both repository files and Docker images, with scheduled, push, and pull request triggers - Ensure Trivy SARIF results are uploaded to the GitHub Security tab after scans Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:43:07 +08:00
appleboy	1cc99b6113	chore: update Go version and core dependencies to latest releases - Update Go version requirement from 1.23.0 to 1.24.0 - Upgrade golang.org/x/crypto dependency to v0.45.0 - Upgrade golang.org/x/sys dependency to v0.38.0 Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-11-28 21:39:55 +08:00
appleboy	4a649cfe45	refactor: refactor SSH authentication handling with switch statement - Refactor if-else logic to a switch statement for handling SSH authentication methods Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-27 09:46:02 +08:00
appleboy	1849c53ed5	test: refactor SSH integration tests with reusable config and helpers - Refactor SSH-related integration tests to use a reusable SSHTestConfig struct and a new runSSHContainerTest helper function - Support testing both key-based and password-based authentication by passing configuration via SSHTestConfig - Move duplicated test setup code for containerized SSH server to the helper function - Update assertions to check outputs against configurable expected values for each test - Add test for password-based authentication in addition to existing sudo command test Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-27 09:31:46 +08:00
appleboy	798fc4fa72	test: remove password authentication from test environment - Remove USER_PASSWORD from test environment setup - Update comment to correctly state that password authentication is disabled Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-27 09:25:49 +08:00
appleboy	0d02cbb190	refactor: migrate TestSudoCommand to key-based authentication - Disable password authentication by setting PASSWORD_ACCESS to false in TestSudoCommand - Remove the use of direct password authentication in favor of key-based authentication in TestSudoCommand Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-27 09:24:52 +08:00
appleboy	ff79cee470	test: enable insecure cipher suites for test compatibility - Enable insecure ciphers in test configuration for compatibility Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-27 09:10:09 +08:00
appleboy	412193b000	test: add dynamic OpenSSH server integration tests using Docker - Add a test that dynamically starts an OpenSSH server in a Docker container for integration testing. - Configure the container with test credentials, allow password and sudo access, and inject the public key. - Update the test to use the actual Docker container's hostname, dynamic port, username, and password. - Improve error handling and test skipping if the Docker environment is not available. Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-27 09:09:46 +08:00
appleboy	e899efd3c6	refactor: simplify test setup and improve SSH compatibility - Remove unused import of strconv - Remove environment variables PUID and PGID from the test container setup - Enable UseInsecureCipher in SSH options for compatibility Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-26 23:17:37 +08:00
appleboy	3fd8cd5cc0	chore: upgrade core dependencies to latest supported versions - Update several dependencies to newer versions, including urfave/cli, x/crypto, ScaleFT/sshkeys, go-md2man, and x/sys Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-26 23:10:13 +08:00
appleboy	1dfeaffef3	docs: add Table of Contents to all language README files - Add a Table of Contents section to the English, Simplified Chinese, and Traditional Chinese README files Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-26 22:00:28 +08:00
appleboy	734d4df2c8	docs: refine and unify documentation wording and formatting - Improve and clarify English wording and formatting throughout the documentation for better readability - Update section titles and add missing punctuation for consistency - Revise build instructions and descriptions for accuracy and clarity - Enhance phrasing in Chinese (Simplified and Traditional) documentation for clarity and consistency - Remove outdated explanatory comments and improve example references in all README files Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-26 21:58:19 +08:00
appleboy	6b748335c1	docs: localize README with Simplified and Traditional Chinese translations - Add links to Traditional and Simplified Chinese README files, and label English as the default language - Fix formatting for the list of supported platforms in the main README - Add a Simplified Chinese version of the README with equivalent content and instructions - Add a Traditional Chinese version of the README with equivalent content and instructions Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-26 21:51:44 +08:00
appleboy	15f08d99ca	test: adjust configuration parameters for system integrations - Change `SUDO_ACCESS` value from `true` to `false` in SSH with Testcontainers test Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-12 23:02:59 +08:00
Bo-Yi Wu	13ee47326a	chore: enhance testing with updated libraries and new test cases (#288 ) * chore: enhance testing with updated libraries and new test cases - Update `testify` library from `v1.8.4` to `v1.10.0` - Add dependency for `testcontainers-go` library - Add various indirect dependencies - Include `context` and `fmt` packages in test file - Add test for SSH connection using `testcontainers` library Signed-off-by: appleboy <appleboy.tw@gmail.com> * refactor: improve performance by optimizing string conversions - Add the `strconv` import. - Replace `fmt.Sprintf` with `strconv.Itoa` for converting UID and GID to string. Signed-off-by: appleboy <appleboy.tw@gmail.com> * test: switch to alternative image source for SSH testing - Update image name in the SSH test from `lscr.io/linuxserver/openssh-server:latest` to `linuxserver/openssh-server:latest`. Signed-off-by: appleboy <appleboy.tw@gmail.com> --------- Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-12 22:21:42 +08:00
appleboy	b16a10d30e	build: improve efficiency and release process with optimizations - Add `.dockerignore` file to exclude all files except those in the `release/` directory Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-11 23:43:50 +08:00
appleboy	7df1147156	build: optimize and upgrade dependencies for improved performance - Update the base image in Dockerfile from alpine:3.20 to alpine:3.21 Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-04-11 23:43:22 +08:00
appleboy	0ec46c4fd2	chore: update and streamline linting configuration and error formatting - Update `.golangci.yaml` to version 2 and streamline settings - Remove specific linters from `.golangci.yaml` configuration - Add exclusion and formatter settings to `.golangci.yaml` - Change error message formatting in `plugin.go` to lowercase - Use `strings.ReplaceAll` instead of `strings.Replace` for better readability and performance in `plugin.go` and `plugin_test.go` Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-03-29 09:39:55 +08:00
appleboy	07c75984e5	ci: update GitHub actions and improve project configurations - Update golangci-lint action to version 7 - Update codecov action to version 5 Signed-off-by: appleboy <appleboy.tw@gmail.com>	2025-03-29 09:35:49 +08:00