This commit is contained in:
@@ -29,6 +29,8 @@ jobs:
|
|||||||
KEEP_N: "5"
|
KEEP_N: "5"
|
||||||
HEALTH_URL: https://stellaamor.com/
|
HEALTH_URL: https://stellaamor.com/
|
||||||
SERVICE_RELOAD: "systemctl reload apache2 || true"
|
SERVICE_RELOAD: "systemctl reload apache2 || true"
|
||||||
|
SSH_KEY_PATH: /home/gitea-runner/.ssh/id_ed25519
|
||||||
|
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout (pure git)
|
- name: Checkout (pure git)
|
||||||
@@ -38,39 +40,6 @@ jobs:
|
|||||||
git fetch --depth=1 origin "$GITHUB_SHA"
|
git fetch --depth=1 origin "$GITHUB_SHA"
|
||||||
git checkout -q "$GITHUB_SHA"
|
git checkout -q "$GITHUB_SHA"
|
||||||
|
|
||||||
- name: Prepare isolated SSH dir
|
|
||||||
run: |
|
|
||||||
set -e
|
|
||||||
SSH_DIR="$(mktemp -d)"
|
|
||||||
echo "SSH_DIR=$SSH_DIR" >> $GITHUB_ENV
|
|
||||||
echo "SSH_KEY_PATH=$SSH_DIR/key" >> $GITHUB_ENV
|
|
||||||
install -m 700 -d "$SSH_DIR"
|
|
||||||
|
|
||||||
- name: Write SSH key
|
|
||||||
env:
|
|
||||||
SSH_KEY_STELLAAMOR: ${{ secrets.SSH_KEY_STELLAAMOR }}
|
|
||||||
run: |
|
|
||||||
set -e
|
|
||||||
umask 177
|
|
||||||
printf '%s' "$SSH_KEY_STELLAAMOR" > "$SSH_KEY_PATH"
|
|
||||||
chmod 600 "$SSH_KEY_PATH"
|
|
||||||
|
|
||||||
- name: Validate private key & show fingerprint
|
|
||||||
run: |
|
|
||||||
set -euo pipefail
|
|
||||||
ls -l ~/.ssh
|
|
||||||
# Check permissions
|
|
||||||
test -f ~/.ssh/deploy_stellaamor && chmod 600 ~/.ssh/deploy_stellaamor
|
|
||||||
# Fail if the key is passphrase-protected (ssh-keygen -y would prompt/fail)
|
|
||||||
if ! PUB=$(ssh-keygen -y -f ~/.ssh/deploy_stellaamor 2>/dev/null); then
|
|
||||||
echo "❌ The private key appears to be passphrase-protected or invalid."
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
echo "$PUB" > ~/.ssh/deploy_stellaamor.pub
|
|
||||||
ssh-keygen -lf ~/.ssh/deploy_stellaamor.pub
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
- name: SSH smoke test
|
- name: SSH smoke test
|
||||||
run: ssh $SSH_OPTS -i "$SSH_KEY_PATH" ${SSH_USER}@${SSH_HOST} true
|
run: ssh $SSH_OPTS -i "$SSH_KEY_PATH" ${SSH_USER}@${SSH_HOST} true
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user