MythEclipse/pr-agent-server
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(ci): robust SSH key handling (base64/raw) + validation
Build & Deploy (Nix) / build-and-deploy (push) Successful in 2m24s

Browse Source
This commit is contained in:
MythEclipse
2026-07-31 09:58:37 +07:00
parent 09ed866525
commit 7ae7b6662d
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/nix-deploy.yml
+7 -1
View File
@@ -44,9 +44,15 @@ jobs:
PROFILE="/nix/var/nix/profiles/pr-agent-server" PROFILE="/nix/var/nix/profiles/pr-agent-server"
key_file=$(mktemp /tmp/deploy-key.XXXXXX) key_file=$(mktemp /tmp/deploy-key.XXXXXX)
printf '%s\n' "$VPS_SSH_KEY" > "$key_file" # VPS_SSH_KEY may be stored base64-encoded (multiline corruption workaround)
if printf '%s' "$VPS_SSH_KEY" | base64 -d 2>/dev/null | head -c 6 | grep -q "BEGIN"; then
printf '%s' "$VPS_SSH_KEY" | base64 -d > "$key_file"
else
printf '%s\n' "$VPS_SSH_KEY" > "$key_file"
fi
chmod 600 "$key_file" chmod 600 "$key_file"
sed -i 's/\r$//' "$key_file" # strip DOS line endings if any sed -i 's/\r$//' "$key_file" # strip DOS line endings if any
ssh-keygen -y -f "$key_file" >/dev/null 2>&1 || { echo "SSH key invalid"; exit 1; }
export NIX_SSHOPTS="-i $key_file -o StrictHostKeyChecking=no" export NIX_SSHOPTS="-i $key_file -o StrictHostKeyChecking=no"
nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "$STORE_PATH" 2>&1 nix copy --to "ssh://${VPS_USER}@${VPS_HOST}" "$STORE_PATH" 2>&1