From 1231947e2b992038eaf4405a13095a690d01e0b9 Mon Sep 17 00:00:00 2001
From: Youssef <youssef.kaouachi@gmail.com>
Date: Thu, 3 Sep 2026 15:26:22 +0200
Subject: [PATCH] fix(ci): write secret key to runner file before docker run to
 preserve multi-line format

---
 .gitea/workflows/ci-prod.yml | 39 +++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml
index e259fc3..c1a8785 100644
--- a/.gitea/workflows/ci-prod.yml
+++ b/.gitea/workflows/ci-prod.yml
@@ -128,39 +128,46 @@ jobs:
           TARGET_USER="${DB_SERVER_USER:-root}"
           PORT="${REMOTE_PORT:-22}"
           DEST_DIR="/opt/as-talange"
-          KEY_CONTENT="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
+          RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
+
+          rm -f /tmp/gitea_runner_key
+          if [ -n "${RAW_KEY}" ]; then
+            printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key
+          elif [ -f /root/.ssh/gitea_ci_key ]; then
+            cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key
+          elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
+            cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key
+          fi
+
+          if [ ! -s /tmp/gitea_runner_key ]; then
+            echo "ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!"
+            exit 1
+          fi
+          chmod 600 /tmp/gitea_runner_key
 
           docker run --rm --net=host \
             -v "$(pwd):/workspace" -w /workspace \
+            -v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \
             -e TARGET_HOST="${TARGET_HOST}" \
             -e TARGET_USER="${TARGET_USER}" \
             -e PORT="${PORT}" \
             -e DEST_DIR="${DEST_DIR}" \
-            -e KEY_CONTENT="${KEY_CONTENT}" \
             alpine:latest sh -c '
               apk add --no-cache openssh-client rsync && \
               echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
               echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
               echo "Destination Directory: ${DEST_DIR}" && \
-              if [ -n "$KEY_CONTENT" ]; then \
-                echo "--> USING SSH KEY FROM GITEA SECRET" && \
-                printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \
-              elif [ -f /root/.ssh/gitea_ci_key ]; then \
-                echo "--> USING SSH KEY FROM FILE: /root/.ssh/gitea_ci_key" && \
-                cp /root/.ssh/gitea_ci_key /tmp/id_rsa ; \
-              else \
-                echo "--> ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" && exit 1 ; \
-              fi && \
-              chmod 600 /tmp/id_rsa && \
+              cp /tmp/id_rsa /tmp/working_key && \
+              chmod 600 /tmp/working_key && \
               echo "=== 🔑 KEY FINGERPRINT ===" && \
-              ssh-keygen -l -f /tmp/id_rsa && \
-              SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
+              ssh-keygen -l -f /tmp/working_key && \
+              SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
               echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
               echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \
-              rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
+              rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
               echo "=== 📦 RSYNC TRANSFER ENV ===" && \
-              rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
+              rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
               echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
             '