From 494fcfbf8a4f83ba662eac928e4ec893e01fcdce Mon Sep 17 00:00:00 2001
From: Youssef <youssef.kaouachi@gmail.com>
Date: Thu, 3 Sep 2026 15:19:28 +0200
Subject: [PATCH] fix(ci): use PROD_DB_SSH_KEY Gitea secret for reliable
 cross-runner authentication

---
 .gitea/workflows/ci-prod.yml | 35 +++++++++++------------------------
 1 file changed, 11 insertions(+), 24 deletions(-)

diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml
index 2d671bc..e259fc3 100644
--- a/.gitea/workflows/ci-prod.yml
+++ b/.gitea/workflows/ci-prod.yml
@@ -132,9 +132,6 @@ jobs:
 
           docker run --rm --net=host \
             -v "$(pwd):/workspace" -w /workspace \
-            -v "/home/ucef/.ssh:/home/ucef/.ssh:ro" \
-            -v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \
-            -v "/root/.ssh:/root/.ssh:ro" \
             -e TARGET_HOST="${TARGET_HOST}" \
             -e TARGET_USER="${TARGET_USER}" \
             -e PORT="${PORT}" \
@@ -142,37 +139,27 @@ jobs:
             -e KEY_CONTENT="${KEY_CONTENT}" \
             alpine:latest sh -c '
               apk add --no-cache openssh-client rsync && \
-              echo "=== DIAGNOSTIC DETAILS ===" && \
-              echo "Container User: $(whoami) (UID: $(id -u))" && \
+              echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
               echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
               echo "Destination Directory: ${DEST_DIR}" && \
-              echo "=== CHECKING ACCESSIBLE SSH DIRECTORIES ===" && \
-              echo "[/root/.ssh/]:" && (ls -la /root/.ssh/ 2>/dev/null || echo "Not accessible") && \
-              echo "[/home/ucef/.ssh/]:" && (ls -la /home/ucef/.ssh/ 2>/dev/null || echo "Not accessible") && \
-              echo "[/home/ubuntu/.ssh/]:" && (ls -la /home/ubuntu/.ssh/ 2>/dev/null || echo "Not accessible") && \
-              FOUND_KEY="" && \
-              for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \
-                if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \
-              done && \
-              if [ -n "$FOUND_KEY" ]; then \
-                echo "--> SELECTED KEY FILE: $FOUND_KEY" && \
-                cp "$FOUND_KEY" /tmp/id_rsa ; \
-              elif [ -n "$KEY_CONTENT" ]; then \
-                echo "--> SELECTED KEY FROM: Gitea secret" && \
+              if [ -n "$KEY_CONTENT" ]; then \
+                echo "--> USING SSH KEY FROM GITEA SECRET" && \
                 printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \
+              elif [ -f /root/.ssh/gitea_ci_key ]; then \
+                echo "--> USING SSH KEY FROM FILE: /root/.ssh/gitea_ci_key" && \
+                cp /root/.ssh/gitea_ci_key /tmp/id_rsa ; \
               else \
-                echo "--> ERROR: No SSH key found!" && exit 1 ; \
+                echo "--> ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" && exit 1 ; \
               fi && \
               chmod 600 /tmp/id_rsa && \
-              echo "=== KEY FINGERPRINT ===" && \
-              ls -la /tmp/id_rsa && \
+              echo "=== 🔑 KEY FINGERPRINT ===" && \
               ssh-keygen -l -f /tmp/id_rsa && \
               SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
-              echo "=== EXECUTING REMOTE COMMAND ===" && \
+              echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
-              echo "=== RSYNC TRANSFER SCRIPT ===" && \
+              echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \
               rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
-              echo "=== RSYNC TRANSFER ENV ===" && \
+              echo "=== 📦 RSYNC TRANSFER ENV ===" && \
               rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
               echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"