ucef/as-talange
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): use PROD_DB_SSH_KEY Gitea secret for reliable cross-runner authentication
AS Talange CI/CD Pipeline - Production / Build & Run Unit Tests (push) Successful in 2m1s
Details
AS Talange CI/CD Pipeline - Production / Deploy to Prod Environment (push) Failing after 1m13s
Details

Browse Source
This commit is contained in:
ucef
2026-09-03 15:19:28 +02:00
parent 5e7e5c461c
commit 494fcfbf8a
1 changed files with 11 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci-prod.yml
+11 -24
View File
@@ -132,9 +132,6 @@ jobs:
docker run --rm --net=host \
-v "$(pwd):/workspace" -w /workspace \
-v "/home/ucef/.ssh:/home/ucef/.ssh:ro" \
-v "/home/ubuntu/.ssh:/home/ubuntu/.ssh:ro" \
-v "/root/.ssh:/root/.ssh:ro" \
-e TARGET_HOST="${TARGET_HOST}" \
-e TARGET_USER="${TARGET_USER}" \
-e PORT="${PORT}" \
@@ -142,37 +139,27 @@ jobs:
-e KEY_CONTENT="${KEY_CONTENT}" \
alpine:latest sh -c '
apk add --no-cache openssh-client rsync && \
echo "=== DIAGNOSTIC DETAILS ===" && \
echo "Container User: $(whoami) (UID: $(id -u))" && \
echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
echo "Destination Directory: ${DEST_DIR}" && \
echo "=== CHECKING ACCESSIBLE SSH DIRECTORIES ===" && \
echo "[/root/.ssh/]:" && (ls -la /root/.ssh/ 2>/dev/null || echo "Not accessible") && \
echo "[/home/ucef/.ssh/]:" && (ls -la /home/ucef/.ssh/ 2>/dev/null || echo "Not accessible") && \
echo "[/home/ubuntu/.ssh/]:" && (ls -la /home/ubuntu/.ssh/ 2>/dev/null || echo "Not accessible") && \
FOUND_KEY="" && \
for k in /home/ucef/.ssh/gitea_ci_key /home/ubuntu/.ssh/gitea_ci_key /root/.ssh/gitea_ci_key /home/ucef/.ssh/id_ed25519 /home/ubuntu/.ssh/id_ed25519 /root/.ssh/id_ed25519 /home/ucef/.ssh/id_rsa /home/ubuntu/.ssh/id_rsa /root/.ssh/id_rsa; do \
if [ -f "$k" ]; then FOUND_KEY="$k"; break; fi ; \
done && \
if [ -n "$FOUND_KEY" ]; then \
echo "--> SELECTED KEY FILE: $FOUND_KEY" && \
cp "$FOUND_KEY" /tmp/id_rsa ; \
elif [ -n "$KEY_CONTENT" ]; then \
echo "--> SELECTED KEY FROM: Gitea secret" && \
if [ -n "$KEY_CONTENT" ]; then \
echo "--> USING SSH KEY FROM GITEA SECRET" && \
printf "%s\n" "$KEY_CONTENT" | tr -d "\r" > /tmp/id_rsa ; \
elif [ -f /root/.ssh/gitea_ci_key ]; then \
echo "--> USING SSH KEY FROM FILE: /root/.ssh/gitea_ci_key" && \
cp /root/.ssh/gitea_ci_key /tmp/id_rsa ; \
else \
echo "--> ERROR: No SSH key found!" && exit 1 ; \
echo "--> ERROR: Secret PROD_DB_SSH_KEY is empty or not defined in Gitea!" && exit 1 ; \
fi && \
chmod 600 /tmp/id_rsa && \
echo "=== KEY FINGERPRINT ===" && \
ls -la /tmp/id_rsa && \
echo "=== 🔑 KEY FINGERPRINT ===" && \
ssh-keygen -l -f /tmp/id_rsa && \
SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
echo "=== EXECUTING REMOTE COMMAND ===" && \
echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
echo "=== RSYNC TRANSFER SCRIPT ===" && \
echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \
rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" && \
echo "=== RSYNC TRANSFER ENV ===" && \
echo "=== 📦 RSYNC TRANSFER ENV ===" && \
rsync -avz -e "ssh -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
$SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"