From 5e7e5c461c7e83b618f0311f2b7a502b9f2f3599 Mon Sep 17 00:00:00 2001
From: Youssef <youssef.kaouachi@gmail.com>
Date: Thu, 3 Sep 2026 15:11:16 +0200
Subject: [PATCH] security: replace key header log with safe public ssh-keygen
 fingerprint display

---
 .gitea/workflows/ci-prod.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml
index 423197e..2d671bc 100644
--- a/.gitea/workflows/ci-prod.yml
+++ b/.gitea/workflows/ci-prod.yml
@@ -164,9 +164,9 @@ jobs:
                 echo "--> ERROR: No SSH key found!" && exit 1 ; \
               fi && \
               chmod 600 /tmp/id_rsa && \
-              echo "=== KEY FILE DETAILS ===" && \
+              echo "=== KEY FINGERPRINT ===" && \
               ls -la /tmp/id_rsa && \
-              head -n 2 /tmp/id_rsa && \
+              ssh-keygen -l -f /tmp/id_rsa && \
               SSH_CMD="ssh -vv -p ${PORT} -i /tmp/id_rsa -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
               echo "=== EXECUTING REMOTE COMMAND ===" && \
               $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \