From a991fd9f350102ee8ecfcafc97f9624f6f7d0a6f Mon Sep 17 00:00:00 2001
From: Youssef <youssef.kaouachi@gmail.com>
Date: Thu, 3 Sep 2026 15:47:40 +0200
Subject: [PATCH] fix(ci): pass SSH key as base64 environment variable to
 completely eliminate volume mount issues

---
 .gitea/workflows/ci-prod.yml | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml
index 557a69d..d77f7c1 100644
--- a/.gitea/workflows/ci-prod.yml
+++ b/.gitea/workflows/ci-prod.yml
@@ -130,38 +130,36 @@ jobs:
           DEST_DIR="/opt/as-talange"
           RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
 
-          rm -rf /tmp/gitea_runner_key
-          if [ -n "${RAW_KEY}" ]; then
-            printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key
-          elif [ -f /root/.ssh/gitea_ci_key ]; then
-            cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key
-          elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
-            cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key
+          if [ -z "${RAW_KEY}" ] && [ -f /root/.ssh/gitea_ci_key ]; then
+            RAW_KEY=$(cat /root/.ssh/gitea_ci_key)
+          elif [ -z "${RAW_KEY}" ] && [ -f /home/ucef/.ssh/gitea_ci_key ]; then
+            RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key)
           fi
 
-          if [ ! -f /tmp/gitea_runner_key ] || [ ! -s /tmp/gitea_runner_key ]; then
+          if [ -z "${RAW_KEY}" ]; then
             echo "========================================================================="
             echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable dans Gitea !"
             echo "Veuillez ajouter la clé privée dans Gitea > Dépôt > Paramètres > Secrets > PROD_DB_SSH_KEY"
             echo "========================================================================="
             exit 1
           fi
-          chmod 600 /tmp/gitea_runner_key
+
+          KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n')
 
           docker run --rm --net=host \
             -v "$(pwd):/workspace" -w /workspace \
-            -v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \
             -e TARGET_HOST="${TARGET_HOST}" \
             -e TARGET_USER="${TARGET_USER}" \
             -e PORT="${PORT}" \
             -e DEST_DIR="${DEST_DIR}" \
+            -e KEY_B64="${KEY_B64}" \
             alpine:latest sh -c '
-              apk add --no-cache openssh-client rsync && \
+              apk add --no-cache openssh-client rsync coreutils && \
+              echo "$KEY_B64" | base64 -d > /tmp/working_key && \
+              chmod 600 /tmp/working_key && \
               echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
               echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
               echo "Destination Directory: ${DEST_DIR}" && \
-              cp /tmp/id_rsa /tmp/working_key && \
-              chmod 600 /tmp/working_key && \
               echo "=== 🔑 KEY FINGERPRINT ===" && \
               ssh-keygen -l -f /tmp/working_key && \
               SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \