ucef/as-talange
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): pass SSH key as base64 environment variable to completely eliminate volume mount issues

Browse Source
This commit is contained in:
ucef
2026-09-03 15:47:40 +02:00
parent a4186ab4d3
commit ab63a8a913
1 changed files with 11 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci-prod.yml
+11 -13
View File
@@ -130,38 +130,36 @@ jobs:
DEST_DIR="/opt/as-talange" DEST_DIR="/opt/as-talange"
RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}" RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
rm -rf /tmp/gitea_runner_key if [ -z "${RAW_KEY}" ] && [ -f /root/.ssh/gitea_ci_key ]; then
if [ -n "${RAW_KEY}" ]; then RAW_KEY=$(cat /root/.ssh/gitea_ci_key)
printf "%s\n" "${RAW_KEY}" | tr -d '\r' | sed 's/\\n/\n/g' > /tmp/gitea_runner_key elif [ -z "${RAW_KEY}" ] && [ -f /home/ucef/.ssh/gitea_ci_key ]; then
elif [ -f /root/.ssh/gitea_ci_key ]; then RAW_KEY=$(cat /home/ucef/.ssh/gitea_ci_key)
cp /root/.ssh/gitea_ci_key /tmp/gitea_runner_key
elif [ -f /home/ucef/.ssh/gitea_ci_key ]; then
cp /home/ucef/.ssh/gitea_ci_key /tmp/gitea_runner_key
fi fi
if [ ! -f /tmp/gitea_runner_key ] || [ ! -s /tmp/gitea_runner_key ]; then if [ -z "${RAW_KEY}" ]; then
echo "=========================================================================" echo "========================================================================="
echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable dans Gitea !" echo "ERREUR : Le secret PROD_DB_SSH_KEY est vide ou introuvable dans Gitea !"
echo "Veuillez ajouter la clé privée dans Gitea > Dépôt > Paramètres > Secrets > PROD_DB_SSH_KEY" echo "Veuillez ajouter la clé privée dans Gitea > Dépôt > Paramètres > Secrets > PROD_DB_SSH_KEY"
echo "=========================================================================" echo "========================================================================="
exit 1 exit 1
fi fi
chmod 600 /tmp/gitea_runner_key
KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n')
docker run --rm --net=host \ docker run --rm --net=host \
-v "$(pwd):/workspace" -w /workspace \ -v "$(pwd):/workspace" -w /workspace \
-v "/tmp/gitea_runner_key:/tmp/id_rsa:ro" \
-e TARGET_HOST="${TARGET_HOST}" \ -e TARGET_HOST="${TARGET_HOST}" \
-e TARGET_USER="${TARGET_USER}" \ -e TARGET_USER="${TARGET_USER}" \
-e PORT="${PORT}" \ -e PORT="${PORT}" \
-e DEST_DIR="${DEST_DIR}" \ -e DEST_DIR="${DEST_DIR}" \
-e KEY_B64="${KEY_B64}" \
alpine:latest sh -c ' alpine:latest sh -c '
apk add --no-cache openssh-client rsync && \ apk add --no-cache openssh-client rsync coreutils && \
echo "$KEY_B64" | base64 -d > /tmp/working_key && \
chmod 600 /tmp/working_key && \
echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \ echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \ echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
echo "Destination Directory: ${DEST_DIR}" && \ echo "Destination Directory: ${DEST_DIR}" && \
cp /tmp/id_rsa /tmp/working_key && \
chmod 600 /tmp/working_key && \
echo "=== 🔑 KEY FINGERPRINT ===" && \ echo "=== 🔑 KEY FINGERPRINT ===" && \
ssh-keygen -l -f /tmp/working_key && \ ssh-keygen -l -f /tmp/working_key && \
SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \ SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \