fix(ci): re-wrap PEM payload to 64 chars with explicit trailing newline

.gitea/workflows/ci-prod.yml

@@ -131,7 +131,6 @@ jobs:
           RAW_KEY="${PROD_DB_SSH_KEY:-${SSH_KEY_PATH_SECRET:-${SSH_KEY_SECRET}}}"
 
           if [ -n "${RAW_KEY}" ] && [ -f "${RAW_KEY}" ]; then
-            echo "RAW_KEY is a readable file path on host, reading content..."
             RAW_KEY=$(cat "${RAW_KEY}")
           fi
 
@@ -161,28 +160,20 @@ jobs:
             -e KEY_B64="${KEY_B64}" \
             alpine:latest sh -c '
               apk add --no-cache openssh-client rsync coreutils && \
-              (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/working_key && \
+              (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \
+              HEADER=$(grep "BEGIN" /tmp/raw_key) && \
+              FOOTER=$(grep "END" /tmp/raw_key) && \
+              BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \
+              printf "%s\n" "$HEADER" > /tmp/working_key && \
+              printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \
+              printf "%s\n" "$FOOTER" >> /tmp/working_key && \
+              echo "" >> /tmp/working_key && \
               chmod 600 /tmp/working_key && \
               echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
               echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
               echo "Destination Directory: ${DEST_DIR}" && \
               echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \
-              HEADER=$(head -n 1 /tmp/working_key) && \
-              echo "Key File First Line: $HEADER" && \
-              case "$HEADER" in \
-                *"BEGIN"*) \
-                  echo "--> Key header format is VALID" ;; \
-                *) \
-                  echo "=========================================================================" && \
-                  echo "ERREUR CONFIGURATION SECRET GITEA :" && \
-                  echo "Le secret PROD_DB_SSH_KEY ne contient pas le texte d une clé SSH !" && \
-                  echo "Valeur actuelle reçue dans le secret : $HEADER" && \
-                  echo "CONSEIL : Dans Gitea > Paramètres > Secrets > PROD_DB_SSH_KEY, tu dois coller" && \
-                  echo "le CONTENU TEXTUEL complet de la clé (ex: cat /root/.ssh/gitea_ci_key)" && \
-                  echo "et NON PAS un chemin comme /root/.ssh/..." && \
-                  echo "=========================================================================" && \
-                  exit 1 ;; \
-              esac && \
+              echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \
               echo "=== 🔑 KEY FINGERPRINT ===" && \
               ssh-keygen -l -f /tmp/working_key && \
               SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \