From d987b9e46cb55e7de35963eb78eacee8c62b2836 Mon Sep 17 00:00:00 2001
From: Youssef <youssef.kaouachi@gmail.com>
Date: Fri, 4 Sep 2026 08:03:23 +0200
Subject: [PATCH] fix(ci): execute deployment directly in runner step
 environment without nested container

---
 .gitea/workflows/ci-prod.yml | 82 ++++++++++++++++++------------------
 1 file changed, 40 insertions(+), 42 deletions(-)

diff --git a/.gitea/workflows/ci-prod.yml b/.gitea/workflows/ci-prod.yml
index e361b85..7e61068 100644
--- a/.gitea/workflows/ci-prod.yml
+++ b/.gitea/workflows/ci-prod.yml
@@ -146,48 +146,46 @@ jobs:
             echo "========================================================================="
             echo "ERREUR : Le secret PROD_DB_SSH_KEY est totalement vide dans Gitea !"
             echo "========================================================================="
+            exit 1
           fi
 
-          KEY_B64=$(printf "%s" "${RAW_KEY}" | tr -d '\r' | base64 | tr -d '\r\n')
-          WORK_DIR="${GITHUB_WORKSPACE:-$(pwd)}"
+          rm -f /tmp/working_key /tmp/raw_key
+          printf "%s\n" "${RAW_KEY}" | tr -d '\r' > /tmp/raw_key
+          HEADER=$(grep "BEGIN" /tmp/raw_key)
+          FOOTER=$(grep "END" /tmp/raw_key)
+          BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n")
+          printf "%s\n" "$HEADER" > /tmp/working_key
+          printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key
+          printf "%s\n" "$FOOTER" >> /tmp/working_key
+          echo "" >> /tmp/working_key
+          chmod 600 /tmp/working_key
 
-          docker run --rm --net=host \
-            -v "${WORK_DIR}:/workspace" -w /workspace \
-            -e TARGET_HOST="${TARGET_HOST}" \
-            -e TARGET_USER="${TARGET_USER}" \
-            -e PORT="${PORT}" \
-            -e DEST_DIR="${DEST_DIR}" \
-            -e KEY_B64="${KEY_B64}" \
-            alpine:latest sh -c '
-              apk add --no-cache openssh-client rsync coreutils && \
-              (echo "$KEY_B64" | base64 -d 2>/dev/null || echo "$KEY_B64" | base64 --decode) > /tmp/raw_key && \
-              HEADER=$(grep "BEGIN" /tmp/raw_key) && \
-              FOOTER=$(grep "END" /tmp/raw_key) && \
-              BODY=$(grep -v "BEGIN" /tmp/raw_key | grep -v "END" | tr -d " \r\n") && \
-              printf "%s\n" "$HEADER" > /tmp/working_key && \
-              printf "%s\n" "$BODY" | fold -w 64 >> /tmp/working_key && \
-              printf "%s\n" "$FOOTER" >> /tmp/working_key && \
-              echo "" >> /tmp/working_key && \
-              chmod 600 /tmp/working_key && \
-              echo "=== 🔍 DIAGNOSTIC DETAILS ===" && \
-              echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})" && \
-              echo "Destination Directory: ${DEST_DIR}" && \
-              echo "Key File Line Count: $(wc -l < /tmp/working_key)" && \
-              echo "Key File First Line: $(head -n 1 /tmp/working_key)" && \
-              echo "=== 🔑 KEY FINGERPRINT ===" && \
-              ssh-keygen -l -f /tmp/working_key && \
-              SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15" && \
-              echo "=== 🚀 EXECUTING REMOTE COMMAND ===" && \
-              $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts" && \
-              echo "=== 📦 RSYNC TRANSFER SCRIPT ===" && \
-              if [ -f /workspace/scripts/backup_db.sh ]; then \
-                rsync -avz -e "$SSH_CMD" /workspace/scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/" ; \
-              else \
-                echo "ERROR: /workspace/scripts/backup_db.sh not found!" && ls -la /workspace && exit 1 ; \
-              fi && \
-              echo "=== 📦 RSYNC TRANSFER ENV ===" && \
-              [ -f /workspace/.env ] || touch /workspace/.env && \
-              rsync -avz -e "$SSH_CMD" /workspace/.env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env" && \
-              $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh" && \
-              echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"
-            '
+          echo "=== 🔍 DIAGNOSTIC DETAILS ==="
+          echo "Target Host: ${TARGET_USER}@${TARGET_HOST} (Port: ${PORT})"
+          echo "Destination Directory: ${DEST_DIR}"
+          echo "Current Directory: $(pwd)"
+          echo "Script Exists: $([ -f scripts/backup_db.sh ] && echo 'YES' || echo 'NO')"
+
+          echo "=== 🔑 KEY FINGERPRINT ==="
+          ssh-keygen -l -f /tmp/working_key
+
+          SSH_CMD="ssh -p ${PORT} -i /tmp/working_key -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ConnectTimeout=15"
+
+          echo "=== 🚀 EXECUTING REMOTE COMMAND ==="
+          $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "mkdir -p ${DEST_DIR}/scripts"
+
+          echo "=== 📦 TRANSFERRING SCRIPT & ENV ==="
+          if command -v rsync >/dev/null 2>&1; then
+            echo "Using rsync for file transfer..."
+            rsync -avz -e "$SSH_CMD" scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/"
+            [ -f .env ] || touch .env
+            rsync -avz -e "$SSH_CMD" .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env"
+          else
+            echo "Using scp for file transfer..."
+            scp -P ${PORT} -i /tmp/working_key -o StrictHostKeyChecking=no scripts/backup_db.sh "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/scripts/"
+            [ -f .env ] || touch .env
+            scp -P ${PORT} -i /tmp/working_key -o StrictHostKeyChecking=no .env "${TARGET_USER}@${TARGET_HOST}:${DEST_DIR}/.env"
+          fi
+
+          $SSH_CMD "${TARGET_USER}@${TARGET_HOST}" "chmod +x ${DEST_DIR}/scripts/backup_db.sh"
+          echo "SUCCESS: Backup script and .env deployed successfully to ${DEST_DIR} on DB Server!"