From ca1206e8c99fa75a134d48867d60cfb2e5b2c95f Mon Sep 17 00:00:00 2001
From: Albrecht Degering <albrecht@degering.name>
Date: Fri, 10 Jul 2026 22:24:47 +0200
Subject: [PATCH] Harden Gitea Actions release dependency SSH

---
 .gitea/workflows/dependency-audit.yml | 14 +++++---------
 .gitea/workflows/module-matrix.yml    | 14 +++++---------
 2 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/.gitea/workflows/dependency-audit.yml b/.gitea/workflows/dependency-audit.yml
index b9703cc..eb4b668 100644
--- a/.gitea/workflows/dependency-audit.yml
+++ b/.gitea/workflows/dependency-audit.yml
@@ -21,21 +21,17 @@ jobs:
           node-version: "22"
       - name: Configure SSH for release dependencies
         env:
-          GOVOPLAN_RELEASE_SSH_KEY: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY }}
+          GOVOPLAN_RELEASE_SSH_KEY_B64: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY_B64 }}
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          if [ -z "${GOVOPLAN_RELEASE_SSH_KEY:-}" ]; then
-            echo "GOVOPLAN_RELEASE_SSH_KEY secret is required for git+ssh release dependencies."
+          if [ -z "${GOVOPLAN_RELEASE_SSH_KEY_B64:-}" ]; then
+            echo "GOVOPLAN_RELEASE_SSH_KEY_B64 secret is required for git+ssh release dependencies."
             exit 1
           fi
-          printf '%s\n' "$GOVOPLAN_RELEASE_SSH_KEY" > ~/.ssh/id_ed25519
+          printf '%s' "$GOVOPLAN_RELEASE_SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          if ! command -v ssh-keyscan >/dev/null 2>&1; then
-            apt-get update
-            apt-get install -y openssh-client
-          fi
-          ssh-keyscan -4 -H git.add-ideas.de >> ~/.ssh/known_hosts
+          echo 'git.add-ideas.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe48IOof2fJS1dTbJtLWQnWnr+JorZXKIFdOAM9ct8G' > ~/.ssh/known_hosts
           chmod 600 ~/.ssh/known_hosts
       - name: Install backend dev audit dependencies
         run: |
diff --git a/.gitea/workflows/module-matrix.yml b/.gitea/workflows/module-matrix.yml
index ec6cf98..3af866a 100644
--- a/.gitea/workflows/module-matrix.yml
+++ b/.gitea/workflows/module-matrix.yml
@@ -19,21 +19,17 @@ jobs:
           node-version: "22"
       - name: Configure SSH for release dependencies
         env:
-          GOVOPLAN_RELEASE_SSH_KEY: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY }}
+          GOVOPLAN_RELEASE_SSH_KEY_B64: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY_B64 }}
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          if [ -z "${GOVOPLAN_RELEASE_SSH_KEY:-}" ]; then
-            echo "GOVOPLAN_RELEASE_SSH_KEY secret is required for git+ssh release dependencies."
+          if [ -z "${GOVOPLAN_RELEASE_SSH_KEY_B64:-}" ]; then
+            echo "GOVOPLAN_RELEASE_SSH_KEY_B64 secret is required for git+ssh release dependencies."
             exit 1
           fi
-          printf '%s\n' "$GOVOPLAN_RELEASE_SSH_KEY" > ~/.ssh/id_ed25519
+          printf '%s' "$GOVOPLAN_RELEASE_SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          if ! command -v ssh-keyscan >/dev/null 2>&1; then
-            apt-get update
-            apt-get install -y openssh-client
-          fi
-          ssh-keyscan -4 -H git.add-ideas.de >> ~/.ssh/known_hosts
+          echo 'git.add-ideas.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe48IOof2fJS1dTbJtLWQnWnr+JorZXKIFdOAM9ct8G' > ~/.ssh/known_hosts
           chmod 600 ~/.ssh/known_hosts
       - name: Install backend release dependencies
         run: |