Harden Gitea Actions release dependency SSH

.gitea/workflows/dependency-audit.yml

@@ -21,21 +21,17 @@ jobs:
           node-version: "22"
       - name: Configure SSH for release dependencies
         env:
-          GOVOPLAN_RELEASE_SSH_KEY: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY }}
+          GOVOPLAN_RELEASE_SSH_KEY_B64: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY_B64 }}
         run: |
           mkdir -p ~/.ssh
           chmod 700 ~/.ssh
-          if [ -z "${GOVOPLAN_RELEASE_SSH_KEY:-}" ]; then
-            echo "GOVOPLAN_RELEASE_SSH_KEY secret is required for git+ssh release dependencies."
+          if [ -z "${GOVOPLAN_RELEASE_SSH_KEY_B64:-}" ]; then
+            echo "GOVOPLAN_RELEASE_SSH_KEY_B64 secret is required for git+ssh release dependencies."
             exit 1
           fi
-          printf '%s\n' "$GOVOPLAN_RELEASE_SSH_KEY" > ~/.ssh/id_ed25519
+          printf '%s' "$GOVOPLAN_RELEASE_SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
-          if ! command -v ssh-keyscan >/dev/null 2>&1; then
-            apt-get update
-            apt-get install -y openssh-client
-          fi
-          ssh-keyscan -4 -H git.add-ideas.de >> ~/.ssh/known_hosts
+          echo 'git.add-ideas.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe48IOof2fJS1dTbJtLWQnWnr+JorZXKIFdOAM9ct8G' > ~/.ssh/known_hosts
           chmod 600 ~/.ssh/known_hosts
       - name: Install backend dev audit dependencies
         run: |