add-ideas/govoplan-core
1
0
Fork 0
Code Issues 45 Pull Requests Actions Packages Projects Releases Wiki Activity

Harden Gitea Actions release dependency SSH
Some checks failed
Dependency Audit / dependency-audit (push) Failing after 49s
Details
Module Matrix / module-matrix (push) Failing after 47s
Details

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-10 22:24:47 +02:00
parent 94236a7d7e
commit ca1206e8c9
2 changed files with 10 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
.gitea/workflows/dependency-audit.yml
View File

@@ -21,21 +21,17 @@ jobs:
node-version: "22" node-version: "22"
- name: Configure SSH for release dependencies - name: Configure SSH for release dependencies
env: env:
GOVOPLAN_RELEASE_SSH_KEY: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY }} GOVOPLAN_RELEASE_SSH_KEY_B64: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY_B64 }}
run: | run: |
mkdir -p ~/.ssh mkdir -p ~/.ssh
chmod 700 ~/.ssh chmod 700 ~/.ssh
if [ -z "${GOVOPLAN_RELEASE_SSH_KEY:-}" ]; then if [ -z "${GOVOPLAN_RELEASE_SSH_KEY_B64:-}" ]; then
echo "GOVOPLAN_RELEASE_SSH_KEY secret is required for git+ssh release dependencies." echo "GOVOPLAN_RELEASE_SSH_KEY_B64 secret is required for git+ssh release dependencies."
exit 1 exit 1
fi fi
printf '%s\n' "$GOVOPLAN_RELEASE_SSH_KEY" > ~/.ssh/id_ed25519 printf '%s' "$GOVOPLAN_RELEASE_SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519
if ! command -v ssh-keyscan >/dev/null 2>&1; then echo 'git.add-ideas.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe48IOof2fJS1dTbJtLWQnWnr+JorZXKIFdOAM9ct8G' > ~/.ssh/known_hosts
apt-get update
apt-get install -y openssh-client
fi
ssh-keyscan -4 -H git.add-ideas.de >> ~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts chmod 600 ~/.ssh/known_hosts
- name: Install backend dev audit dependencies - name: Install backend dev audit dependencies
run: | run: |

14
.gitea/workflows/module-matrix.yml
View File

@@ -19,21 +19,17 @@ jobs:
node-version: "22" node-version: "22"
- name: Configure SSH for release dependencies - name: Configure SSH for release dependencies
env: env:
GOVOPLAN_RELEASE_SSH_KEY: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY }} GOVOPLAN_RELEASE_SSH_KEY_B64: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY_B64 }}
run: | run: |
mkdir -p ~/.ssh mkdir -p ~/.ssh
chmod 700 ~/.ssh chmod 700 ~/.ssh
if [ -z "${GOVOPLAN_RELEASE_SSH_KEY:-}" ]; then if [ -z "${GOVOPLAN_RELEASE_SSH_KEY_B64:-}" ]; then
echo "GOVOPLAN_RELEASE_SSH_KEY secret is required for git+ssh release dependencies." echo "GOVOPLAN_RELEASE_SSH_KEY_B64 secret is required for git+ssh release dependencies."
exit 1 exit 1
fi fi
printf '%s\n' "$GOVOPLAN_RELEASE_SSH_KEY" > ~/.ssh/id_ed25519 printf '%s' "$GOVOPLAN_RELEASE_SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_ed25519 chmod 600 ~/.ssh/id_ed25519
if ! command -v ssh-keyscan >/dev/null 2>&1; then echo 'git.add-ideas.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe48IOof2fJS1dTbJtLWQnWnr+JorZXKIFdOAM9ct8G' > ~/.ssh/known_hosts
apt-get update
apt-get install -y openssh-client
fi
ssh-keyscan -4 -H git.add-ideas.de >> ~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts chmod 600 ~/.ssh/known_hosts
- name: Install backend release dependencies - name: Install backend release dependencies
run: | run: |