micqdf/TerraHome
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'fix: normalize escaped SSH private key secrets' (#49) from stage into master
Some checks failed
Terraform Apply / Terraform Apply (push) Failing after 5m10s
Details

Browse Source 
Reviewed-on: #49
This commit was merged in pull request #49.
This commit is contained in:
micqdf
2026-02-28 18:06:31 +00:00
parent 8b363497b7 2d9d6cdcd5
commit 2078afa8a3
3 changed files with 18 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitea/workflows/kubeadm-bootstrap.yml
View File

@@ -42,7 +42,7 @@ jobs:
exit 1
fi
printf '%s\n' "$KEY_CONTENT" | tr -d '\r' > ~/.ssh/id_ed25519
KEY_CONTENT="$KEY_CONTENT" python3 -c 'import os, pathlib; key=os.environ.get("KEY_CONTENT", "").replace("\r", ""); key=key.replace("\\n", "\n") if "\\n" in key and "\n" not in key else key; pathlib.Path.home().joinpath(".ssh", "id_ed25519").write_text(key if key.endswith("\n") else key + "\n")'
chmod 0600 ~/.ssh/id_ed25519
- name: Set up Terraform

2
.gitea/workflows/kubeadm-reset.yml
View File

@@ -42,7 +42,7 @@ jobs:
exit 1
fi
printf '%s\n' "$KEY_CONTENT" | tr -d '\r' > ~/.ssh/id_ed25519
KEY_CONTENT="$KEY_CONTENT" python3 -c 'import os, pathlib; key=os.environ.get("KEY_CONTENT", "").replace("\r", ""); key=key.replace("\\n", "\n") if "\\n" in key and "\n" not in key else key; pathlib.Path.home().joinpath(".ssh", "id_ed25519").write_text(key if key.endswith("\n") else key + "\n")'
chmod 0600 ~/.ssh/id_ed25519
- name: Set up Terraform

19
.gitea/workflows/terraform-apply.yml
View File

@@ -85,13 +85,26 @@ jobs:
exit 1
fi
printf '%s\n' "$KEY_CONTENT" | tr -d '\r' > ~/.ssh/id_ed25519
KEY_CONTENT="$KEY_CONTENT" python3 -c 'import os, pathlib; key=os.environ.get("KEY_CONTENT", "").replace("\r", ""); key=key.replace("\\n", "\n") if "\\n" in key and "\n" not in key else key; pathlib.Path.home().joinpath(".ssh", "id_ed25519").write_text(key if key.endswith("\n") else key + "\n")'
chmod 0600 ~/.ssh/id_ed25519
- name: Verify SSH keypair match
run: |
PRIV_FP="$(ssh-keygen -y -f ~/.ssh/id_ed25519 | ssh-keygen -lf - | awk '{print $2}')"
PUB_FP="$(printf '%s\n' "${{ secrets.SSH_KEY_PUBLIC }}" | tr -d '\r' | ssh-keygen -lf - | awk '{print $2}')"
if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/tmp/key.pub 2>/tmp/key.err; then
echo "Invalid private key content in SSH_KEY_PRIVATE/KUBEADM_SSH_PRIVATE_KEY"
cat /tmp/key.err
exit 1
fi
printf '%s\n' "${{ secrets.SSH_KEY_PUBLIC }}" | tr -d '\r' > /tmp/secret.pub
if ! ssh-keygen -lf /tmp/secret.pub >/tmp/secret.fp 2>/tmp/secret.err; then
echo "Invalid SSH_KEY_PUBLIC format"
cat /tmp/secret.err
exit 1
fi
PRIV_FP="$(ssh-keygen -lf /tmp/key.pub | awk '{print $2}')"
PUB_FP="$(awk '{print $2}' /tmp/secret.fp)"
echo "private fingerprint: $PRIV_FP"
echo "public fingerprint: $PUB_FP"