kjh2064/QuantEngineByItz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

fix: Reference the actual registered SSH secret name

Browse Source 
Found via SSH log analysis (Run #2003, task 2334): the "Verify SSH
Key and Secrets" step failed immediately with
"DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY not configured" -- both were
empty. Queried GET /repos/{repo}/actions/secrets directly and found
the actually-registered secrets are named SSH_PRIVATE_KEY and
QUANTENGINE_DB_PASSWORD; DEPLOY_SSH_KEY_B64/DEPLOY_SSH_KEY were never
created, despite CLAUDE.md claiming "SSH credentials: SSH_KEY
registered in Gitea Secrets".

Every past deploy-prod.yml run that reached the SSH step (e.g. Run
#1991's Pre-Deployment Verification) failed here for the same reason
-- this was never a working path, just never diagnosed down to the
secret name before now.

Fix: check secrets.SSH_PRIVATE_KEY first (with the same PEM-vs-base64
auto-detection used for the legacy names), falling back to
DEPLOY_SSH_KEY_B64 / DEPLOY_SSH_KEY in case those get added later.
Applied to all three places that build ~/.ssh/deploy_key (deploy job
verify + setup, and post-deploy-check's setup).
This commit is contained in:
김재현
2026-07-12 00:50:30 +09:00
parent cc94d5aeae
commit c8c558841e
1 changed files with 29 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/deploy-prod.yml
+29 -9
View File
@@ -32,10 +32,15 @@ jobs:
steps:
- name: Verify SSH Key and Secrets
run: |
# SSH_PRIVATE_KEY is the actual secret name registered in this repo
# (verified via GET /repos/{r}/actions/secrets -- DEPLOY_SSH_KEY_B64 /
# DEPLOY_SSH_KEY were never actually created despite CLAUDE.md
# claiming so; kept as fallback names in case they're added later).
SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
if [ -z "$SSH_KEY_B64" ] && [ -z "$SSH_KEY_RAW" ]; then
echo "ERROR: DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY not configured"
if [ -z "$SSH_KEY" ] && [ -z "$SSH_KEY_B64" ] && [ -z "$SSH_KEY_RAW" ]; then
echo "ERROR: No SSH key secret configured (checked SSH_PRIVATE_KEY, DEPLOY_SSH_KEY_B64, DEPLOY_SSH_KEY)"
exit 1
fi
[ -z "${{ secrets.GITEA_TOKEN }}" ] && { echo "ERROR: GITEA_TOKEN not configured"; exit 1; }
@@ -104,17 +109,25 @@ jobs:
- name: Setup SSH
run: |
mkdir -p ~/.ssh
SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
if [ -n "$SSH_KEY_B64" ]; then
write_key() {
# $1 = raw secret value; auto-detects PEM vs base64
if printf '%s' "$1" | grep -q 'BEGIN.*PRIVATE KEY'; then
printf '%b\n' "$1" > ~/.ssh/deploy_key
else
printf '%s' "$1" | base64 -d > ~/.ssh/deploy_key
fi
}
if [ -n "$SSH_KEY" ]; then
write_key "$SSH_KEY"
elif [ -n "$SSH_KEY_B64" ]; then
printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/deploy_key
elif [ -n "$SSH_KEY_RAW" ]; then
if printf '%s' "$SSH_KEY_RAW" | grep -q 'BEGIN.*PRIVATE KEY'; then
printf '%b\n' "$SSH_KEY_RAW" > ~/.ssh/deploy_key
else
printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/deploy_key
fi
write_key "$SSH_KEY_RAW"
else
echo "ERROR: No SSH key configured"
exit 1
@@ -207,10 +220,17 @@ jobs:
- name: Setup SSH (for service check)
run: |
mkdir -p ~/.ssh
SSH_KEY="${{ secrets.SSH_PRIVATE_KEY }}"
SSH_KEY_B64="${{ secrets.DEPLOY_SSH_KEY_B64 }}"
SSH_KEY_RAW="${{ secrets.DEPLOY_SSH_KEY }}"
if [ -n "$SSH_KEY_B64" ]; then
if [ -n "$SSH_KEY" ]; then
if printf '%s' "$SSH_KEY" | grep -q 'BEGIN.*PRIVATE KEY'; then
printf '%b\n' "$SSH_KEY" > ~/.ssh/deploy_key
else
printf '%s' "$SSH_KEY" | base64 -d > ~/.ssh/deploy_key
fi
elif [ -n "$SSH_KEY_B64" ]; then
printf '%s' "$SSH_KEY_B64" | base64 -d > ~/.ssh/deploy_key
elif [ -n "$SSH_KEY_RAW" ]; then
printf '%s' "$SSH_KEY_RAW" | base64 -d > ~/.ssh/deploy_key