Will Anderson
c94721b70b
Gitea's SSH server is disabled (START_SSH_SERVER=false) so the SSH URL rewrite breaks git HTTPS clones in build containers. HTTPS git ops work directly from Legion host network — Cloudflare bypasses CF Access for smart-HTTP and release asset paths.
49 lines
1.8 KiB
Bash
49 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# git-ssh-init.sh
|
|
#
|
|
# Sets up SSH authentication for git operations inside CI build containers.
|
|
#
|
|
# How this gets invoked:
|
|
# act_runner runs each step via a non-interactive bash invocation.
|
|
# Setting BASH_ENV=/usr/local/bin/git-ssh-init.sh in act_runner's
|
|
# container.env causes bash to source this before any step's commands.
|
|
# (See servers/legion/k8s/gitea-runner/deployment.yaml.)
|
|
#
|
|
# What it does:
|
|
# 1. Writes GITEA_SSH_PRIVATE_KEY (from the runner secret) to ~/.ssh/gitea_key
|
|
# 2. Creates an ~/.ssh/config entry so git uses that key for git.neuralplatform.ai
|
|
# 3. Sets a git insteadOf rule to rewrite HTTPS Gitea URLs to SSH,
|
|
# so `actions/checkout` and any direct `git clone https://...` also use SSH
|
|
#
|
|
# Idempotent — safe to re-run on every step.
|
|
|
|
if [ -n "${GITEA_SSH_PRIVATE_KEY:-}" ]; then
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
# Write the private key
|
|
printf '%s\n' "${GITEA_SSH_PRIVATE_KEY}" > ~/.ssh/gitea_key
|
|
chmod 600 ~/.ssh/gitea_key
|
|
|
|
# SSH config — use this key for git.neuralplatform.ai, skip host key checking
|
|
# (build containers are ephemeral; we don't persist a known_hosts file)
|
|
cat > ~/.ssh/gitea_config << 'EOF'
|
|
Host git.neuralplatform.ai
|
|
HostName git.neuralplatform.ai
|
|
User git
|
|
IdentityFile ~/.ssh/gitea_key
|
|
StrictHostKeyChecking no
|
|
UserKnownHostsFile /dev/null
|
|
EOF
|
|
chmod 600 ~/.ssh/gitea_config
|
|
|
|
# Point SSH at our per-job config (merge with any existing config if present)
|
|
export GIT_SSH_COMMAND="ssh -F ~/.ssh/gitea_config"
|
|
|
|
# NOTE: Do NOT add url.insteadOf SSH rewrite here.
|
|
# Gitea's built-in SSH server is disabled (START_SSH_SERVER=false) so
|
|
# SSH git clones would fail. HTTPS git operations work directly from
|
|
# the build container host network — Cloudflare bypasses the CF Access
|
|
# gate for git smart-HTTP and release asset paths.
|
|
fi
|