Will Anderson
49 lines
1.8 KiB
Bash
49 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# git-ssh-init.sh
|
|
#
|
|
# Sets up SSH authentication for git operations inside CI build containers.
|
|
#
|
|
# How this gets invoked:
|
|
# act_runner runs each step via a non-interactive bash invocation.
|
|
# Setting BASH_ENV=/usr/local/bin/git-ssh-init.sh in act_runner's
|
|
# container.env causes bash to source this before any step's commands.
|
|
# (See servers/legion/k8s/gitea-runner/deployment.yaml.)
|
|
#
|
|
# What it does:
|
|
# 1. Writes GITEA_SSH_PRIVATE_KEY (from the runner secret) to ~/.ssh/gitea_key
|
|
# 2. Creates an ~/.ssh/config entry so git uses that key for git.neuralplatform.ai
|
|
# 3. Sets a git insteadOf rule to rewrite HTTPS Gitea URLs to SSH,
|
|
# so `actions/checkout` and any direct `git clone https://...` also use SSH
|
|
#
|
|
# Idempotent — safe to re-run on every step.
|
|
|
|
if [ -n "${GITEA_SSH_PRIVATE_KEY:-}" ]; then
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
# Write the private key
|
|
printf '%s\n' "${GITEA_SSH_PRIVATE_KEY}" > ~/.ssh/gitea_key
|
|
chmod 600 ~/.ssh/gitea_key
|
|
|
|
# SSH config — use this key for git.neuralplatform.ai, skip host key checking
|
|
# (build containers are ephemeral; we don't persist a known_hosts file)
|
|
cat > ~/.ssh/gitea_config << 'EOF'
|
|
Host git.neuralplatform.ai
|
|
HostName git.neuralplatform.ai
|
|
User git
|
|
IdentityFile ~/.ssh/gitea_key
|
|
StrictHostKeyChecking no
|
|
UserKnownHostsFile /dev/null
|
|
EOF
|
|
chmod 600 ~/.ssh/gitea_config
|
|
|
|
# Point SSH at our per-job config (merge with any existing config if present)
|
|
export GIT_SSH_COMMAND="ssh -F ~/.ssh/gitea_config"
|
|
|
|
# Rewrite HTTPS Gitea URLs → SSH so `actions/checkout` and plain `git clone`
|
|
# both go through SSH without any HTTPS credential or CF Access token needed
|
|
git config --global \
|
|
url."git@git.neuralplatform.ai:".insteadOf \
|
|
"https://git.neuralplatform.ai/" 2>/dev/null || true
|
|
fi
|