root/Jyotisha
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(staging): rotate SSH secret handling and env ownership
Staging Backend Quality Gate / validate (pull_request) Successful in 16m32s
Details
Staging Backend Quality Gate / publish (pull_request) Has been skipped
Details

Browse Source
This commit is contained in:
Jesse
2026-08-06 15:34:31 +08:00
parent eccd831ae9
commit cfc7af6b46
16 changed files with 153 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/configure-staging-rectification-rollout.yml
+4 -3
View File
@@ -73,13 +73,14 @@ jobs:
- name: Configure pinned staging SSH
env:
SSH_PRIVATE_KEY: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
SSH_PRIVATE_KEY_BASE64: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
run: |
set -euo pipefail
test -n "$SSH_PRIVATE_KEY"
test -n "$SSH_PRIVATE_KEY_BASE64"
install -d -m 700 ~/.ssh
printf '%s\n' "$SSH_PRIVATE_KEY" >~/.ssh/jyotisha-staging
printf '%s' "$SSH_PRIVATE_KEY_BASE64" | base64 --decode >~/.ssh/jyotisha-staging
chmod 600 ~/.ssh/jyotisha-staging
ssh-keygen -y -f ~/.ssh/jyotisha-staging >/dev/null
printf '%s\n' "$STAGING_KNOWN_HOSTS" >~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts
.github/workflows/deploy-staging.yml
+4 -3
View File
@@ -154,13 +154,14 @@ jobs:
- name: Configure pinned staging SSH
env:
SSH_PRIVATE_KEY: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
SSH_PRIVATE_KEY_BASE64: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
run: |
set -euo pipefail
test -n "$SSH_PRIVATE_KEY"
test -n "$SSH_PRIVATE_KEY_BASE64"
install -m 700 -d ~/.ssh
printf '%s\n' "$SSH_PRIVATE_KEY" >~/.ssh/jyotisha-staging
printf '%s' "$SSH_PRIVATE_KEY_BASE64" | base64 --decode >~/.ssh/jyotisha-staging
chmod 600 ~/.ssh/jyotisha-staging
ssh-keygen -y -f ~/.ssh/jyotisha-staging >/dev/null
printf '%s\n' "$STAGING_KNOWN_HOSTS" >~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts
.github/workflows/migrate-staging-database.yml
+4 -3
View File
@@ -116,13 +116,14 @@ jobs:
- name: Configure pinned staging SSH
env:
SSH_PRIVATE_KEY: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
SSH_PRIVATE_KEY_BASE64: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
run: |
set -euo pipefail
test -n "$SSH_PRIVATE_KEY"
test -n "$SSH_PRIVATE_KEY_BASE64"
install -m 700 -d ~/.ssh
printf '%s\n' "$SSH_PRIVATE_KEY" >~/.ssh/jyotisha-staging
printf '%s' "$SSH_PRIVATE_KEY_BASE64" | base64 --decode >~/.ssh/jyotisha-staging
chmod 600 ~/.ssh/jyotisha-staging
ssh-keygen -y -f ~/.ssh/jyotisha-staging >/dev/null
printf '%s\n' "$STAGING_KNOWN_HOSTS" >~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts
.github/workflows/reset-staging-account.yml
+4 -3
View File
@@ -62,13 +62,14 @@ jobs:
- name: Configure pinned staging SSH
env:
SSH_PRIVATE_KEY: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
SSH_PRIVATE_KEY_BASE64: ${{ secrets.STAGING_SSH_PRIVATE_KEY }}
run: |
set -euo pipefail
test -n "$SSH_PRIVATE_KEY"
test -n "$SSH_PRIVATE_KEY_BASE64"
install -d -m 700 ~/.ssh
printf '%s\n' "$SSH_PRIVATE_KEY" >~/.ssh/jyotisha-staging
printf '%s' "$SSH_PRIVATE_KEY_BASE64" | base64 --decode >~/.ssh/jyotisha-staging
chmod 600 ~/.ssh/jyotisha-staging
ssh-keygen -y -f ~/.ssh/jyotisha-staging >/dev/null
printf '%s\n' "$STAGING_KNOWN_HOSTS" >~/.ssh/known_hosts
chmod 600 ~/.ssh/known_hosts