From d7d18e111dc2584bb6309a4765a7a3522212690d Mon Sep 17 00:00:00 2001 From: Gabriel Brown Date: Thu, 1 Oct 2026 15:15:16 -0400 Subject: [PATCH] Keep the deploy key out of the printed CI script The deploy step put ${{ secrets.DEPLOY_SSH_KEY }} straight into the run script. The runner prints that script, and Gitea does not mask a multi-line secret once it is split across script lines, so the key body appeared in every deploy log. The key now arrives through the step's env block. --- .gitea/workflows/build-next.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/.gitea/workflows/build-next.yml b/.gitea/workflows/build-next.yml index bac982d..5f16993 100644 --- a/.gitea/workflows/build-next.yml +++ b/.gitea/workflows/build-next.yml @@ -119,9 +119,14 @@ jobs: # failure only warns: the image is pushed and the midnight # podman-update.timer deploys it anyway. - name: Trigger immediate deploy + # The key comes in through env, not ${{ secrets.* }} in the script: + # the runner prints the script, and Gitea does not mask a multi-line + # secret once it is split across script lines. + env: + DEPLOY_SSH_KEY: ${{ secrets.DEPLOY_SSH_KEY }} run: | install -m600 /dev/null "$HOME/.deploy_key" - printf '%s\n' "${{ secrets.DEPLOY_SSH_KEY }}" > "$HOME/.deploy_key" + printf '%s\n' "$DEPLOY_SSH_KEY" > "$HOME/.deploy_key" ssh -i "$HOME/.deploy_key" \ -o BatchMode=yes \ -o StrictHostKeyChecking=accept-new \