gitadmin/fxhnt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): use GIT_SSH_COMMAND absolute key path (Argo emissary has no HOME=/root)

Browse Source 
The cp-key-to-~/.ssh idiom failed under Argo's executor because emissary
doesn't set HOME=/root, so git couldn't find the key -> clone exit 128.
GIT_SSH_COMMAND with the absolute key path is HOME-independent (verified
cloning under HOME=/nonexistent). Applied to all three git-clone steps.
This commit is contained in:
Jeroen Grusewski
2026-07-21 10:46:56 +00:00
parent 6cf19ec379
commit 80bf243023
1 changed files with 8 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
infra/argo/fxhnt-cockpit-workflowtemplate.yaml
View File

@@ -56,15 +56,15 @@ spec:
env:
- { name: COMMIT_SHA, value: "{{workflow.parameters.commit-sha}}" }
- { name: MODE, value: "{{workflow.parameters.mode}}" }
# Absolute key path via GIT_SSH_COMMAND — Argo's emissary executor does not set HOME=/root, so the
# old `cp key -> ~/.ssh` idiom left git unable to find the key (clone failed with exit 128). This is
# HOME-independent and verified to clone under HOME=/nonexistent.
- { name: GIT_SSH_COMMAND, value: "ssh -i /etc/git-ssh/ssh-privatekey -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" }
args:
- |
set -e
case "$COMMIT_SHA" in *[!0-9a-fA-F]*|"") echo "refusing non-hex commit-sha" >&2; exit 1 ;; esac
case "$MODE" in auto|build|deploy) : ;; *) echo "refusing unknown mode: $MODE" >&2; exit 1 ;; esac
mkdir -p /root/.ssh
cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config
git clone --filter=blob:none \
"ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src
cd /workspace/src && git checkout "$COMMIT_SHA"
@@ -106,14 +106,12 @@ spec:
# SECURITY: commit-sha via ENV + hex-validated (see decide-mode note) — no inline shell substitution.
env:
- { name: COMMIT_SHA, value: "{{workflow.parameters.commit-sha}}" }
# Absolute key path via GIT_SSH_COMMAND — HOME-independent (Argo's emissary doesn't set HOME=/root).
- { name: GIT_SSH_COMMAND, value: "ssh -i /etc/git-ssh/ssh-privatekey -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" }
args:
- |
set -ex
case "$COMMIT_SHA" in *[!0-9a-fA-F]*|"") echo "refusing non-hex commit-sha" >&2; exit 1 ;; esac
mkdir -p /root/.ssh
cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config
git clone --no-checkout --filter=blob:none \
"ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src
cd /workspace/src && git checkout "$COMMIT_SHA"
@@ -161,14 +159,12 @@ spec:
# SECURITY: commit-sha via ENV + hex-validated — no inline shell substitution.
env:
- { name: COMMIT_SHA, value: "{{workflow.parameters.commit-sha}}" }
# Absolute key path via GIT_SSH_COMMAND — HOME-independent (Argo's emissary doesn't set HOME=/root).
- { name: GIT_SSH_COMMAND, value: "ssh -i /etc/git-ssh/ssh-privatekey -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" }
args:
- |
set -ex
case "$COMMIT_SHA" in *[!0-9a-fA-F]*|"") echo "refusing non-hex commit-sha" >&2; exit 1 ;; esac
mkdir -p /root/.ssh
cp /etc/git-ssh/ssh-privatekey /root/.ssh/id_ed25519
chmod 600 /root/.ssh/id_ed25519
printf 'Host *\n StrictHostKeyChecking no\n UserKnownHostsFile /dev/null\n' > /root/.ssh/config
git clone --no-checkout --filter=blob:none \
"ssh://git@gitea-ssh.gitea.svc.cluster.local:22/gitadmin/fxhnt.git" /workspace/src
cd /workspace/src && git checkout "$COMMIT_SHA"