Skip to content

Commit ab8a4f6

Browse files
committed
Update GitHub Actions workflow to enhance SSH key handling
- Modified the `ssh-keyscan` command to include all key types GitHub may present, improving security and reliability. - Updated the `GIT_SSH_COMMAND` environment variable to enforce strict host key checking and specify the known hosts file, ensuring a more secure SSH connection during the workflow execution.
1 parent 4e60f7d commit ab8a4f6

1 file changed

Lines changed: 13 additions & 4 deletions

File tree

.github/workflows/generate-db-docs.yml

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,8 @@ jobs:
4242
- name: Add GitHub to known_hosts
4343
run: |
4444
install -d -m 700 ~/.ssh
45-
ssh-keyscan -t ed25519,ecdsa github.com >> ~/.ssh/known_hosts
45+
# Add ALL key types GitHub may present
46+
ssh-keyscan -H -t rsa,ecdsa,ed25519 github.com >> ~/.ssh/known_hosts
4647
chmod 644 ~/.ssh/known_hosts
4748
4849
- name: Set up deploy key
@@ -55,7 +56,11 @@ jobs:
5556
- name: Check out docs repo
5657
run: git clone git@github.com:rage/secret-project-331-db-docs.git db-docs
5758
env:
58-
GIT_SSH_COMMAND: "ssh -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes"
59+
GIT_SSH_COMMAND: >-
60+
ssh -i ~/.ssh/id_ed25519
61+
-o IdentitiesOnly=yes
62+
-o StrictHostKeyChecking=yes
63+
-o UserKnownHostsFile=~/.ssh/known_hosts
5964
6065
- name: Setup database
6166
run: sqlx database setup
@@ -103,6 +108,10 @@ jobs:
103108

104109
- name: Push changes
105110
run: git push
106-
env:
107-
GIT_SSH_COMMAND: "ssh -o StrictHostKeyChecking=no -i ~/.ssh/id_ed25519 -o IdentitiesOnly=yes"
108111
working-directory: ./db-docs
112+
env:
113+
GIT_SSH_COMMAND: >-
114+
ssh -i ~/.ssh/id_ed25519
115+
-o IdentitiesOnly=yes
116+
-o StrictHostKeyChecking=yes
117+
-o UserKnownHostsFile=~/.ssh/known_hosts

0 commit comments

Comments
 (0)