From 1fac90ed2a0434750ab6d697c7f23ebb83449e76 Mon Sep 17 00:00:00 2001 From: Mathias Date: Mon, 27 Jul 2026 22:16:00 +0200 Subject: [PATCH] fix(cd): pass git.d-ma.be SSH override as -o flags, not an appended ~/.ssh/config line MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit cd.yml's own $HOME (/data) is a PVC that persists across job runs on this runner. The previous fix (cb9c251) appended the corrected HostName to ~/.ssh/config, but a stale 127.0.0.1:30022 entry from an earlier failed run was already there — ssh_config is first-match-wins, so the stale entry silently shadowed the fix and the very next run failed identically. Cleaned the persisted stale entry on the runner directly; this commit removes the append entirely so the step no longer depends on file state surviving (or not surviving) between runs — CLI -o overrides always win. Verified end-to-end against the real infra repo from inside the runner pod (git ls-remote, correctly reached gitea and got a clean auth rejection, not a connection error). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_01Roq1ajWKR5f1hG5Df9wC6A --- .gitea/workflows/cd.yml | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml index 5f3a59a..5cf6d5c 100644 --- a/.gitea/workflows/cd.yml +++ b/.gitea/workflows/cd.yml @@ -52,9 +52,19 @@ jobs: # (that only worked when act_runner ran on koala's bare host network; # from inside the containerized runner's own pod netns, loopback # never reaches the host — "Connection refused", found 2026-07-27). - printf 'Host git.d-ma.be\n HostName gitea-ssh-nodeport.gitea.svc.cluster.local\n Port 22\n StrictHostKeyChecking no\n' >> ~/.ssh/config - - GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \ + # + # Pass as -o overrides on the ssh invocation itself, NOT appended to + # ~/.ssh/config: $HOME (/data) is a PVC that persists across job + # runs on this runner (same "workspace not ephemeral" class as + # brain: act-runner-host-executor-tmp-persists), so an appended + # line here would pile up duplicate `Host git.d-ma.be` blocks + # across every run — ssh_config is first-match-wins, so a stale + # entry from an earlier failed run would silently shadow this + # fix forever (exactly what happened once already: this fix's + # own first attempt got appended AFTER an already-stale entry + # and lost). CLI -o options always win regardless of file state, + # so this step is safe to re-run any number of times. + GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes -o HostName=gitea-ssh-nodeport.gitea.svc.cluster.local -o Port=22 -o StrictHostKeyChecking=no" \ git clone "${INFRA_REPO}" /tmp/infra-update cd /tmp/infra-update