From 7daf7a267b0e2e6bab913bb74588913cbffdfdfe Mon Sep 17 00:00:00 2001 From: Timothy Kim Date: Fri, 20 Mar 2026 16:31:03 -0400 Subject: [PATCH] pin ssh host key in all workflows --- .gitea/workflows/deploy-garage.yml | 3 ++- .gitea/workflows/deploy-haanmind.net.yml | 3 ++- .gitea/workflows/deploy-hantim.net.yml | 3 ++- .gitea/workflows/deploy-hcsuzuki.net.yml | 3 ++- .gitea/workflows/deploy-nginx.yml | 3 ++- .gitea/workflows/deploy-thekims.family.yml | 3 ++- .gitea/workflows/deploy-timothykim.yml | 3 ++- .gitea/workflows/provision.yml | 3 ++- tools/app.sh | 3 ++- 9 files changed, 18 insertions(+), 9 deletions(-) diff --git a/.gitea/workflows/deploy-garage.yml b/.gitea/workflows/deploy-garage.yml index 38a5a74..f47ff03 100644 --- a/.gitea/workflows/deploy-garage.yml +++ b/.gitea/workflows/deploy-garage.yml @@ -13,6 +13,7 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-garage + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-garage diff --git a/.gitea/workflows/deploy-haanmind.net.yml b/.gitea/workflows/deploy-haanmind.net.yml index 28c3b93..527bfeb 100644 --- a/.gitea/workflows/deploy-haanmind.net.yml +++ b/.gitea/workflows/deploy-haanmind.net.yml @@ -13,6 +13,7 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-haanmind.net + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-haanmind.net diff --git a/.gitea/workflows/deploy-hantim.net.yml b/.gitea/workflows/deploy-hantim.net.yml index c1fa30d..b1bc9c0 100644 --- a/.gitea/workflows/deploy-hantim.net.yml +++ b/.gitea/workflows/deploy-hantim.net.yml @@ -13,6 +13,7 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-hantim.net + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-hantim.net diff --git a/.gitea/workflows/deploy-hcsuzuki.net.yml b/.gitea/workflows/deploy-hcsuzuki.net.yml index 8520979..10d29e1 100644 --- a/.gitea/workflows/deploy-hcsuzuki.net.yml +++ b/.gitea/workflows/deploy-hcsuzuki.net.yml @@ -13,6 +13,7 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-hcsuzuki.net + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-hcsuzuki.net diff --git a/.gitea/workflows/deploy-nginx.yml b/.gitea/workflows/deploy-nginx.yml index a979c7e..3c6118c 100644 --- a/.gitea/workflows/deploy-nginx.yml +++ b/.gitea/workflows/deploy-nginx.yml @@ -13,9 +13,10 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-nginx test: needs: deploy diff --git a/.gitea/workflows/deploy-thekims.family.yml b/.gitea/workflows/deploy-thekims.family.yml index 4e057db..81e9b05 100644 --- a/.gitea/workflows/deploy-thekims.family.yml +++ b/.gitea/workflows/deploy-thekims.family.yml @@ -13,6 +13,7 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-thekims.family + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-thekims.family diff --git a/.gitea/workflows/deploy-timothykim.yml b/.gitea/workflows/deploy-timothykim.yml index 1a3315c..e1c951c 100644 --- a/.gitea/workflows/deploy-timothykim.yml +++ b/.gitea/workflows/deploy-timothykim.yml @@ -13,6 +13,7 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-timothykim.net + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-timothykim.net diff --git a/.gitea/workflows/provision.yml b/.gitea/workflows/provision.yml index c4bc655..66fe793 100644 --- a/.gitea/workflows/provision.yml +++ b/.gitea/workflows/provision.yml @@ -13,6 +13,7 @@ jobs: - name: Provision via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} provision + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} provision diff --git a/tools/app.sh b/tools/app.sh index 7660db1..5f58e2b 100755 --- a/tools/app.sh +++ b/tools/app.sh @@ -293,9 +293,10 @@ jobs: - name: Deploy via SSH run: | mkdir -p ~/.ssh + echo "${{ vars.DEPLOY_HOST_KEY }}" > ~/.ssh/known_hosts echo "${{ secrets.DEPLOY_SSH_KEY }}" > ~/.ssh/deploy_key chmod 600 ~/.ssh/deploy_key - ssh -o StrictHostKeyChecking=accept-new -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-APP_PLACEHOLDER + ssh -o StrictHostKeyChecking=yes -i ~/.ssh/deploy_key deploy@${{ vars.DEPLOY_HOST }} deploy-APP_PLACEHOLDER OUTER sed -i "s/APP_PLACEHOLDER/$APP/g" "$REPO_ROOT/.gitea/workflows/deploy-$APP.yml"