guettli/sharedinbox
1
0
Fork 0
Code Issues 21 Pull Requests 6 Actions Packages Projects Releases Wiki Activity

fix: pin SSH host key via known_hosts instead of StrictHostKeyChecking=no (#161) #181

Merged
guettlibot merged 1 commits from issue-161-fix into main 2026-05-24 11:00:12 +00:00
Conversation 0 Commits 1 Files Changed 5
+4516 -14239
1 Commits
Author SHA1 Message Date
Thomas SharedInboxandClaude Sonnet 4.6 b934894505 fix: pin SSH host key via known_hosts instead of StrictHostKeyChecking=no (#161) 
- Add knownHosts *dagger.Secret parameter to Deployer(), DeployLinux(),
  DeployApk(), PublishWebsite(), BuildWebsite(), GenerateBuildHistory()
- Mount SSH_KNOWN_HOSTS secret at /root/.ssh/known_hosts (mode 0644) in
  both the Deployer container and the GenerateBuildHistory container
- Remove all -o StrictHostKeyChecking=no flags from ssh/scp/rsync calls
  in ci/main.go and scripts/generate_build_history.py
- Update Taskfile dagger tasks (deploy-linux, deploy-apk, publish-website)
  to require SSH_KNOWN_HOSTS and pass --known-hosts env:SSH_KNOWN_HOSTS
- Fix non-Dagger Taskfile tasks to write SSH_KNOWN_HOSTS to ~/.ssh/known_hosts
- Fix .forgejo/workflows/deploy.yml to pass SSH_KNOWN_HOSTS secret
- Fix .github/workflows/ci.yml SSH setup step to write known_hosts file

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-05-24 12:51:33 +02:00