Deploy over native ssh and scp instead of third-party actions - #836
Open
Jack-Edwards wants to merge 4 commits into
Open
Deploy over native ssh and scp instead of third-party actions#836Jack-Edwards wants to merge 4 commits into
Jack-Edwards wants to merge 4 commits into
Conversation
appleboy/scp-action and appleboy/ssh-action are composite actions that download a drone-scp or drone-ssh binary from GitHub releases at run time, with no checksum verification. Pinning those actions to a commit SHA does not cover the code that actually runs, and this is the workflow that holds the production SSH key. The OpenSSH client on the hosted runners covers everything this workflow needs: three single-file copies and five short remote commands. A host alias in ~/.ssh/config keeps the per-step configuration out of the way. Neither action was verifying the app server host key, since no fingerprint was ever configured. Host key checking is now strict and reads from a known_hosts file, so deploying requires a new APPSERVER_SSH_KNOWN_HOSTS secret. The workflow fails early with instructions when it is missing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Deploying now requires an APPSERVER_SSH_KNOWN_HOSTS secret per environment. Capturing the host key belongs with the rest of the one-time server setup, next to the SSH user it authenticates against. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Jack-Edwards
force-pushed
the
chore/native-ssh-deploy
branch
from
August 1, 2026 03:16
dfc30b7 to
06ce0b1
Compare
The previous instructions checked a single Ed25519 fingerprint against the server, but ssh-keyscan captures every key type the server offers unless it is told otherwise, so the remaining keys went into the secret unverified. Not every server has an Ed25519 key to begin with. Reading fingerprints off the server was also circular. Reaching it means connecting over ssh, at which point the workstation already holds the key that step was meant to confirm. known_hosts is indexed by host and port, and ssh writes a bare hostname only for port 22. An entry copied from a workstation that connects on another port is never consulted, and the deploy fails under strict host key checking as though no key had been recorded. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
appleboy/ssh-action applied a ten minute command_timeout that native ssh has no equivalent for, so a wedged image pull or a migration blocked on a lock would otherwise run until the six hour job default expires. BatchMode stops ssh from falling back to password and keyboard-interactive authentication when the key is rejected. Those attempts read an empty passphrase from a closed stdin and fail three times over before the step gives up, reporting a permission problem rather than the key problem. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
appleboy/scp-actionandappleboy/ssh-actionboth download a binary from GitHub releases at run time with no checksum verification, so pinning them to a commit SHA does not cover the code that actually executes. This workflow holds the production SSH key, so it is the one place worth removing that dependency. The OpenSSH client already on the runner does everything the workflow needs.A
Configure SSHstep writes the key, aknown_hostsfile, and aHost appserveralias, after which each step is a plainsshorscpinvocation.Deployment steps: this needs a new
APPSERVER_SSH_KNOWN_HOSTSsecret in both the production and staging environments before the next deploy. Neither action was verifying the host key previously, since nofingerprintwas ever configured; host key checking is now strict, and the workflow fails with instructions if the secret is missing. Capturing the key is documented underRecord the host keyin Web Server Setup. The host field of eachknown_hostsline has to matchAPPSERVER_SSH_HOSTandAPPSERVER_SSH_PORT, which means[host]:porton a non-default port.A remote command that exits non-zero now fails the workflow.
appleboy/ssh-actionleftscript_stopunset, so a failed migration or image pull previously passed its step and the deploy carried on.🤖 Generated with Claude Code