sharang/compliance-scanner-agent
1
0
Fork 0
Code Issues 79 Pull Requests 1 Actions Packages Projects Releases 1 Wiki Activity

ci: fetch private tramiton dep via read-only SSH deploy key
CI / Detect Changes (pull_request) Has been cancelled
Details
CI / Deploy Agent (pull_request) Has been cancelled
Details
CI / Deploy Dashboard (pull_request) Has been cancelled
Details
CI / Deploy Docs (pull_request) Has been cancelled
Details
CI / Deploy MCP (pull_request) Has been cancelled
Details
CI / Check (pull_request) Has been cancelled
Details

Browse Source 
Gitea PATs can't be scoped to a single repo and the ephemeral Actions token
can't clone a private git dependency (verified: "Repository not found" even with
Collaborative Owners + the actions/checkout extraheader form). A read-only Deploy
Key is per-repo least privilege: load it from the TRAMITON_DEPLOY_KEY secret and
let cargo fetch tramiton over SSH (dep URL is already ssh://…:22222).

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Sharang Parnerkar
2026-07-10 16:13:02 +02:00
co-authored by Claude Fable 5
parent 03e39a883d
commit 5f59635bf8
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+14 -10
View File
@@ -50,19 +50,23 @@ jobs:
RUSTC_WRAPPER: ""
# compliance-agent has a git dependency on tramiton-core (a private repo on
# this Gitea instance). Rewrite its SSH URL to HTTPS and authenticate with
# the ephemeral Actions token using the same Basic-auth extraheader form
# that actions/checkout uses (username `x-access-token`) — no PAT needed,
# provided sharang/tramiton grants this repo access via Collaborative Owners
# (tramiton → Settings → Actions).
- name: Configure git auth for private tramiton dependency
# this Gitea instance). The ephemeral Actions token can NOT clone it even
# with a Collaborative Owner grant (that only covers `uses:` actions), and
# Gitea PATs can't be scoped to a single repo. So use a read-only Deploy
# Key (per-repo): add the public key to sharang/tramiton → Settings →
# Deploy Keys (read-only), and the matching private key as this repo's
# TRAMITON_DEPLOY_KEY secret. cargo fetches the dep over SSH using it.
- name: Configure SSH deploy key for private tramiton dependency
env:
GITEA_ACTIONS_TOKEN: ${{ github.token }}
TRAMITON_DEPLOY_KEY: ${{ secrets.TRAMITON_DEPLOY_KEY }}
RUSTC_WRAPPER: ""
run: |
AUTH=$(printf 'x-access-token:%s' "$GITEA_ACTIONS_TOKEN" | base64 -w0)
git config --global http."https://gitea.meghsakha.com/".extraheader "Authorization: Basic $AUTH"
git config --global url."https://gitea.meghsakha.com/".insteadOf "ssh://git@gitea.meghsakha.com:22222/"
apt-get update && apt-get install -y --no-install-recommends openssh-client
mkdir -p ~/.ssh && chmod 700 ~/.ssh
printf '%s\n' "$TRAMITON_DEPLOY_KEY" > ~/.ssh/tramiton_ci
chmod 600 ~/.ssh/tramiton_ci
printf 'Host gitea.meghsakha.com\n HostName gitea.meghsakha.com\n Port 22222\n User git\n IdentityFile ~/.ssh/tramiton_ci\n IdentitiesOnly yes\n StrictHostKeyChecking accept-new\n' > ~/.ssh/config
chmod 600 ~/.ssh/config
# Format (no compilation needed)
- name: Format