From 28e8c8c375be6cee14b8704d4eb49a175fc9345e Mon Sep 17 00:00:00 2001
From: LaurensBartelds <laurensbartelds@protonmail.com>
Date: Fri, 24 Apr 2026 09:27:55 +0200
Subject: [PATCH] fix: harden deploy workflow (if guard, wget --fail, pip
 ansible, secret cleanup)

---
 .gitea/workflows/deploy.yml | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index a8204c2..fa7287b 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -9,22 +9,23 @@ on:
 jobs:
   deploy:
     runs-on: ubuntu-latest
-    if: github.event.workflow_run.conclusion == 'success'
+    timeout-minutes: 15
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: Checkout Code
         uses: actions/checkout@v4
 
       - name: Install Ansible
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y ansible
+        run: pip3 install --quiet "ansible>=9,<11"
 
       - name: Write SSH Key
         run: |
-          echo "${{ secrets.ANSIBLE_SSH_KEY }}" > /tmp/ansible_key
+          printf '%s\n' "${{ secrets.ANSIBLE_SSH_KEY }}" > /tmp/ansible_key
           chmod 600 /tmp/ansible_key
 
       - name: Write Inventory
+        # StrictHostKeyChecking=no is intentional for a known home-network host.
+        # To harden, add the host fingerprint as a secret and use a known_hosts file.
         run: |
           printf '[orangepi]\norangepi ansible_host=%s ansible_user=%s ansible_ssh_private_key_file=/tmp/ansible_key ansible_ssh_common_args="-o StrictHostKeyChecking=no"\n' \
             "${{ secrets.ANSIBLE_HOST }}" \
@@ -34,15 +35,19 @@ jobs:
         run: |
           TAG="${{ github.event.workflow_run.head_branch }}"
           BASE_URL="${{ github.server_url }}/${{ github.repository }}/releases/download/${TAG}"
-          wget -q "${BASE_URL}/brainwave-arm64.tar.gz"
-          wget -q "${BASE_URL}/docker-compose.arm64.yml"
+          wget --fail -q "${BASE_URL}/brainwave-arm64.tar.gz" || { echo "Failed to download ARM tarball from ${BASE_URL}"; exit 1; }
+          wget --fail -q "${BASE_URL}/docker-compose.arm64.yml" || { echo "Failed to download docker-compose file from ${BASE_URL}"; exit 1; }
 
       - name: Deploy via Ansible
+        env:
+          WORKSPACE: ${{ github.workspace }}
         run: |
           ansible-playbook ansible/deploy.yml \
             -i /tmp/inventory.ini \
-            -e "artifact_path=${{ github.workspace }}"
+            -e "artifact_path=${WORKSPACE}"
 
-      - name: Cleanup SSH Key
+      - name: Cleanup Secrets
         if: always()
-        run: rm -f /tmp/ansible_key
+        run: |
+          rm -f /tmp/ansible_key
+          rm -f /tmp/inventory.ini