From 9539e3d740ee49f233413f96f3c88b7542e63b3d Mon Sep 17 00:00:00 2001
From: LaurensBartelds <laurensbartelds@protonmail.com>
Date: Fri, 24 Apr 2026 22:35:45 +0200
Subject: [PATCH] feat: refactor SSH key handling in deploy workflow to use
 ssh-agent

---
 .gitea/workflows/deploy.yml | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index e495a7c..e6dbf4c 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -18,17 +18,19 @@ jobs:
       - name: Install Ansible
         run: pip3 install --quiet --break-system-packages "ansible>=9,<11"
 
-      - name: Write SSH Key
+      - name: Setup SSH Agent
         run: |
-          printf '%s' "${{ secrets.ANSIBLE_SSH_KEY }}" | tr -d '\r\n' | base64 -d > /tmp/ansible_key
-          chmod 600 /tmp/ansible_key
-          ssh-keygen -l -f /tmp/ansible_key
+          eval "$(ssh-agent -s)"
+          printf '%s' "${{ secrets.ANSIBLE_SSH_KEY }}" | tr -d '\r\n' | base64 -d | ssh-add -
+          ssh-add -l
+          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
+          echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> "$GITHUB_ENV"
 
       - name: Write Inventory
         # StrictHostKeyChecking=no is intentional for a known home-network host.
         # To harden, add the host fingerprint as a secret and use a known_hosts file.
         run: |
-          printf '[orangepi]\norangepi ansible_host=%s ansible_user=%s ansible_ssh_private_key_file=/tmp/ansible_key ansible_ssh_common_args="-o StrictHostKeyChecking=no"\n' \
+          printf '[orangepi]\norangepi ansible_host=%s ansible_user=%s ansible_ssh_common_args="-o StrictHostKeyChecking=no -o ForwardAgent=yes"\n' \
             "${{ secrets.ANSIBLE_HOST }}" \
             "${{ secrets.ANSIBLE_USER }}" > /tmp/inventory.ini
 
@@ -55,8 +57,8 @@ jobs:
             -i /tmp/inventory.ini \
             -e "artifact_path=${WORKSPACE}"
 
-      - name: Cleanup Secrets
+      - name: Cleanup
         if: always()
         run: |
-          rm -f /tmp/ansible_key
+          ssh-agent -k || true
           rm -f /tmp/inventory.ini