feat: refactor SSH key handling in deploy workflow to use ssh-agent

.gitea/workflows/deploy.yml

@@ -18,17 +18,19 @@ jobs:
       - name: Install Ansible
         run: pip3 install --quiet --break-system-packages "ansible>=9,<11"
 
-      - name: Write SSH Key
+      - name: Setup SSH Agent
         run: |
-          printf '%s' "${{ secrets.ANSIBLE_SSH_KEY }}" | tr -d '\r\n' | base64 -d > /tmp/ansible_key
-          chmod 600 /tmp/ansible_key
-          ssh-keygen -l -f /tmp/ansible_key
+          eval "$(ssh-agent -s)"
+          printf '%s' "${{ secrets.ANSIBLE_SSH_KEY }}" | tr -d '\r\n' | base64 -d | ssh-add -
+          ssh-add -l
+          echo "SSH_AUTH_SOCK=$SSH_AUTH_SOCK" >> "$GITHUB_ENV"
+          echo "SSH_AGENT_PID=$SSH_AGENT_PID" >> "$GITHUB_ENV"
 
       - name: Write Inventory
         # StrictHostKeyChecking=no is intentional for a known home-network host.
         # To harden, add the host fingerprint as a secret and use a known_hosts file.
         run: |
-          printf '[orangepi]\norangepi ansible_host=%s ansible_user=%s ansible_ssh_private_key_file=/tmp/ansible_key ansible_ssh_common_args="-o StrictHostKeyChecking=no"\n' \
+          printf '[orangepi]\norangepi ansible_host=%s ansible_user=%s ansible_ssh_common_args="-o StrictHostKeyChecking=no -o ForwardAgent=yes"\n' \
             "${{ secrets.ANSIBLE_HOST }}" \
             "${{ secrets.ANSIBLE_USER }}" > /tmp/inventory.ini
 
@@ -55,8 +57,8 @@ jobs:
             -i /tmp/inventory.ini \
             -e "artifact_path=${WORKSPACE}"
 
-      - name: Cleanup Secrets
+      - name: Cleanup
         if: always()
         run: |
-          rm -f /tmp/ansible_key
+          ssh-agent -k || true
           rm -f /tmp/inventory.ini