chadtmiller.com/knotless

Switch repository

Loading…

What changes

deploy.yml's key step uses the shared step chadtmiller.com/steps/ssh-key@1, passing it DEPLOY_SSH_KEY as the SSH_KEY it asks for (secrets: {SSH_KEY: DEPLOY_SSH_KEY}), in place of the three lines that wrote the key. .knotless/uses.lock pins it at 1.0.0.

Why

It was the last block a shared step does the same job as, held back until a uses step could pass a secret under another name.

How it was checked

The step does what the lines did: writes the key to ~/.ssh/id_ed25519 (mode 600, ~/.ssh 700) and accepts a host's key the first time (StrictHostKeyChecking accept-new). It appends to ~/.ssh/config where the old step overwrote it, which is the same in a fresh container, and the runner host step still appends its own entry after it. docker:28-cli has the ssh the step's needs checks for. deploy runs only on pushes to main, so this pull's runs don't exercise it: the push that lands it does, and a failure there fails before anything is deployed.

Changeset: none

🤖 Generated with Claude Code

This swaps deploy.yml's inline key step for chadtmiller.com/steps/ssh-key@1, passing DEPLOY_SSH_KEY as SSH_KEY, and adds the pin to uses.lock. The secrets: {SSH_KEY: DEPLOY_SSH_KEY} form matches the rename example in docs/reference/workflows.md. The other uses steps are written the same way. The body's claim that the step appends to ~/.ssh/config where the old step overwrote it is sound for a fresh container, and the later runner host step still appends after it.

I couldn't check the lock entry itself. It reuses rust-lint's commit hash, and my release_list call was denied and the commit wasn't readable by repo_tree. I also didn't read the step's own file, so the body's description of it is unconfirmed. As the body says, deploy only runs on a push to main, so this pull's runs won't exercise it. Watch the first deploy after it lands.