From 7b4dc69241aceeaa100e2e1436d12b52fa43ebd8 Mon Sep 17 00:00:00 2001
From: Ryan Kegel <ryan.kegel@gmail.com>
Date: Wed, 21 Oct 2026 15:23:41 -0400
Subject: [PATCH] feat: add validation for production SSH credentials in
 deployment workflow

---
 .gitea/workflows/promote-master.yaml | 36 ++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/.gitea/workflows/promote-master.yaml b/.gitea/workflows/promote-master.yaml
index d367e87..8db6f94 100644
--- a/.gitea/workflows/promote-master.yaml
+++ b/.gitea/workflows/promote-master.yaml
@@ -191,12 +191,48 @@ jobs:
             exit 1
           fi
 
+      - name: Validate production SSH credentials
+        env:
+          DEPLOY_PROD_HOST: ${{ secrets.DEPLOY_PROD_HOST }}
+          DEPLOY_PROD_USER: ${{ secrets.DEPLOY_PROD_USER }}
+          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          PROD_SSH_KEY_PASSPHRASE: ${{ secrets.PROD_SSH_KEY_PASSPHRASE }}
+        run: |
+          set -eu
+
+          if [ -z "$DEPLOY_PROD_HOST" ]; then
+            echo "DEPLOY_PROD_HOST secret is required."
+            exit 1
+          fi
+          if [ -z "$DEPLOY_PROD_USER" ]; then
+            echo "DEPLOY_PROD_USER secret is required."
+            exit 1
+          fi
+          if [ -z "$PROD_SSH_PRIVATE_KEY" ]; then
+            echo "PROD_SSH_PRIVATE_KEY secret is required."
+            exit 1
+          fi
+
+          key_file=$(mktemp)
+          public_key_file=$(mktemp)
+          trap 'rm -f "$key_file" "$public_key_file"' EXIT
+          printf '%s\n' "$PROD_SSH_PRIVATE_KEY" > "$key_file"
+          chmod 600 "$key_file"
+          if ! ssh-keygen -y -P "$PROD_SSH_KEY_PASSPHRASE" -f "$key_file" > "$public_key_file"; then
+            echo "PROD_SSH_PRIVATE_KEY could not be read; check its format and PROD_SSH_KEY_PASSPHRASE."
+            exit 1
+          fi
+
+          echo "Production deploy key fingerprint:"
+          ssh-keygen -lf "$public_key_file"
+
       - name: Deploy to production homeserver
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ secrets.DEPLOY_PROD_HOST }}
           username: ${{ secrets.DEPLOY_PROD_USER }}
           key: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          passphrase: ${{ secrets.PROD_SSH_KEY_PASSPHRASE }}
           port: 22
           script: |
             set -euo pipefail