feat: add validation for production SSH credentials in deployment workflow

.gitea/workflows/promote-master.yaml

@@ -191,12 +191,48 @@ jobs:
             exit 1
           fi
 
+      - name: Validate production SSH credentials
+        env:
+          DEPLOY_PROD_HOST: ${{ secrets.DEPLOY_PROD_HOST }}
+          DEPLOY_PROD_USER: ${{ secrets.DEPLOY_PROD_USER }}
+          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          PROD_SSH_KEY_PASSPHRASE: ${{ secrets.PROD_SSH_KEY_PASSPHRASE }}
+        run: |
+          set -eu
+
+          if [ -z "$DEPLOY_PROD_HOST" ]; then
+            echo "DEPLOY_PROD_HOST secret is required."
+            exit 1
+          fi
+          if [ -z "$DEPLOY_PROD_USER" ]; then
+            echo "DEPLOY_PROD_USER secret is required."
+            exit 1
+          fi
+          if [ -z "$PROD_SSH_PRIVATE_KEY" ]; then
+            echo "PROD_SSH_PRIVATE_KEY secret is required."
+            exit 1
+          fi
+
+          key_file=$(mktemp)
+          public_key_file=$(mktemp)
+          trap 'rm -f "$key_file" "$public_key_file"' EXIT
+          printf '%s\n' "$PROD_SSH_PRIVATE_KEY" > "$key_file"
+          chmod 600 "$key_file"
+          if ! ssh-keygen -y -P "$PROD_SSH_KEY_PASSPHRASE" -f "$key_file" > "$public_key_file"; then
+            echo "PROD_SSH_PRIVATE_KEY could not be read; check its format and PROD_SSH_KEY_PASSPHRASE."
+            exit 1
+          fi
+
+          echo "Production deploy key fingerprint:"
+          ssh-keygen -lf "$public_key_file"
+
       - name: Deploy to production homeserver
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ secrets.DEPLOY_PROD_HOST }}
           username: ${{ secrets.DEPLOY_PROD_USER }}
           key: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          passphrase: ${{ secrets.PROD_SSH_KEY_PASSPHRASE }}
           port: 22
           script: |
             set -euo pipefail