feat: add validation for production SSH credentials in deployment workflow

.gitea/workflows/promote-master.yaml

@@ -191,12 +191,48 @@ jobs:
             exit 1
           fi
 
+      - name: Validate production SSH credentials
+        env:
+          DEPLOY_PROD_HOST: ${{ secrets.DEPLOY_PROD_HOST }}
+          DEPLOY_PROD_USER: ${{ secrets.DEPLOY_PROD_USER }}
+          PROD_SSH_PRIVATE_KEY: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          PROD_SSH_KEY_PASSPHRASE: ${{ secrets.PROD_SSH_KEY_PASSPHRASE }}
+        run: |
+          set -eu
+
+          if [ -z "$DEPLOY_PROD_HOST" ]; then
+            echo "DEPLOY_PROD_HOST secret is required."
+            exit 1
+          fi
+          if [ -z "$DEPLOY_PROD_USER" ]; then
+            echo "DEPLOY_PROD_USER secret is required."
+            exit 1
+          fi
+          if [ -z "$PROD_SSH_PRIVATE_KEY" ]; then
+            echo "PROD_SSH_PRIVATE_KEY secret is required."
+            exit 1
+          fi
+
+          key_file=$(mktemp)
+          public_key_file=$(mktemp)
+          trap 'rm -f "$key_file" "$public_key_file"' EXIT
+          printf '%s\n' "$PROD_SSH_PRIVATE_KEY" > "$key_file"
+          chmod 600 "$key_file"
+          if ! ssh-keygen -y -P "$PROD_SSH_KEY_PASSPHRASE" -f "$key_file" > "$public_key_file"; then
+            echo "PROD_SSH_PRIVATE_KEY could not be read; check its format and PROD_SSH_KEY_PASSPHRASE."
+            exit 1
+          fi
+
+          echo "Production deploy key fingerprint:"
+          ssh-keygen -lf "$public_key_file"
+
       - name: Deploy to production homeserver
         uses: appleboy/ssh-action@v1.0.3
         with:
           host: ${{ secrets.DEPLOY_PROD_HOST }}
           username: ${{ secrets.DEPLOY_PROD_USER }}
           key: ${{ secrets.PROD_SSH_PRIVATE_KEY }}
+          passphrase: ${{ secrets.PROD_SSH_KEY_PASSPHRASE }}
           port: 22
           script: |
             set -euo pipefail
@@ -317,6 +353,14 @@ jobs:
               exit 1
             fi
 
+            # Validate that MONGO_URI is present (falling back to previous .env if available)
+            if [ -z "${{ secrets.MONGO_URI }}" ]; then
+                echo "ERROR: MONGO_URI secret is missing or empty in Gitea repository secrets."
+                exit 1
+            else
+              echo "MONGO_URI successfully loaded from Gitea secrets."
+            fi
+
             cat > .env << EOF
             FRONTEND_URL=${{ secrets.PROD_FRONTEND_URL }}
             BACKEND_HOST_PORT=${{ secrets.PROD_BACKEND_HOST_PORT }}
@@ -330,6 +374,7 @@ jobs:
             ADMIN_PASSWORD=${{ secrets.PROD_ADMIN_PASSWORD }}
             ADMIN_FIRST_NAME=${{ secrets.PROD_ADMIN_FIRST_NAME }}
             ADMIN_LAST_NAME=${{ secrets.PROD_ADMIN_LAST_NAME }}
+            MONGO_URI=${{ secrets.MONGO_URI }}
             EOF
 
             chmod 600 .env .rollback-meta