From b088ab1689716ca2419d0497bb1d55ef23051457 Mon Sep 17 00:00:00 2001
From: cheney <cheney@honor3.com>
Date: Thu, 16 Jul 2026 13:42:50 +0800
Subject: [PATCH] =?UTF-8?q?ci:=20=E5=BC=BA=E5=8C=96=20SSH=20=E5=AF=86?=
 =?UTF-8?q?=E9=92=A5=E8=AE=A4=E8=AF=81=E4=B8=8E=E8=AF=8A=E6=96=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitea/workflows/deploy.yml | 28 ++++++++++++++++++++++------
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/.gitea/workflows/deploy.yml b/.gitea/workflows/deploy.yml
index fc4d294..1c9b4d2 100644
--- a/.gitea/workflows/deploy.yml
+++ b/.gitea/workflows/deploy.yml
@@ -1,7 +1,8 @@
 # Gitea Actions 工作流：构建 Docker 镜像并通过 SSH 触发部署
 # 前置：
 #   1. Gitea Runner 已开放 Docker 访问（挂载 /var/run/docker.sock 到容器内）
-#   2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文）
+#   2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文，含 BEGIN/END 行）
+#   3. 私钥对应的公钥已加入部署机 ~/.ssh/authorized_keys
 name: build-and-deploy
 
 on:
@@ -38,17 +39,32 @@ jobs:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf "%s\n" "${SSH_PRIVATE_KEY}" > ~/.ssh/deploy_key
+          # 写入并去除可能被 secret 引入的 CR，避免 openssh 解析失败
+          printf '%s\n' "${SSH_PRIVATE_KEY}" | tr -d '\r' > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+          # 诊断：不打印私钥内容，只打印结构，便于定位 secret 是否损坏
+          echo "---私钥文件行数与首末行（不含中间敏感内容）---"
+          wc -l ~/.ssh/deploy_key
+          head -n 1 ~/.ssh/deploy_key
+          tail -n 1 ~/.ssh/deploy_key
+          # 通过 ssh-keygen 校验私钥合法性并派生公钥指纹
+          ssh-keygen -y -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub
+          echo "---派生公钥指纹（把公钥追加到部署机 authorized_keys）---"
+          ssh-keygen -l -f ~/.ssh/deploy_key.pub
+          echo "---派生公钥内容（可直接 append 到部署机 ~/.ssh/authorized_keys）---"
+          cat ~/.ssh/deploy_key.pub
 
       - name: 上传 start.sh 到部署目录
         run: |
-          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
-          scp -i ~/.ssh/deploy_key deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
-          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
+          # 强制仅用密钥认证 + 详细日志，password 认证禁用后仍失败会直接抛错
+          SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
+          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
+          scp $SSH_OPTS deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
+          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
 
       - name: 远程执行部署
         run: |
-          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" \
+          SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
+          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" \
             "IMAGE_TAG=${{ steps.meta.outputs.tag }} ${DEPLOY_DIR}/start.sh"
\ No newline at end of file