ci: 强化 SSH 密钥认证与诊断

.gitea/workflows/deploy.yml

@@ -1,7 +1,8 @@
 # Gitea Actions 工作流：构建 Docker 镜像并通过 SSH 触发部署
 # 前置：
 #   1. Gitea Runner 已开放 Docker 访问（挂载 /var/run/docker.sock 到容器内）
-#   2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文）
+#   2. 仓库 Secret 中已添加 SSH_PRIVATE_KEY（内容为部署机私钥全文，含 BEGIN/END 行）
+#   3. 私钥对应的公钥已加入部署机 ~/.ssh/authorized_keys
 name: build-and-deploy
 
 on:
@@ -38,17 +39,32 @@ jobs:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
           mkdir -p ~/.ssh
-          printf "%s\n" "${SSH_PRIVATE_KEY}" > ~/.ssh/deploy_key
+          # 写入并去除可能被 secret 引入的 CR，避免 openssh 解析失败
+          printf '%s\n' "${SSH_PRIVATE_KEY}" | tr -d '\r' > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
           ssh-keyscan -H "${DEPLOY_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
+          # 诊断：不打印私钥内容，只打印结构，便于定位 secret 是否损坏
+          echo "---私钥文件行数与首末行（不含中间敏感内容）---"
+          wc -l ~/.ssh/deploy_key
+          head -n 1 ~/.ssh/deploy_key
+          tail -n 1 ~/.ssh/deploy_key
+          # 通过 ssh-keygen 校验私钥合法性并派生公钥指纹
+          ssh-keygen -y -f ~/.ssh/deploy_key > ~/.ssh/deploy_key.pub
+          echo "---派生公钥指纹（把公钥追加到部署机 authorized_keys）---"
+          ssh-keygen -l -f ~/.ssh/deploy_key.pub
+          echo "---派生公钥内容（可直接 append 到部署机 ~/.ssh/authorized_keys）---"
+          cat ~/.ssh/deploy_key.pub
 
       - name: 上传 start.sh 到部署目录
         run: |
-          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
-          scp -i ~/.ssh/deploy_key deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
-          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
+          # 强制仅用密钥认证 + 详细日志，password 认证禁用后仍失败会直接抛错
+          SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
+          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "mkdir -p ${DEPLOY_DIR}"
+          scp $SSH_OPTS deploy/start.sh "${DEPLOY_USER}@${DEPLOY_HOST}:${DEPLOY_DIR}/start.sh"
+          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" "chmod +x ${DEPLOY_DIR}/start.sh"
 
       - name: 远程执行部署
         run: |
-          ssh -i ~/.ssh/deploy_key "${DEPLOY_USER}@${DEPLOY_HOST}" \
+          SSH_OPTS='-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o PreferredAuthentications=publickey -o BatchMode=yes'
+          ssh $SSH_OPTS "${DEPLOY_USER}@${DEPLOY_HOST}" \
             "IMAGE_TAG=${{ steps.meta.outputs.tag }} ${DEPLOY_DIR}/start.sh"