Duy /zuey/ 74930a1625 fix(ci): base64-encode zuey SSH key secret to dodge libcrypto error (#79) ...

* fix(ci): base64-encode zuey SSH key secret to dodge libcrypto error

First real deploy_zuey_beta run failed at the new 'Sync zuey ops scripts
to VPS' step with 'Load key: error in libcrypto' / Permission denied,
because GitHub Secrets storage normalized newlines inside the multi-line
PEM block.

Switch the secret to ZUEY_SSH_PRIVATE_KEY_B64 (single-line base64) and
base64 -d it on the runner. Single-line storage is immune to whitespace
mangling. Add a ssh-keygen -y -f pre-flight check that fails fast with
a clear remediation message if either the base64 or the decoded key is
malformed.

Refs: workflow run 26499549166

* fix(ci): create SSH key at 0600 from birth via umask 077

Defense-in-depth from review of PR #79: wrap the base64-decode pipeline
in a subshell that sets umask 077 so the decoded private key file is
created at 0600 directly, instead of relying on a chmod 0600 after the
fact (which left a brief 0644 window).

2026-05-27 17:59:08 +07:00

..

pr-assets

feat(codex-pool,create_image): collapse primary_first + route pools through create_image chain (#1006)

2026-04-24 00:16:14 +07:00

workflows

fix(ci): base64-encode zuey SSH key secret to dodge libcrypto error (#79)

2026-05-27 17:59:08 +07:00

pull_request_template.md

chore: stabilize main branch with dev workflow + PR guidelines

2026-04-02 12:36:30 +07:00