From 71f752c46eb58c4f2071d93398ca00dd4e30bc8c Mon Sep 17 00:00:00 2001
From: SW <janvete@gmail.com>
Date: Thu, 10 Sep 2026 11:27:04 +0200
Subject: [PATCH] ci: use SSH key for tap and apt push

---
 .forgejo/workflows/release.yml | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 77ada8e..9d764ed 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -12,16 +12,28 @@ jobs:
       image: golang:1.27
 
     steps:
-      - name: Install packaging tools
+      - name: Install tools
         run: |
           apt-get update
-          apt-get install -y dpkg-dev git curl
+          apt-get install -y dpkg-dev git curl openssh-client
+
+      - name: Setup SSH
+        env:
+          FORGEJO_SSH_KEY: ${{ secrets.FORGEJO_SSH_KEY }}
+        run: |
+          mkdir -p ~/.ssh
+          printf '%s\n' "${FORGEJO_SSH_KEY}" > ~/.ssh/forgejo_runner
+          chmod 600 ~/.ssh/forgejo_runner
+          # Accept Forgejo SSH host key without prompting.
+          ssh-keyscan -p 554 git-ssh.janvete.com >> ~/.ssh/known_hosts 2>/dev/null || \
+            ssh-keyscan git-ssh.janvete.com >> ~/.ssh/known_hosts 2>/dev/null || true
+          echo "GIT_SSH_COMMAND=ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts" >> "$GITHUB_ENV"
 
       - name: Checkout source
         env:
-          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          GIT_SSH_COMMAND: ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts
         run: |
-          git clone "https://seth:${FORGEJO_TOKEN}@git.janvete.com/seth/Caddyview.git" src
+          git clone ssh://git@git-ssh.janvete.com:554/seth/Caddyview.git src
           cd src
           git checkout "${{ github.ref_name }}"
 
@@ -114,7 +126,7 @@ jobs:
       - name: Update Homebrew tap
         working-directory: src
         env:
-          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          GIT_SSH_COMMAND: ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts
         run: |
           VERSION=${{ github.ref_name }}
           VER=${VERSION#v}
@@ -122,7 +134,7 @@ jobs:
           SHA_AMD64=$(sha256sum dist/caddyview-${VERSION}-darwin-amd64.tar.gz | awk '{print $1}')
           SHA_LINUX=$(sha256sum dist/caddyview-${VERSION}-linux-amd64.tar.gz  | awk '{print $1}')
 
-          git clone "https://seth:${FORGEJO_TOKEN}@git.janvete.com/seth/homebrew-tools.git" tap
+          git clone ssh://git@git-ssh.janvete.com:554/seth/homebrew-tools.git tap
 
           cat > tap/Formula/caddyview.rb << FORMULA
           class Caddyview < Formula
@@ -168,12 +180,12 @@ jobs:
       - name: Update APT repository
         working-directory: src
         env:
-          FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
+          GIT_SSH_COMMAND: ssh -i ~/.ssh/forgejo_runner -o StrictHostKeyChecking=no -o UserKnownHostsFile=~/.ssh/known_hosts
         run: |
           VERSION=${{ github.ref_name }}
           VER=${VERSION#v}
 
-          git clone "https://seth:${FORGEJO_TOKEN}@git.janvete.com/seth/apt.git" apt-repo
+          git clone ssh://git@git-ssh.janvete.com:554/seth/apt.git apt-repo
           cp "dist/caddyview_${VER}_amd64.deb" apt-repo/
 
           cd apt-repo