Toilville/forge-kv-cache
Watch
5
0
Fork
You've already forked forge-kv-cache
 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

fix(ci): provision a read-only deploy key for the linux runner #4

Merged
peterswimm merged 1 commit from fix/ci-runner-permissions into main 2026-07-17 14:19:09 +00:00
Conversation 0 Commits 1 Files changed 1 +12 -2
peterswimm commented 2026-07-17 14:18:04 +00:00
Owner
Copy link

Follow-up to #3, now merged. After the known-hosts/CARGO_HOME/CARGO_NET_GIT_FETCH_WITH_CLI fixes, the linux runner's container hit one more real wall: git@git.toilville.dev: Permission denied (publickey) — that container has no SSH identity of its own.

FORGE_CI_DEPLOY_KEY is a fresh, dedicated ed25519 keypair generated for this purpose. The public half is registered as a read-only deploy key on both forge-kv-cache and mlx-rs-mirror; the private half is stored as a Forgejo Actions secret on this repo only. This PR writes it to a temp file at job start and points GIT_SSH_COMMAND at it.

Follow-up to #3, now merged. After the known-hosts/CARGO_HOME/CARGO_NET_GIT_FETCH_WITH_CLI fixes, the linux runner's container hit one more real wall: `git@git.toilville.dev: Permission denied (publickey)` — that container has no SSH identity of its own. `FORGE_CI_DEPLOY_KEY` is a fresh, dedicated ed25519 keypair generated for this purpose. The public half is registered as a read-only deploy key on both `forge-kv-cache` and `mlx-rs-mirror`; the private half is stored as a Forgejo Actions secret on this repo only. This PR writes it to a temp file at job start and points `GIT_SSH_COMMAND` at it.
fix(ci): provision a read-only deploy key for the linux runner
Some checks failed
CI / Core (default features, no MLX) (pull_request) Failing after 16s
Details
CI / MLX feature (macOS + Apple Silicon) (pull_request) Failing after 2s
Details
CI / lint-workflows (pull_request) Successful in 17s
Details
0d376a8bf7 
The linux runner's container has no SSH identity of its own for
git.toilville.dev (confirmed via the actual action logs: git@...:
Permission denied (publickey), after the earlier known-hosts/CARGO_HOME
fixes got past the previous two failure points).

FORGE_CI_DEPLOY_KEY is a fresh, dedicated ed25519 keypair generated
for this purpose — registered read-only on forge-kv-cache and
mlx-rs-mirror, stored as a Forgejo Actions secret on this repo only.
peterswimm deleted branch fix/ci-runner-permissions 2026-07-17 14:19:09 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
bug
Something is not working

  
duplicate
This issue or pull request already exists

  
enhancement
New feature

  
help wanted
Need some help

  
invalid
Something is wrong

  
question
More information is needed

  
wontfix
This won't be fixed

No labels
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Toilville/forge-kv-cache!4
No description provided.