-
Notifications
You must be signed in to change notification settings - Fork 0
49 lines (45 loc) · 1.53 KB
/
deploy.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
name: "Deploy Dotfiles"
on:
workflow_dispatch:
push:
branches:
- master
paths-ignore:
- '.github/**'
- 'Deprecated/**'
- 'PKGBUILD/**'
- 'Submodules/**'
jobs:
deploy:
runs-on: ubuntu-latest
strategy:
matrix:
host: [herd, fridge, toaster]
steps:
- name: Configure SSH
run: |
mkdir -p ~/.ssh
echo "${{ secrets.BOT_SSH_KEY }}" > ~/.ssh/id_ed25519
chmod 400 ~/.ssh/id_ed25519
echo "${{ secrets.BOT_SSH_CERT }}" > ~/.ssh/id_ed25519-cert.pub
chmod 400 ~/.ssh/id_ed25519-cert.pub
echo "@cert-authority *.heyi7086.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICETRx1nrSVwLdwod4KaDIZYVf6La97GjbwMSza6/Put" > ~/.ssh/known_hosts
chmod 400 ~/.ssh/known_hosts
- name: Deploy Dotfiles
run: |
ssh \
-o User=he \
-i ~/.ssh/id_ed25519 \
-o CertificateFile=~/.ssh/id_ed25519-cert.pub \
-o Ciphers=aes256-gcm@openssh.com \
-o MACs=hmac-sha2-512-etm@openssh.com \
-o KexAlgorithms=sntrup761x25519-sha512@openssh.com \
-o HostKeyAlgorithms=ssh-ed25519-cert-v01@openssh.com \
-o PubkeyAcceptedAlgorithms=ssh-ed25519-cert-v01@openssh.com,ssh-ed25519 \
-o CASignatureAlgorithms=ssh-ed25519 \
-o StrictHostKeyChecking=yes \
-o ControlMaster=no \
"${{ matrix.host }}.heyi7086.com"
- name: Clear SSH Credential
run: rm -rf ~/.ssh
if: ${{ always() }}