From e0a89906e621c052c9533da8559e5837f4e51875 Mon Sep 17 00:00:00 2001
From: Viet Anh Nguyen <vietanh.dev@gmail.com>
Date: Mon, 20 Jul 2026 14:16:36 +0700
Subject: [PATCH] fix(aur): make host-key setup deterministic and diagnosable

The AUR push failed with

  Cloning into '/tmp/aur-repo'...
  Host key verification failed.

Publishing to the AUR is a git push over SSH, so aur.archlinux.org's host
key must be in known_hosts before git will connect. The step already ran
ssh-keyscan, but with 2>/dev/null -- and ssh-keyscan can return NOTHING
while still exiting 0, so an empty result passed silently and surfaced
three lines later as an error about the host key rather than about the
scan.

Now asserts the scan produced something and prints the count, so an empty
result fails at the point it happens with a message naming the cause.

Also drops ~/.ssh and the ssh config file in favour of absolute paths and
an explicit GIT_SSH_COMMAND. The shell and the ssh that git spawns each
resolve ~ from HOME independently, and in a container that is one more
thing that can quietly differ -- another way to arrive at exactly this
error while the host key was never the problem. IdentitiesOnly stops ssh
offering some other key and being rejected before it reaches ours.
---
 .github/workflows/publish-aur.yml | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/publish-aur.yml b/.github/workflows/publish-aur.yml
index 577fb33..7a93bd9 100644
--- a/.github/workflows/publish-aur.yml
+++ b/.github/workflows/publish-aur.yml
@@ -95,11 +95,32 @@ jobs:
             exit 1
           fi
 
-          install -d -m 700 ~/.ssh
-          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > ~/.ssh/aur
-          chmod 600 ~/.ssh/aur
-          ssh-keyscan aur.archlinux.org >> ~/.ssh/known_hosts 2>/dev/null
-          printf 'Host aur.archlinux.org\n  IdentityFile ~/.ssh/aur\n  User aur\n' > ~/.ssh/config
+          # Absolute paths and an explicit GIT_SSH_COMMAND, rather than ~/.ssh
+          # plus a config file. The shell and the ssh that git spawns each
+          # resolve ~ from HOME independently, and in a container that is one
+          # more thing that can silently differ -- the failure then arrives as
+          # "Host key verification failed", which points at the host key rather
+          # than at path resolution.
+          key=/tmp/aur_id
+          hosts=/tmp/aur_known_hosts
+          printf '%s\n' "$AUR_SSH_PRIVATE_KEY" > "$key"
+          chmod 600 "$key"
+
+          # AUR is reached over SSH, so its host key has to be known before git
+          # will connect. ssh-keyscan can return NOTHING and still exit 0, and
+          # the previous 2>/dev/null hid why -- so assert the result instead of
+          # assuming it.
+          ssh-keyscan -t rsa,ecdsa,ed25519 aur.archlinux.org > "$hosts" 2>/tmp/keyscan.err || true
+          if [ ! -s "$hosts" ]; then
+            echo "::error::ssh-keyscan returned no host keys for aur.archlinux.org - cannot verify the host to push to"
+            cat /tmp/keyscan.err >&2 || true
+            exit 1
+          fi
+          echo "host keys fetched: $(wc -l < "$hosts")"
+
+          # IdentitiesOnly stops ssh offering any other key it happens to find
+          # and being rejected before it reaches this one.
+          export GIT_SSH_COMMAND="ssh -i ${key} -o IdentitiesOnly=yes -o UserKnownHostsFile=${hosts} -o StrictHostKeyChecking=yes"
 
           git config --global user.name "Viet Anh Nguyen"
           git config --global user.email "vietanh.dev@gmail.com"