webfactory / ssh-agent

GitHub Action to setup `ssh-agent` with a private key
MIT License
1.22k stars 253 forks source link

Keys not properly loaded when calling the action multiple times #190

Open MaximeLaurenty opened 1 year ago

MaximeLaurenty commented 1 year ago

Hello,

I stumbled upon an edge case where using webfactory/ssh-agent multiple times within a job didn't make all keys available as I would have expected it.

When I am doing:

    - name: Setup ssh-agent 1
      uses: webfactory/ssh-agent@v0.7.0
      with:
        ssh-private-key: |
          ${{ fromJSON(inputs.secrets).SECOND_SSH_PRIVATE_KEY }}
...
    - name: Setup ssh-agent 2
      uses: webfactory/ssh-agent@v0.7.0
      with:
        ssh-private-key: |
          ${{ fromJSON(inputs.secrets).FIRST_SSH_PRIVATE_KEY }}
          ${{ fromJSON(inputs.secrets).SECOND_SSH_PRIVATE_KEY }}
...
    - name: Use keys
       run: poetry install # this uses git+ssh under the hood, using the private keys set above

Despite the output of Setup ssh-agent 2 being

Adding private key(s) to agent
Identity added: (stdin) (git@github.com:***/repo1.git)
Identity added: (stdin) (git@github.com:***/repo2.git)
Key(s) added:
256 SHA256:xxxxxxxxxx git@github.com:***/repo1.git (ED25519)
256 SHA256:yyyyyyyyyy git@github.com:***/repo2.git (ED25519)
Configuring deployment key(s)
Added deploy-key mapping: Use identity '/home/runner/.ssh/key-cad66b7e90275a9d9d6183dc407526afb0bd53566443057adc3797d640c905bb' for GitHub repository ***/repo1
Added deploy-key mapping: Use identity '/home/runner/.ssh/key-eb5f0a6cae7f6b166315c50bc24631453bd5f20e6eaa07ccd1313aa8392cc127' for GitHub repository ***/repo2

The keys can't be used in "Use keys", as this error shows:

  Load key "/home/runner/.ssh/key-cad66b7e90275a9d9d6183dc407526afb0bd53566443057adc3797d640c905bb": error in libcrypto
  git@github.com: Permission denied (publickey).

We fixed it by calling ssh-agent only once and with all private keys (which is cleaner anyway) but I didn't expect this behaviour. If this is a feature and not a bug, feel free to close the issue!