Host key verification

[x-yuri]

Doesn't it make sense to add ability to add host keys to ~/.ssh/known_hosts? From what I can see the alternative solution allows this. And you add GitHub host keys to the file anyway.

A workaround:

    - name: Add the host key
      run: |
        line='example.com,xx.xxx.xx.xxx ssh-rsa AAAA...kMIR'
        echo "$line" >> ~/.ssh/known_hosts

[mpdude]

I would really like to keep this action focused and the scope narrow; and since adding the key is a one-liner (as you suggested), I don't see much added value in having it supported in the action.

Regarding the GH Host Key, you're right that this is a special case. I thought it would help a lot of people since in the beginning, the worker nodes did not come with this key by default. GitHub has changed this in the meantime, but I never though about when/how to best drop this particular key.

If you thought about bringing along some more host keys in the action (i. e. not as user-provided keys), please understand that I would neither have a good policy how to select them (GitHub? BitBucket? GitLab? What else, what not?) and/or to make sure the keys are and will stay up to date and correct.

Does that make sense?

[x-yuri]

Sure. I just saw a number of people in the issues seemingly doing suboptimal things. And actually I believe that adding support would, say, bring the score down. Because people wouldn't have to think about what to do with host key verification.

About autoadding BitBucket, GitLab, you-name-it keys, I didn't mean exactly that. In your place I would probably not autoadd them automatically, I'd let the users decide, like:

            - uses: webfactory/ssh-agent@v0.5.2
              with:
                  ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
                  host-keys:
                    - GitHub
                    - GitLab
                    - BitBucket
                    - 'example.com,xx.xxx.xx.xxx ssh-rsa AAAA...kMIR some-name'

Similar to what the nodemailer guys did. Or that all indeed might be extracted into a separate action.

But again. Feel free to close the issue. But in that case I'd probably add more specific instructions to the readme (examples). One for third-party servers. In this case one should probably rely only on domains. And for in-house ones. In this case I think it makes sense to provide an ip as well.

[mpdude]

I'd be glad if you could open a PR to add some remarks regarding Host Keys in the README.

I will be unable to maintain (and guarantee accuracy) for pre-defined host keys in this action, and so something like what you suggested in your example config above seems unfeasible for me.

Again, thank you for your understanding, and looking forward to your PR!