actions/checkout only has github in ssh-known-hosts #1971

rimas commented 2025年06月01日 21:55:05 +02:00

Comment

When using Codeberg Actions, the actions/checkout action allows cloning a different repository than the one that has triggered the workflow, however, if you want to push new commits to that different repository, you have to clone it over SSH, and currently, that requires to either set the ssh-strict parameter to false, or to be manually populate the ssh-known-hosts value with the result of ssh-keyscan codeberg.org. At the same time, per documentation, GitHub keys are already known by default.

I wonder if it's possible to add Codeberg keys in addition to GItHub ones to the default set.

I thought I'd report this issue to the actions/checkout repository, but apparently, it's just a mirror of the equivalent repo on GItHub, and I doubt GItHub would be interested in adding our SSH keys. But I think it should be controllable without modifying the actions/checkout source, since it only references GitHub keys in the docs, but doesn't seem to be doing anything special to default to them.

### Comment When using Codeberg Actions, the [`actions/checkout`](https://code.forgejo.org/actions/checkout) action allows cloning a different repository than the one that has triggered the workflow, however, if you want to push new commits to that different repository, you have to clone it over SSH, and currently, that requires to either set the `ssh-strict` parameter to `false`, or to be manually populate the `ssh-known-hosts` value with the result of `ssh-keyscan codeberg.org`. At the same time, per documentation, GitHub keys are already known by default. I wonder if it's possible to add Codeberg keys in addition to GItHub ones to the default set. I thought I'd report this issue to the [`actions/checkout`](https://code.forgejo.org/actions/checkout) repository, but apparently, it's just a mirror of the equivalent repo on GItHub, and I doubt GItHub would be interested in adding our SSH keys. But I think it should be controllable without modifying the `actions/checkout` source, since it only references GitHub keys in the docs, but doesn't seem to be doing anything special to default to them.

Gusted commented 2025年06月06日 15:11:16 +02:00

It is hardcoded in the action actions/checkout@09d2acae67/src/git-auth-helper.ts (L250). I don't think Codeberg can do much to change or inject our own SSH host key (and if it was possible, it would be a security concern if that was possible).

It is hardcoded in the action https://code.forgejo.org/actions/checkout/src/commit/09d2acae674a48949e3602304ab46fd20ae0c42f/src/git-auth-helper.ts#L250. I don't think Codeberg can do much to change or inject our own SSH host key (and if it was possible, it would be a security concern if that was possible).

rimas commented 2025年06月08日 10:11:56 +02:00

Perhaps a solution would be maintain a synced fork of the action instead of just mirroring it?

Perhaps a solution would be maintain a synced fork of the action instead of just mirroring it?

Gusted commented 2025年06月09日 00:14:31 +02:00

We don't have the capacity to maintain such a fork, neither really want to. The actions on code.forgejo.org is served via different infrastructure maintained by the Forgejo team, it has better uptime and capacity to deal with serving actions at the moment.

We don't have the capacity to maintain such a fork, neither really want to. The actions on code.forgejo.org is served via different infrastructure maintained by the Forgejo team, it has better uptime and capacity to deal with serving actions at the moment.

fnetX commented 2025年06月10日 00:19:38 +02:00

I'll try to keep this in mind, but it will definitely take a while. It might need changes to the Forgejo Actions ecosystem at a whole to allow this, e.g. by somehow obtaining the data from the server to ensure it always works with the server the runner is connected to.

I'll try to keep this in mind, but it will definitely take a while. It might need changes to the Forgejo Actions ecosystem at a whole to allow this, e.g. by somehow obtaining the data from the server to ensure it always works with the server the runner is connected to.

rimas commented 2025年06月10日 07:12:42 +02:00

I initially though that maybe this could be preconfigurable via environment, but seeing that the keys are committed into the code, I think forking the repo and just adding Codeberg's keys might be the best option.

For one, it would ensure that the default known keys are actually known in advance and auditable, which is good for security.

And maintenance-wise, I don't think it would be too much to handle, especially now that the parent repo is effectively dormant (see its latest commit).

I initially though that maybe this could be preconfigurable via environment, but seeing that the keys are committed into the code, I think forking the repo and just adding Codeberg's keys might be the best option. For one, it would ensure that the default known keys are actually known in advance and auditable, which is good for security. And maintenance-wise, I don't think it would be too much to handle, especially now that the parent repo is effectively dormant (see [its latest commit](https://code.forgejo.org/actions/checkout/commit/09d2acae674a48949e3602304ab46fd20ae0c42f)).