Support for accessing to private repositories using different methods

[Serafin-dev]

Description

For security reasons we would like to adopt deploy keys as our access method to private repositories.
The Picasso workflow uses this ssh-agent to make this possible. According to the ssh-agent here you can manage deploy keys.
I have not been able to make it work though. Not quite sure if this is the action not really supporting it. I checked everything was done as the documentation describes but still.

Also, @mariajgrimaldi could you please provide feedback about the tests you did for Github Apps? Thanks!

[mariajgrimaldi]

@Serafin-dev: Thanks for the report! I've tested this only with an SSH key associated with a service account, not with a deployment key, but technically, it shouldn't be that different. Have you tested the action in an isolated environment to confirm your theory? This issue opened a few days ago: webfactory/ssh-agent#232, which suggests the same as you did.

As for the github apps authentication method, I haven't tested the approach. Mainly because it needed modifications in tutor-contrib-picasso (here, specifically) to use tokens instead of assuming that an SSH agent is configured with the proper permissions. Or maybe there is another approach that allows the host to recognize the token instead of passing it in the gh URL, I'm not sure though.

[Serafin-dev]

@mariajgrimaldi thanks for your response.
I have not tested it in an isolated environment apart from the action.
Regarding tests on Github Apps, could you please leave a comment here when you have any update on tthis?

[MAAngamarca]

Hi @mariajgrimaldi , to reopen this issue, following the documentation from: webfactory/ssh-agent, support for deploy keys could be implemented in the following way.

Pearson-Advance@88814ef#diff-5c3fa597431eda03ac3339ae6bf7f05e1a50d6fc7333679ec38e21b337cb6721R124

In this case, two variables were defined: one for the deploy keys (SSH_DEPLOY_KEYS), which would have the following structure:

-----BEGIN OPENSSH PRIVATE KEY-----
value
-----END OPENSSH PRIVATE KEY-----
-----BEGIN OPENSSH PRIVATE KEY-----
value
-----END OPENSSH PRIVATE KEY-----
-----BEGIN OPENSSH PRIVATE KEY-----
value
-----END OPENSSH PRIVATE KEY-----

And the SSH_PRIVATE_KEY variable is preserved to avoid conflicts in this action. actions/checkout@v4

Could this solution be extended upstream?

[mariajgrimaldi]

FYI @magajh since I'm not working on this project anymore :)