carrtech/ct-ops
3
0
Fork 0
Code Issues 28 Pull requests Projects Releases 750 Packages Wiki Activity Actions

fix(web): validate repository SSH keys #332

Merged
simon merged 2 commits from fix/ct-automation-repository-key-errors into main 2026-05-31 18:14:35 +00:00
Conversation 0 Commits 2 Files changed 3 +228 -10
simon commented 2026-05-31 17:58:38 +00:00
Owner
Copy link

Summary\n- validate CT-Automation repository SCM private keys before invoking Git, including malformed OpenSSH blocks and encrypted PEM/OpenSSH keys\n- normalize repository private key and known_hosts line endings before testing/saving\n- replace raw Git/SSH repository-test failures with specific sanitized messages for key-load, access denied, host-key, DNS, network, and ref errors\n\n## Validation\n- node --experimental-strip-types --test apps/web/lib/automation/ct-automation-repository-step-core.test.mjs\n- pnpm --filter web type-check\n- pnpm run lint (passes with existing warnings)\n- DATABASE_URL=postgresql://dummy:dummy@localhost:5432/dummy BETTER_AUTH_SECRET=dummy-secret-for-ci-build-only-at-least-32 BETTER_AUTH_URL=http://localhost:3000 NEXT_PUBLIC_APP_URL=http://localhost:3000 pnpm --filter web run build\n\n## Notes\n- Full web unit suite was also run and still has unrelated pre-existing source-assertion failures tracked in #21, #283, #284, and #331.

## Summary\n- validate CT-Automation repository SCM private keys before invoking Git, including malformed OpenSSH blocks and encrypted PEM/OpenSSH keys\n- normalize repository private key and known_hosts line endings before testing/saving\n- replace raw Git/SSH repository-test failures with specific sanitized messages for key-load, access denied, host-key, DNS, network, and ref errors\n\n## Validation\n- node --experimental-strip-types --test apps/web/lib/automation/ct-automation-repository-step-core.test.mjs\n- pnpm --filter web type-check\n- pnpm run lint (passes with existing warnings)\n- DATABASE_URL=postgresql://dummy:dummy@localhost:5432/dummy BETTER_AUTH_SECRET=dummy-secret-for-ci-build-only-at-least-32 BETTER_AUTH_URL=http://localhost:3000 NEXT_PUBLIC_APP_URL=http://localhost:3000 pnpm --filter web run build\n\n## Notes\n- Full web unit suite was also run and still has unrelated pre-existing source-assertion failures tracked in #21, #283, #284, and #331.
simon force-pushed fix/ct-automation-repository-key-errors from a4b5f16bdc
Some checks failed
Conventional PR title / Conventional PR title (pull_request) Successful in 1s
Details
PR Checks (Docker images) / Ansible API contract (pull_request) Successful in 6s
Details
PR Checks (Docker images) / Detect Docker image changes (pull_request) Successful in 9s
Details
PR Checks (Docker images) / Ingest Docker image (pull_request) Has been skipped
Details
PR Checks (Docker images) / Ansible API Docker image (pull_request) Has been skipped
Details
Secret Scan / gitleaks (pull_request) Failing after 27s
Details
SAST / crypto-lint (no weak hashes / ciphers) (pull_request) Successful in 1m6s
Details
SAST / semgrep (pull_request) Successful in 1m12s
Details
SAST / gosec (ingest) (pull_request) Successful in 1m58s
Details
SAST / trivy (config / IaC) (pull_request) Successful in 2m6s
Details
PR Checks (Web) / Web (lint / type-check / build) (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Web Docker image (pull_request) Has been cancelled
Details
SAST / gosec (agent) (pull_request) Has been cancelled
Details
SAST / trivy (filesystem) (pull_request) Has been cancelled
Details
to c157c5b499
Some checks failed
Conventional PR title / Conventional PR title (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Detect Docker image changes (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Ansible API contract (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Web Docker image (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Ingest Docker image (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Ansible API Docker image (pull_request) Has been cancelled
Details
PR Checks (Web) / Web (lint / type-check / build) (pull_request) Has been cancelled
Details
SAST / gosec (agent) (pull_request) Has been cancelled
Details
SAST / gosec (ingest) (pull_request) Has been cancelled
Details
SAST / semgrep (pull_request) Has been cancelled
Details
SAST / trivy (filesystem) (pull_request) Has been cancelled
Details
SAST / crypto-lint (no weak hashes / ciphers) (pull_request) Has been cancelled
Details
SAST / trivy (config / IaC) (pull_request) Has been cancelled
Details
Secret Scan / gitleaks (pull_request) Has been cancelled
Details
2026-05-31 18:00:56 +00:00 Compare
simon force-pushed fix/ct-automation-repository-key-errors from 5e1d6acf2c
Some checks failed
Conventional PR title / Conventional PR title (pull_request) Successful in 1s
Details
PR Checks (Docker images) / Ansible API contract (pull_request) Successful in 6s
Details
PR Checks (Docker images) / Detect Docker image changes (pull_request) Successful in 8s
Details
PR Checks (Docker images) / Web Docker image (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Ingest Docker image (pull_request) Has been cancelled
Details
PR Checks (Docker images) / Ansible API Docker image (pull_request) Has been cancelled
Details
SAST / trivy (config / IaC) (pull_request) Has been cancelled
Details
Secret Scan / gitleaks (pull_request) Has been cancelled
Details
SAST / trivy (filesystem) (pull_request) Has been cancelled
Details
SAST / semgrep (pull_request) Has been cancelled
Details
SAST / gosec (ingest) (pull_request) Has been cancelled
Details
SAST / crypto-lint (no weak hashes / ciphers) (pull_request) Has been cancelled
Details
PR Checks (Web) / Web (lint / type-check / build) (pull_request) Has been cancelled
Details
SAST / gosec (agent) (pull_request) Has been cancelled
Details
to 1f535be287
All checks were successful
Conventional PR title / Conventional PR title (pull_request) Successful in 0s
Details
PR Checks (Docker images) / Ansible API contract (pull_request) Successful in 6s
Details
PR Checks (Docker images) / Detect Docker image changes (pull_request) Successful in 8s
Details
Secret Scan / gitleaks (pull_request) Successful in 42s
Details
PR Checks (Docker images) / Ingest Docker image (pull_request) Has been skipped
Details
SAST / crypto-lint (no weak hashes / ciphers) (pull_request) Successful in 1m7s
Details
PR Checks (Docker images) / Ansible API Docker image (pull_request) Has been skipped
Details
SAST / semgrep (pull_request) Successful in 1m12s
Details
SAST / gosec (agent) (pull_request) Successful in 1m56s
Details
SAST / gosec (ingest) (pull_request) Successful in 2m0s
Details
SAST / trivy (filesystem) (pull_request) Successful in 2m1s
Details
SAST / trivy (config / IaC) (pull_request) Successful in 1m57s
Details
PR Checks (Web) / Web (lint / type-check / build) (pull_request) Successful in 2m39s
Details
PR Checks (Docker images) / Web Docker image (pull_request) Successful in 8m32s
Details
2026-05-31 18:04:07 +00:00 Compare
simon merged commit 4ad1b9471a into main 2026-05-31 18:14:35 +00:00
simon deleted branch fix/ct-automation-repository-key-errors 2026-05-31 18:14:35 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
E2E Failure
Regression found by end-to-end automation

  
area:agent
Go agent

  
area:audit-log
Audit logging

  
area:auth
Authentication

  
area:authz
Authorisation / RBAC

  
area:ci
CI / tooling / scanning

  
area:crypto
Cryptography / secrets

  
area:db
Database / schema

  
area:docker
Docker / deployment

  
area:headers
HTTP headers / CSP

  
area:ingest
gRPC ingest service

  
area:ldap
LDAP integration

  
area:rate-limit
Rate limiting / abuse prevention

  
area:ssrf
Server-side request forgery

  
area:supply-chain
Supply chain / deploy

  
area:terminal
Terminal / PTY

  
autorelease: pending

   
autorelease: tagged

   
bug
Something isn't working

  
claude-working

   
documentation
Improvements or additions to documentation

  
duplicate
This issue or pull request already exists

  
enhancement
New feature or request

  
good first issue
Good for newcomers

  
help wanted
Extra attention is needed

  
invalid
This doesn't seem right

  
priority: critical
Critical - blocking or data loss

  
priority: high
High priority - should be addressed soon

  
priority: low
Low priority - nice to have

  
priority: medium
Medium priority - address after high priority items

  
question
Further information is requested

  
security
Security finding from pre-pentest audit

  
sev:critical
Severity: Critical

  
sev:high
Severity: High

  
sev:info
Severity: Informational / Hardening

  
sev:low
Severity: Low

  
sev:medium
Severity: Medium

  
tests-required
Needs tests or stronger coverage before fix is complete

  
wontfix
This will not be worked on

No labels
E2E Failure
area:agent
area:audit-log
area:auth
area:authz
area:ci
area:crypto
area:db
area:docker
area:headers
area:ingest
area:ldap
area:rate-limit
area:ssrf
area:supply-chain
area:terminal
autorelease: pending
autorelease: tagged
bug
claude-working
documentation
duplicate
enhancement
good first issue
help wanted
invalid
priority: critical
priority: high
priority: low
priority: medium
question
security
sev:critical
sev:high
sev:info
sev:low
sev:medium
tests-required
wontfix
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
carrtech/ct-ops!332
No description provided.