How to fill a prompt asking for input with a secret in Github Actions?

user_2280527 0
Viewed 958

Doing the following step inside a job:

name: Add Secret Key
  run: ssh-add - <<< "${{ secrets.SECRET_KEY }}"

I get prompted to fill in the passphrase.

How do I use another secret, such as "${{ secrets.PASSPHRASE }}" to fill the prompt?

Currently I get this error: enter image description here

Because "Enter passphrase for (stdin):" step is skipped

github-actions github bash
1 Answers

You should not be prompted for a passphrase unless the private key was originally created with a passphrase.

For example, consider an action like actions/webfactory-ssh-agent, which comes from the study done in "Using a SSH deploy key in GitHub Actions to access private repositories" done by Matthias Pigulla

GitHub Actions only have access to the repository they run for. So, in order to access additional private repositories, create an SSH key with sufficient access privileges.
Then, use this action to make the key available with ssh-agent on the Action worker node. Once this has been set up, git clone commands using ssh URLs will just work.

# .github/workflows/my-workflow.yml
jobs:
    my_job:
        ...
        steps:
            - actions/checkout@v1
            # Make sure the @v0.4.1 matches the current version of the
            # action 
            - uses: webfactory/ssh-agent@v0.4.1
              with:
                  ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
            - ... other steps

Its README does include:

Creating SSH keys

In order to create a new SSH key, run ssh-keygen -t ed25519 -a 100 -f path/to/keyfile, as suggested in this blog post.
If you need to work with some older server software and need RSA keys, try ssh-keygen -t rsa -b 4096 -o -f path/to/keyfile instead.

Both commands will prompt you for a key passphrase and save the key in path/to/keyfile.
In general, having a passphrase is a good thing, since it will keep the key encrypted on your disk.

When using the key with this action, however, you need to make sure you don't specify a passphrase: The key must be usable without reading the passphrase from input. Since the key itself is stored using GitHub's "Secret" feature, it should be fairly safe anyway.

VonC_63090
Related