fix(ci): use SSH on the merge bot (#607)

I'm seeing an access denied for the bot (but not for workflow_dispatch). Let's use an SSH user and see what happens. Signed-off-by: Claudio André <[email protected]>
openwall · Nov 15, 2024 · 6579932 · 6579932
1 parent fb3c4f1
commit 6579932
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/.github/actions/spelling/patterns.txt b/.github/actions/spelling/patterns.txt
@@ -100,3 +100,6 @@ index [0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
 # hit-count: 1 file-count: 1
 # curl arguments
 \b(?:\\n|)curl(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
+
+# SSH information
+SHA256:ok.{42}[email protected]
diff --git a/.github/workflows/merge-bot.yml b/.github/workflows/merge-bot.yml
@@ -49,6 +49,7 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443
+            github.com:22
             github.com:443
             raw.githubusercontent.com:443
 
@@ -57,10 +58,15 @@ jobs:
           GITHUB_CONTEXT: ${{ toJSON(github) }}
         run: echo "$GITHUB_CONTEXT"
 
+      - uses: webfactory/ssh-agent@dc588b651fe13675774614f8e6a936a468676387 # v0.9.0
+        with:
+          ssh-private-key: ${{ secrets.SSH_PRIVATE_KEY }}
+
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
           ref: main
+          ssh-key: "SHA256:ok+PGEmHdM/emA1zW4KJFOi59cOhuxk9wB3rrUwi1dg [email protected]"
 
       - name: Auto-merge PRs
         run: |