Fix Jenkins deploy: SSH key ACLs, scp exit checks, auto-download installer tools.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: baasith6

Jenkinsfile

@@ -61,7 +61,7 @@ pipeline {
                 -VmHost ${params.VM_HOST} ^
                 -VmUser ${params.VM_USER} ^
                 -BackendUrl ${params.BACKEND_URL} ^
-                -SshKeyPath %SSH_KEY%${extra}
+                -SshKeyPath "${env.SSH_KEY}"${extra}
             """
           }
         }

docs/JENKINS_DEPLOY.md

@@ -88,9 +88,10 @@ powershell -ExecutionPolicy Bypass -File scripts/deploy-vm.ps1 -SkipInstaller
 
 | Issue | Fix |
 |-------|-----|
-| SSH permission denied | Check `onevo-vm-ssh-key` credential; test `ssh azureuser@20.193.69.220` from Jenkins service account |
+| SSH permission denied | Re-check `onevo-vm-ssh-key` credential; deploy script copies the key with strict ACLs for OpenSSH on Windows |
 | GPU compose error | Keep `USE_GPU=false` on CPU VM |
-| Installer build fails | Install Inno Setup; run `scripts/build-installer.ps1` manually once |
+| Missing `ffmpeg.exe` | First build auto-downloads to `%ProgramData%\onevo\installer-tools\`; or run `scripts/ensure-installer-tools.ps1` once |
+| Installer build fails | Install Inno Setup 6 + PyInstaller; run `scripts/build-installer.ps1` manually once |
 | Backend unhealthy after deploy | SSH to VM: `cd /opt/onevo/app && docker compose logs backend --tail 50` |
 
 ## Related

scripts/deploy-vm.ps1

@@ -14,14 +14,37 @@ $ErrorActionPreference = "Stop"
 $root = Split-Path -Parent $PSScriptRoot
 $tarball = Join-Path $env:TEMP "onevo-deploy.tar.gz"
 
-function Get-SshArgs {
-  if ($SshKeyPath -and (Test-Path $SshKeyPath)) {
-    return @("-i", $SshKeyPath, "-o", "StrictHostKeyChecking=no")
+function Prepare-SshKey([string]$KeyPath) {
+  if (-not $KeyPath -or -not (Test-Path $KeyPath)) {
+    throw "SSH key not found (pass -SshKeyPath or configure default ~/.ssh key). Got: '$KeyPath'"
   }
-  return @()
+  $dest = Join-Path $env:TEMP ("onevo-deploy-key-{0}" -f [Guid]::NewGuid().ToString("N"))
+  $raw = [IO.File]::ReadAllText($KeyPath) -replace "`r`n", "`n" -replace "`r", "`n"
+  if (-not $raw.EndsWith("`n")) { $raw += "`n" }
+  [IO.File]::WriteAllText($dest, $raw)
+  $identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().Name
+  & icacls $dest /inheritance:r /grant:r "${identity}:(R)" | Out-Null
+  return $dest
 }
 
-$sshArgs = Get-SshArgs
+function Invoke-Checked {
+  param([string]$Label, [scriptblock]$Command)
+  & $Command
+  if ($LASTEXITCODE -ne 0) {
+    throw "$Label failed (exit $LASTEXITCODE)"
+  }
+}
+
+function Get-SshArgs([string]$KeyPath) {
+  if ($KeyPath -and (Test-Path $KeyPath)) {
+    return @("-i", $KeyPath, "-o", "StrictHostKeyChecking=no", "-o", "BatchMode=yes")
+  }
+  return @("-o", "StrictHostKeyChecking=no", "-o", "BatchMode=yes")
+}
+
+$preparedKey = $null
+if ($SshKeyPath) { $preparedKey = Prepare-SshKey $SshKeyPath }
+$sshArgs = Get-SshArgs $preparedKey
 $scpArgs = @($sshArgs) + @("${VmUser}@${VmHost}:")
 
 Write-Host "==> Packaging app (excluding large artifacts)..."
@@ -51,16 +74,18 @@ try {
 }
 
 Write-Host "==> Uploading to ${VmUser}@${VmHost}..."
-scp @sshArgs $tarball "${VmUser}@${VmHost}:/tmp/onevo-deploy.tar.gz"
+Invoke-Checked "SCP tarball" { scp @sshArgs $tarball "${VmUser}@${VmHost}:/tmp/onevo-deploy.tar.gz" }
 
 $installerExe = $null
 if (-not $SkipInstaller) {
+  Write-Host "==> Ensuring installer tools (ffmpeg, WinSW)..."
+  & (Join-Path $root "scripts\ensure-installer-tools.ps1")
   Write-Host "==> Building Windows installer..."
   & (Join-Path $root "scripts\build-installer.ps1") -BackendUrl $BackendUrl -AllowHttp
   $installerExe = Get-ChildItem (Join-Path $root "connector\dist\ONEVO-Connector-Setup-*.exe") |
     Sort-Object LastWriteTime -Descending | Select-Object -First 1
   if (-not $installerExe) { throw "Installer EXE not found after build" }
-  scp @sshArgs $installerExe.FullName "${VmUser}@${VmHost}:/tmp/$($installerExe.Name)"
+  Invoke-Checked "SCP installer" { scp @sshArgs $installerExe.FullName "${VmUser}@${VmHost}:/tmp/$($installerExe.Name)" }
   $installerRemoteName = $installerExe.Name
 } else {
   $installerRemoteName = ""
@@ -95,7 +120,11 @@ docker compose ps --format 'table {{.Name}}\t{{.Status}}'
 "@ -replace "`r`n", "`n"
 
 Write-Host "==> Running remote deploy..."
-ssh @sshArgs "${VmUser}@${VmHost}" $remoteScript
+try {
+  Invoke-Checked "SSH deploy" { ssh @sshArgs "${VmUser}@${VmHost}" $remoteScript }
+} finally {
+  if ($preparedKey -and (Test-Path $preparedKey)) { Remove-Item $preparedKey -Force -ErrorAction SilentlyContinue }
+}
 
 Write-Host ""
 Write-Host "Deploy complete."

scripts/ensure-installer-tools.ps1

@@ -0,0 +1,57 @@
+# Ensure connector/installer/tools has ffmpeg.exe and WinSW-x64.exe (gitignored).
+param(
+  [string]$ToolsDir = "",
+  [string]$CacheDir = ""
+)
+
+$ErrorActionPreference = "Stop"
+$root = Split-Path -Parent $PSScriptRoot
+if (-not $ToolsDir) { $ToolsDir = Join-Path $root "connector\installer\tools" }
+if (-not $CacheDir) { $CacheDir = Join-Path $env:ProgramData "onevo\installer-tools" }
+
+New-Item -ItemType Directory -Force -Path $ToolsDir, $CacheDir | Out-Null
+
+$ffmpegDest = Join-Path $ToolsDir "ffmpeg.exe"
+$winswDest = Join-Path $ToolsDir "WinSW-x64.exe"
+$ffmpegCache = Join-Path $CacheDir "ffmpeg.exe"
+$winswCache = Join-Path $CacheDir "WinSW-x64.exe"
+
+$ffmpegZipUrl = "https://www.gyan.dev/ffmpeg/builds/ffmpeg-release-essentials.zip"
+$winswUrl = "https://github.com/winsw/winsw/releases/download/v2.12.0/WinSW-x64.exe"
+
+function Copy-IfMissing([string]$Source, [string]$Dest, [string]$Label) {
+  if (Test-Path $Dest) { return }
+  if (-not (Test-Path $Source)) { throw "Missing cached $Label at $Source" }
+  Copy-Item -Force $Source $Dest
+  Write-Host "    Copied $Label -> $Dest"
+}
+
+function Download-File([string]$Url, [string]$Dest) {
+  Write-Host "    Downloading $Url ..."
+  Invoke-WebRequest -Uri $Url -OutFile $Dest -UseBasicParsing
+}
+
+if (-not (Test-Path $ffmpegCache)) {
+  $zipPath = Join-Path $CacheDir "ffmpeg-release-essentials.zip"
+  Download-File $ffmpegZipUrl $zipPath
+  $extractDir = Join-Path $CacheDir "ffmpeg-extract"
+  if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
+  Expand-Archive -Path $zipPath -DestinationPath $extractDir
+  $ffmpegBin = Get-ChildItem -Path $extractDir -Recurse -Filter "ffmpeg.exe" |
+    Where-Object { $_.FullName -match '\\bin\\ffmpeg\.exe$' } |
+    Select-Object -First 1
+  if (-not $ffmpegBin) { throw "ffmpeg.exe not found inside downloaded archive" }
+  Copy-Item -Force $ffmpegBin.FullName $ffmpegCache
+  Remove-Item $extractDir -Recurse -Force
+  Remove-Item $zipPath -Force
+  Write-Host "    Cached ffmpeg.exe"
+}
+
+if (-not (Test-Path $winswCache)) {
+  Download-File $winswUrl $winswCache
+  Write-Host "    Cached WinSW-x64.exe"
+}
+
+Copy-IfMissing $ffmpegCache $ffmpegDest "ffmpeg.exe"
+Copy-IfMissing $winswCache $winswDest "WinSW-x64.exe"
+Write-Host "Installer tools ready in $ToolsDir"