feat: add action to setup ssh to discovery

Author: blaggacao

setup-discovery-ssh/action.yaml

@@ -0,0 +1,39 @@
+name: "Setup SSH to Discovery"
+description: "Configure SSH access to the discovery host and fetch build instructions (derivaitons)."
+author: "The Standard Authors"
+
+inputs:
+  ssh_key:
+    required: true
+    description: |
+      The private SSH key used to authenticate with the Discovery host.
+
+      You should not add your private key directly to the workflow file but
+      instead define a GitHub Secret for it, to avoid mistakenly sharing your
+      key with others.
+
+      It is advisable to create a new SSH key specifically for use within GitHub
+      (or even per repository or workflow). That way you can revoke access to
+      your Discovery host in a fine-grained fashion.
+
+  user_name:
+    required: true
+    description: |
+      The user name to connect with.
+
+  ssh_known_hosts_entry:
+    required: true
+    description: |
+      The known host entry to use for the Discovery host.
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up SSH access to the Discovery host
+      id: setup
+      run: ${{ github.action_path }}/setup.sh
+      shell: bash
+      env:
+        DISCOVERY_USER_NAME: ${{ inputs.user_name }}
+        DISCOVERY_SSH_KNOWN_HOSTS_ENTRY: ${{ inputs.ssh_known_hosts_entry }}
+        DISCOVERY_SSH_KEY: ${{ inputs.ssh_key }}

setup-discovery-ssh/setup.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+set -eu
+set -o pipefail
+
+# Setup known_hosts
+SSH_KNOWN_HOSTS_FILE="$(mktemp)"
+printenv DISCOVERY_SSH_KNOWN_HOSTS_ENTRY > "$SSH_KNOWN_HOSTS_FILE"
+
+host_name="$(echo "$DISCOVERY_SSH_KNOWN_HOSTS_ENTRY" | cut -d ' ' -f 1)"
+
+# Create ssh config
+SSH_CONFIG_FILE="$(mktemp)"
+cat >"$SSH_CONFIG_FILE" <<EOF
+Host discovery
+HostName $host_name
+User $DISCOVERY_USER_NAME
+LogLevel ERROR
+StrictHostKeyChecking yes
+UserKnownHostsFile $SSH_KNOWN_HOSTS_FILE
+ControlPath none
+EOF
+
+# Setup auth
+ssh_key_file="$(mktemp)"
+printenv DISCOVERY_SSH_KEY > "$ssh_key_file"
+if ssh-keygen -y -f "$ssh_key_file" &>/dev/null; then
+  # Start ssh agent
+  eval $(ssh-agent)
+  # Add ssh key to agent
+  ssh-add -q "$ssh_key_file" && rm "$ssh_key_file"
+  # Auth agent socket to ssh config
+  echo "IdentityAgent $SSH_AUTH_SOCK" >> "$SSH_CONFIG_FILE"
+else
+  echo -e >&2 \
+"Your SSH key is not a valid OpenSSH private key\n"\
+"This is likely caused by one of these issues:\n"\
+"* The key has been configured incorrectly in your workflow file.\n"\
+"* The workflow was triggered by an actor that has no access to\n"\
+"  the GitHub Action secret used for storing your SSH key.\n"\
+"  For example, Pull Requests originating from a fork of your\n"\
+"  repository can't access secrets."
+  exit 1
+fi
+
+# Append ssh config to system config
+sudo mkdir -p /etc/ssh
+sudo touch /etc/ssh/ssh_config
+sudo tee -a /etc/ssh/ssh_config < "$SSH_CONFIG_FILE" >/dev/null