From 5cfd1661a99eb625353608906b436033bf38c54b Mon Sep 17 00:00:00 2001 From: "matthias.hauber" Date: Fri, 11 Sep 2026 16:24:15 +0200 Subject: [PATCH] fix: validate STACKIT_SERVICE_ACCOUNT_KEY format and update key path handling --- .github/workflows/verify-deployment.yml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/.github/workflows/verify-deployment.yml b/.github/workflows/verify-deployment.yml index 45cd5c3..9c890d2 100644 --- a/.github/workflows/verify-deployment.yml +++ b/.github/workflows/verify-deployment.yml @@ -96,9 +96,15 @@ jobs: echo "::error::Environment secret STACKIT_SERVICE_ACCOUNT_KEY is missing or empty." exit 1 fi - install -d -m 700 "$HOME/.stackit" - printf '%s' "$STACKIT_SERVICE_ACCOUNT_KEY" > "$HOME/.stackit/credentials.json" - chmod 600 "$HOME/.stackit/credentials.json" + if ! jq -e 'type == "object"' <<<"$STACKIT_SERVICE_ACCOUNT_KEY" >/dev/null 2>&1; then + echo "::error::STACKIT_SERVICE_ACCOUNT_KEY is not a JSON object. Expected the service account key JSON." + exit 1 + fi + + key_path="$RUNNER_TEMP/stackit-service-account-key.json" + install -m 600 /dev/null "$key_path" + printf '%s' "$STACKIT_SERVICE_ACCOUNT_KEY" > "$key_path" + echo "STACKIT_SERVICE_ACCOUNT_KEY_PATH=$key_path" >> "$GITHUB_ENV" - name: Restore OPNsense image cache id: opnsense-image-cache