From c74789f9499f90682307251bb986d52a5b1f6ebb Mon Sep 17 00:00:00 2001
From: root <melabidi@alrahmaisgl.org>
Date: Sat, 4 Jul 2026 01:57:44 -0400
Subject: [PATCH] fix build 3

---
 .gitea/workflows/build-and-deploy.yml | 31 +++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/build-and-deploy.yml b/.gitea/workflows/build-and-deploy.yml
index c23720f..3f1c436 100644
--- a/.gitea/workflows/build-and-deploy.yml
+++ b/.gitea/workflows/build-and-deploy.yml
@@ -184,13 +184,24 @@ jobs:
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
           chmod 644 ~/.ssh/known_hosts
 
+      - name: Test SSH authentication
+        env:
+          VPS_HOST: ${{ secrets.VPS_IP }}
+        run: |
+          VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
+          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          if ! ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" "printf 'ssh authenticated as '; whoami"; then
+            echo "::error::SSH authentication failed. Verify VPS_USER matches the account that has the deploy public key in ~/.ssh/authorized_keys on $VPS_HOST."
+            exit 1
+          fi
+
       - name: Sync build context to VPS
         env:
           REMOTE_BUILD_DIR: ${{ env.DEPLOY_ROOT }}/build-context
           VPS_HOST: ${{ secrets.VPS_IP }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          SSH_OPTIONS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
           ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" \
             "rm -rf '$REMOTE_BUILD_DIR' && mkdir -p '$REMOTE_BUILD_DIR'"
           tar \
@@ -219,7 +230,7 @@ jobs:
           VPS_HOST: ${{ secrets.VPS_IP }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          SSH_OPTIONS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
           REGISTRY_PASSWORD_B64="$(printf '%s' "$REGISTRY_PASSWORD" | base64 | tr -d '\n')"
           ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" "
             set -e
@@ -367,13 +378,25 @@ jobs:
           ssh-keyscan -H "$VPS_HOST" >> ~/.ssh/known_hosts 2>/dev/null || true
           chmod 644 ~/.ssh/known_hosts
 
+      - name: Test SSH authentication
+        if: steps.check-creds.outputs.skip == 'false'
+        env:
+          VPS_HOST: ${{ secrets.VPS_IP }}
+        run: |
+          VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
+          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          if ! ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" "printf 'ssh authenticated as '; whoami"; then
+            echo "::error::SSH authentication failed. Verify VPS_USER matches the account that has the deploy public key in ~/.ssh/authorized_keys on $VPS_HOST."
+            exit 1
+          fi
+
       - name: Sync deployment assets
         if: steps.check-creds.outputs.skip == 'false'
         env:
           VPS_HOST: ${{ secrets.VPS_IP }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          SSH_OPTIONS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
           ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" \
             "mkdir -p '$DEPLOY_ROOT/scripts' '$DEPLOY_ROOT/docker/pgmanage' '$DEPLOY_ROOT/docker/registry/auth' '$DEPLOY_ROOT/dynamic'"
           scp $SSH_OPTIONS docker-compose.production.yml \
@@ -396,7 +419,7 @@ jobs:
           VPS_HOST: ${{ secrets.VPS_IP }}
         run: |
           VPS_HOST="${VPS_HOST:-$DEPLOY_SSH_HOST}"
-          SSH_OPTIONS="-o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
+          SSH_OPTIONS="-i $HOME/.ssh/id_rsa -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=$HOME/.ssh/known_hosts"
           REGISTRY_PASSWORD_B64="$(printf '%s' "${{ secrets.REGISTRY_PASSWORD }}" | base64 | tr -d '\n')"
           ssh $SSH_OPTIONS "${{ secrets.VPS_USER }}@$VPS_HOST" "
             set -e