fix ssh_key parsing

.gitlab-ci.yml

@@ -189,11 +189,22 @@ deploy_to_vps:
     # Load the SSH private key stored in the CI variable SSH_PRIVATE_KEY
     - eval $(ssh-agent -s)
     - |
+      key_file="$(mktemp)"
+
       if [ -f "${SSH_PRIVATE_KEY:-}" ]; then
-        tr -d '\r' < "$SSH_PRIVATE_KEY" | ssh-add -
+        tr -d '\r' < "$SSH_PRIVATE_KEY" > "$key_file"
       else
-        printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' | ssh-add -
+        printf '%s\n' "$SSH_PRIVATE_KEY" | tr -d '\r' > "$key_file"
       fi
+
+      chmod 600 "$key_file"
+      ssh-keygen -y -f "$key_file" >/dev/null 2>&1 || {
+        echo "SSH_PRIVATE_KEY is not a valid unencrypted private key that OpenSSH can read." >&2
+        exit 1
+      }
+
+      ssh-add "$key_file"
+      rm -f "$key_file"
     - mkdir -p ~/.ssh && chmod 700 ~/.ssh
     # Scan and trust the VPS host key (avoids manual known_hosts management)
     - ssh-keyscan -H $VPS_IP >> ~/.ssh/known_hosts