From 13f05bbddf87bd41b866829978542898db8cac6f Mon Sep 17 00:00:00 2001
From: butterrobot <butterrobot@fmartingr.com>
Date: Wed, 9 Sep 2026 17:14:12 +0000
Subject: [PATCH 1/2] fix: make entrypoint.sh executable

entrypoint.sh was committed with mode 0644 while action.yml invoked it
directly, so every run of this action died before the script started:

  entrypoint.sh: Permission denied
  exitcode '126': failure

Sets the executable bit, and invokes the script through sh so the action no
longer depends on the mode bit surviving a checkout.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 action.yml    | 2 +-
 entrypoint.sh | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 mode change 100644 => 100755 entrypoint.sh

diff --git a/action.yml b/action.yml
index 1152a0d..94d77a2 100644
--- a/action.yml
+++ b/action.yml
@@ -41,7 +41,7 @@ runs:
         fi
     - name: Deploy
       shell: sh
-      run: ${{ github.action_path }}/entrypoint.sh
+      run: sh "${{ github.action_path }}/entrypoint.sh"
       env:
         INPUT_HOST: ${{ inputs.host }}
         INPUT_PORT: ${{ inputs.port }}
diff --git a/entrypoint.sh b/entrypoint.sh
old mode 100644
new mode 100755
-- 
2.52.0


From 909f84caae92387c70a5ba35603246f6daeea019 Mon Sep 17 00:00:00 2001
From: butterrobot <butterrobot@fmartingr.com>
Date: Wed, 9 Sep 2026 17:16:58 +0000
Subject: [PATCH 2/2] fix: resolve ssh paths from $HOME and always remove the
 deploy key

ssh expands ~ from the passwd database rather than $HOME, so a container that
sets HOME elsewhere made ssh look for the key and known_hosts in a different
directory than the one the script had just written, failing with a confusing
"Identity file not accessible" / "Host key verification failed" pair.

The deploy key was also only removed on the success path, leaving the private
key on the runner whenever rsync failed; a trap now removes it either way.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 entrypoint.sh | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/entrypoint.sh b/entrypoint.sh
index 449a656..5b9786b 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -24,20 +24,26 @@ fi
 SSH_PORT="${INPUT_PORT:-22}"
 SOURCE="${INPUT_SOURCE:-.}"
 
-mkdir -p ~/.ssh
-chmod 700 ~/.ssh
+# ssh expands ~ from the passwd database rather than $HOME, so the two disagree
+# whenever a container sets HOME elsewhere. Pass absolute paths instead.
+SSH_DIR="$HOME/.ssh"
+KEY_FILE="$SSH_DIR/deploy_key"
+KNOWN_HOSTS="$SSH_DIR/known_hosts"
 
-echo "$INPUT_KEY" > ~/.ssh/deploy_key
-chmod 600 ~/.ssh/deploy_key
+mkdir -p "$SSH_DIR"
+chmod 700 "$SSH_DIR"
 
-ssh-keyscan -p "$SSH_PORT" -H "$INPUT_HOST" >> ~/.ssh/known_hosts 2>/dev/null
+trap 'rm -f "$KEY_FILE"' EXIT
+
+echo "$INPUT_KEY" > "$KEY_FILE"
+chmod 600 "$KEY_FILE"
+
+ssh-keyscan -p "$SSH_PORT" -H "$INPUT_HOST" >> "$KNOWN_HOSTS" 2>/dev/null
 
 rsync -avz \
-  -e "ssh -i ~/.ssh/deploy_key -p $SSH_PORT -o ConnectTimeout=30" \
+  -e "ssh -i $KEY_FILE -o UserKnownHostsFile=$KNOWN_HOSTS -p $SSH_PORT -o ConnectTimeout=30" \
   $INPUT_ARGS \
   "${SOURCE}/" \
   "${INPUT_USERNAME}@${INPUT_HOST}:${INPUT_TARGET}/"
 
-rm -f ~/.ssh/deploy_key
-
 echo "Deployed ${SOURCE} to ${INPUT_HOST}:${INPUT_TARGET}"
-- 
2.52.0