GitHub Actions自托管Runner SSH部署权限被拒问题求助

问题描述 #

我通过GitHub Actions自托管Runner构建部署项目，仓库密钥已配置SS_KEY、USER_ID、SERVER_IP等信息，手动在Runner实例执行SSH部署正常，但Actions执行时出现权限拒绝错误。

配置文件（actions.yaml） #

name: myproject
on:
  push:
  workflow_dispatch:
concurrency:
  group: "${{ github.ref }}"
  cancel-in-progress: true

permissions:
  contents: read
  packages: read

env:
  USER_ID: "${{ secrets.USER_ID }}"
  SS_KEY: "${{ secrets.SS_KEY }}"
  SERVER_IP: "${{ secrets.SS_SERVER_IP }}""
  
jobs:
  dev-build:
    runs-on:
      - self-hosted
    container:    
      image: ghcr.io/yepme/skanska:1.8  
    if: github.ref == 'refs/heads/feature-branch'
    timeout-minutes: 60
    steps:
    - uses: actions/checkout@v3
    - run: |
        which ssh-agent || ( apt-get update -y && apt-get install openssh-client -yqq ) &&
        eval $(ssh-agent -s) &&
        echo "$SS_KEY" | ssh-add - &&
        echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config &&
        echo "$SS_KEY" > key.pem && chmod 400 key.pem &&
        ansible-playbook deploy/deploy.yml -i hosts --extra-vars '{"project":"shopping","component":"customer"}' --tags "build"
    - uses: actions/upload-artifact@v3.1.3
      if: success()
      with:
        name: "${{ github.job }}"
        path: build/build.tar.gz        
        
  dev-deploy:
    needs: dev-build
    runs-on:
      - self-hosted
    container:
      image: ghcr.io/yepme/skanska:1.8      
    if: github.ref == 'refs/heads/feature-branch'
    timeout-minutes: 60
    steps:
    - uses: actions/checkout@v3
    - uses: actions/download-artifact@v3.0.2
    - run: |
        which ssh-agent || ( apt-get update -y && apt-get install openssh-client -yqq ) &&
        eval $(ssh-agent -s) &&
        echo "$SS_KEY" | ssh-add - &&
        echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config &&
        echo "$SS_KEY" > key.pem && chmod 400 key.pem &&
        pwd &&
        ls -la &&  
        
        # 报错位置
        ssh -p 2069 $AZUREGID@$AZURE_DEVRULEENGINESERVERIP "echo $AZURE_DEVRULEENGINECONFIG > /tmp/config.ini; mkdir -p ~/.cassandra/.certs; echo $AZ_DEV_CASS_CERT > ~/.cassandra/.certs/dev_cass.cer.pem; echo $AZURE_DEV_CASS_KEY > ~/.cassandra/.certs/dev_cass.key.pem"
        echo "[node]" > hosts &&
        echo "$SERVER_IP ansible_ssh_port=2069 ansible_ssh_user=$USER_ID ansible_ssh_private_key_file=./key.pem" >> hosts &&
        cat hosts > unauth_usage &&
        ansible-playbook deploy/deploy.yml -i unauth_usage --extra-vars '{"project":"shopping","component":"customer","process":"customer_max","dir":"customer","env":"dev"}' --tags "unauth_monitor" &&
        ansible-playbook deploy/deploy.yml -i hosts --extra-vars '{"project":"shopping","component":"customer","process":"customer_max","dir":"customer","env":"dev"}' --tags "deploy"

报错信息 #

Warning: Permanently added '[***]:2069' (ECDSA) to the list of known hosts.
***@***: Permission denied (publickey).

修复方案 #

1. SSH命令未指定私钥路径 #

执行SSH命令时未指定生成的key.pem，SSH会默认查找容器内的默认密钥（如~/.ssh/id_rsa），但这些密钥不存在，导致验证失败。修改SSH命令，添加-i ./key.pem参数：

ssh -i ./key.pem -p 2069 $AZUREGID@$AZURE_DEVRULEENGINESERVERIP "echo $AZURE_DEVRULEENGINECONFIG > /tmp/config.ini; mkdir -p ~/.cassandra/.certs; echo $AZ_DEV_CASS_CERT > ~/.cassandra/.certs/dev_cass.cer.pem; echo $AZURE_DEV_CASS_KEY > ~/.cassandra/.certs/dev_cass.key.pem"

2. 缺失环境变量定义 #

dev-deploy任务中用到的$AZUREGID、$AZURE_DEVRULEENGINESERVERIP等变量未在env块中从GitHub Secrets导入，导致SSH命令的用户名、服务器IP等参数无效。补充环境变量定义，同时修正SERVER_IP末尾多余的双引号：

env:
  USER_ID: "${{ secrets.USER_ID }}"
  SS_KEY: "${{ secrets.SS_KEY }}"
  SERVER_IP: "${{ secrets.SS_SERVER_IP }}"
  AZUREGID: "${{ secrets.AZUREGID }}"
  AZURE_DEVRULEENGINESERVERIP: "${{ secrets.AZURE_DEVRULEENGINESERVERIP }}"
  AZURE_DEVRULEENGINECONFIG: "${{ secrets.AZURE_DEVRULEENGINECONFIG }}"
  AZ_DEV_CASS_CERT: "${{ secrets.AZ_DEV_CASS_CERT }}"
  AZURE_DEV_CASS_KEY: "${{ secrets.AZURE_DEV_CASS_KEY }}"

3. SSH密钥格式损坏 #

用echo "$SS_KEY" > key.pem可能丢失私钥中的换行符，破坏密钥格式。改用printf确保格式正确：

printf "%s" "$SS_KEY" > key.pem && chmod 400 key.pem

4. 系统级SSH配置无权限修改 #

执行echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config需要root权限，Actions默认非root用户执行会失败。改用用户级配置：

echo "StrictHostKeyChecking no" >> ~/.ssh/config && chmod 600 ~/.ssh/config

内容的提问来源于stack exchange，提问作者DevGo