Github Action无法通过SSH连接的问题求助

问题场景 #

使用Github Action部署Quasar SSR项目，构建流程正常，但部署阶段SSH连接失败，错误提示sign_and_send_pubkey: no mutual signature supported，且本地其他机器可正常SSH连接目标服务器。

原部署Workflow配置：

on:
  push:
    branches:
      - main
  workflow_dispatch:
jobs:
  build:
    name: Build Website
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v2
      - name: Install Dependencies
        run: yarn install --frozen-lockfile
      - name: Build SSR
        run: npx quasar build -m ssr
      - name: Upload Build Artifacts
        uses: actions/upload-artifact@v2
        with:
          name: build-artifacts
          path: './dist/ssr'

  deploy:
    name: Deploy to Production
    runs-on: ubuntu-latest
    needs: [build]
    steps:
      - name: Install SSH Key
        uses: shimataro/ssh-key-action@v2
        with:
          key: ${{ secrets.SSH_KEY }}
          known_hosts: 'just-a-placeholder-so-we-dont-get-errors'
      - name: Adding Known Hosts
        run: ssh-keyscan -p ${{ secrets.SSH_PORT }} -H ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts
      - name: Deploy with rsync
        run: rsync -avz -e "ssh -oHostKeyAlgorithms=+ssh-rsa -p ${{ secrets.SSH_PORT }}" ./dist/ssr/ ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:${{ vars.HOST_PATH }}

错误日志核心片段：

sign_and_send_pubkey: no mutual signature supported
Permission denied, please try again.
***@***: Permission denied (publickey,password).
rsync: connection unexpectedly closed (0 bytes received so far) [sender]
rsync error: error in rsync protocol data stream (code 12) at io.c(231) [sender=3.2.7]

问题分析 #

1. 签名算法不兼容：Github Action使用的Ubuntu Runner默认SSH客户端可能禁用了部分旧签名算法（如ssh-rsa），而目标服务器仅支持这类算法，导致密钥签名协商失败。
2. 构建产物未下载：Deploy Job未下载Build Job上传的build-artifacts，即使SSH连接成功，rsync也会因为源目录不存在而失败。
3. Known Hosts配置不规范：使用占位符可能导致主机密钥验证逻辑异常。

解决方案 #

1. 补充构建产物下载步骤 #

在Deploy Job的步骤开头添加下载Artifact的操作，确保rsync有正确的源文件：

- name: Download Build Artifacts
  uses: actions/download-artifact@v2
  with:
    name: build-artifacts
    path: ./dist/ssr

2. 修复SSH签名算法参数 #

修改rsync命令，添加PubkeyAcceptedAlgorithms参数，指定服务器支持的签名算法（以ssh-rsa为例，可根据服务器实际配置调整）：

- name: Deploy with rsync
  run: rsync -avz -e "ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa -p ${{ secrets.SSH_PORT }}" ./dist/ssr/ ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:${{ vars.HOST_PATH }}

3. 规范Known Hosts配置 #

• 在本地终端运行命令生成服务器的Known Hosts条目：

  ssh-keyscan -p <你的SSH端口> <你的服务器地址>
  

• 将输出内容添加到Github仓库的Secrets中，命名为SSH_KNOWN_HOSTS
• 修改SSH密钥安装步骤：

  - name: Install SSH Key
    uses: shimataro/ssh-key-action@v2
    with:
      key: ${{ secrets.SSH_KEY }}
      known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}
  

  此步骤可替代原有的Adding Known Hosts步骤，避免手动追加可能导致的格式问题。

完整修改后的Deploy Job #

deploy:
  name: Deploy to Production
  runs-on: ubuntu-latest
  needs: [build]
  steps:
    - name: Download Build Artifacts
      uses: actions/download-artifact@v2
      with:
        name: build-artifacts
        path: ./dist/ssr

    - name: Install SSH Key
      uses: shimataro/ssh-key-action@v2
      with:
        key: ${{ secrets.SSH_KEY }}
        known_hosts: ${{ secrets.SSH_KNOWN_HOSTS }}

    - name: Deploy with rsync
      run: rsync -avz -e "ssh -oHostKeyAlgorithms=+ssh-rsa -oPubkeyAcceptedAlgorithms=+ssh-rsa -p ${{ secrets.SSH_PORT }}" ./dist/ssr/ ${{ secrets.SSH_USER }}@${{ secrets.SSH_HOST }}:${{ vars.HOST_PATH }}

验证要点 #

• 确保SSH_KEY是目标服务器可识别的私钥（无密码保护，或配置ssh-agent处理密码）
• 确认服务器端~/.ssh/authorized_keys已添加对应公钥
• 测试服务器是否支持指定的签名算法，可通过本地SSH命令验证：

  ssh -oPubkeyAcceptedAlgorithms=+ssh-rsa -p <端口> <用户名>@<服务器地址>
  

内容的提问来源于stack exchange，提问作者Tarik