From 0b82cbb25f1bd1aac60daef002f52e78b73123cf Mon Sep 17 00:00:00 2001 From: miczek Date: Thu, 15 Oct 2026 05:05:52 +0300 Subject: [PATCH] ci: use unbraced $$SECRET escapes in deploy ssh --- .drone.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.drone.yml b/.drone.yml index b1a9cab..49dbea6 100644 --- a/.drone.yml +++ b/.drone.yml @@ -125,17 +125,16 @@ steps: - apk add --no-cache openssh-client - mkdir -p /root/.ssh && chmod 700 /root/.ssh - printenv SSH_KEY > /root/.ssh/id_ed25519 && chmod 600 /root/.ssh/id_ed25519 - # Drone pre-expands ${VAR} (empty for secrets). Use $VAR / $$ so the shell - # reads the from_secret environment at runtime. + # Escape secrets as $$… so Drone does not pre-expand them to empty. - | ssh -i /root/.ssh/id_ed25519 \ - -p "$${SSH_PORT:-22}" \ + -p "$$SSH_PORT" \ -o StrictHostKeyChecking=accept-new \ -o BatchMode=yes \ - "$${SSH_USER}@$${SSH_HOST}" \ - "export REGISTRY_USERNAME='$${REGISTRY_USERNAME}' REGISTRY_PASSWORD='$${REGISTRY_PASSWORD}'; bash -s" <<'EOS' + "$$SSH_USER@$$SSH_HOST" \ + "export REGISTRY_USERNAME='$$REGISTRY_USERNAME' REGISTRY_PASSWORD='$$REGISTRY_PASSWORD'; bash -s" <<'EOS' set -euo pipefail - echo "$${REGISTRY_PASSWORD}" | docker login registry.zea.lt -u "$${REGISTRY_USERNAME}" --password-stdin + echo "$$REGISTRY_PASSWORD" | docker login registry.zea.lt -u "$$REGISTRY_USERNAME" --password-stdin cd /home/miczek/homelab/tracker docker compose pull docker compose up -d --remove-orphans