gowalk-cicd 1.0.179 → 1.0.180

package/README.md

@@ -284,11 +284,11 @@ Requirements on the consumer repo:
   never bake secrets in. A generated `.env` (with `POSTGRES_PASSWORD`) is created
   on the host on first deploy and preserved across deploys (rsync excludes it).
 - Repo **secret** `BACKEND_DEPLOY_SSH_KEY` (a private key with access to the host).
-- Repo **variable** `BACKEND_DEPLOY_KNOWN_HOSTS` (recommended): `known_hosts` lines for the exact
+- Repo **variable** `BACKEND_DEPLOY_KNOWN_HOSTS` (required): trusted `known_hosts` lines for the exact
   host string the workflow connects to (`BACKEND_DEPLOY_HOST`, for example
-  `138.197.36.107 ssh-ed25519 AAAA...`). Deploys then require that key
-  (`StrictHostKeyChecking=yes`). While it is empty the job trusts `ssh-keyscan` and prints one
-  `backend_host_key_unpinned` warning.
+  `backend.example.com ssh-ed25519 AAAA...`). Deploys require that key
+  (`StrictHostKeyChecking=yes`). Missing pins refuse with `backend_host_key_required` before SSH
+  or writing the private key; the action never discovers and trusts an unverified host key.
 - Repo **secret** `BACKEND_RUNTIME_ENV` (optional): newline-delimited `KEY=value`
   runtime secrets. The action writes it as mode 0600 on the host and passes it
   to Compose without copying values into the repository or action log.

package/backend-action/action.yml

@@ -36,8 +36,8 @@ inputs:
   known-hosts:
     description: >
       known_hosts lines pinning the deploy host's key (vars.BACKEND_DEPLOY_KNOWN_HOSTS).
-      Empty trusts whatever ssh-keyscan returns and prints a warning.
-    required: false
+      Required before SSH; missing pins refuse without network discovery.
+    required: true
     default: ""
   app-name:
     description: Stable slug — the compose project and /opt/gowalk-backends/<app-name> dir.
@@ -160,15 +160,14 @@ runs:
         set -euo pipefail
         source "${{ github.action_path }}/deploy_evidence.sh"
         BACKEND_DEPLOY_PHASE=configure_ssh
+        if [[ ! "${KNOWN_HOSTS:-}" =~ [^[:space:]] ]]; then
+          echo "::error title=backend_host_key_required::Configure the backend binding's trusted SSH host key"
+          exit 1
+        fi
         mkdir -p ~/.ssh && chmod 700 ~/.ssh
         printf '%s\n' "$DEPLOY_SSH_KEY" > ~/.ssh/backend_deploy
         chmod 600 ~/.ssh/backend_deploy
-        if [ -n "${KNOWN_HOSTS:-}" ]; then
-          printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
-        else
-          echo "::warning title=backend_host_key_unpinned::BACKEND_DEPLOY_KNOWN_HOSTS is empty; trusting the key ssh-keyscan returns"
-          ssh-keyscan -t ed25519,rsa,ecdsa "${{ inputs.host }}" >> ~/.ssh/known_hosts 2>/dev/null
-        fi
+        printf '%s\n' "$KNOWN_HOSTS" > ~/.ssh/known_hosts
         chmod 644 ~/.ssh/known_hosts
 
     - name: Sync backend to the host

package/backend-action/ssh_gate.py

@@ -16,6 +16,7 @@ OWNERS = Path('/var/lib/gowalk-backend-ownership')
 APPS = Path('/opt/gowalk-backends')
 INGRESS = Path('/opt/gowalk-backend-ingress')
 ROOT_UID = 0
+PLATFORM = ['docker', 'info', '--format', '{{.OSType}}/{{.Architecture}}']
 READY = ('command -v docker >/dev/null && docker info >/dev/null 2>&1 '
          '&& docker compose version >/dev/null 2>&1')
 
@@ -143,6 +144,15 @@ def readiness():
     return 0
 
 
+def platform():
+    result = subprocess.run(PLATFORM, capture_output=True, text=True, timeout=15, check=True)
+    value = result.stdout.strip()
+    if not re.fullmatch('[a-zA-Z0-9_-]+/[a-zA-Z0-9_-]+', value):
+        raise ValueError('ssh_platform_invalid')
+    print(value)
+    return 0
+
+
 def main():
     try:
         os.umask(0o077)
@@ -151,6 +161,8 @@ def main():
         command = os.environ.get('SSH_ORIGINAL_COMMAND', '')
         if ' '.join(command.split()) in (READY, 'gowalk-backend readiness'):
             return readiness()
+        if shlex.split(command) == PLATFORM:
+            return platform()
         if policy.get('disabled', True):
             raise ValueError('ssh_backend_disabled')
         project, may_claim, arguments = plan(command)

package/docs/BACKEND_SSH_GATE.md

@@ -9,7 +9,7 @@ needed for the transport protocol below.
 Each panel gets its own dedicated SSH key. Its `authorized_keys` entry uses `restrict` and a fixed owner:
 
 ```text
-restrict,command="/usr/bin/python3 /opt/gowalk-cicd-runtime/1.0.179/backend-action/ssh_gate.py robot" ssh-ed25519 <key>
+restrict,command="/usr/bin/python3 /opt/gowalk-cicd-runtime/1.0.180/backend-action/ssh_gate.py robot" ssh-ed25519 <key>
 ```
 
 Keep operator and release credentials separate. Never install an unrestricted backend key as a fallback.
@@ -24,7 +24,7 @@ Create root-owned mode-0600 `/etc/gowalk-backend-ssh.json`:
 }
 ```
 
-`disabled: true` refuses every mutation while permitting the read-only readiness probe. Keep it set
+`disabled: true` refuses every mutation while permitting the read-only readiness and platform probes. Keep it set
 through migration and validation. Existing per-app runtime `disabled` profiles remain an independent
 start fence when the global transport gate opens.
 
@@ -38,6 +38,7 @@ provisioning without a manual allowlist update; existing ownership and private d
 The entry permits only:
 
 - the panel's exact existing Docker/Compose readiness probe, or `gowalk-backend readiness`;
+- exactly `docker info --format '{{.OSType}}/{{.Architecture}}'` for real deployment-platform discovery;
 - scoped app-directory creation and the action's rsync **receiver** protocol inside that app;
 - the standard private runtime environment and edge-input receive envelopes;
 - the standard backend deploy invocation, redirected to the host-owned released helper;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gowalk-cicd",
-  "version": "1.0.179",
+  "version": "1.0.180",
   "description": "Zero-config GitHub Actions delivery for iOS TestFlight and Android Google Play.",
   "type": "module",
   "bin": {