I can't use Drone Secret

D_Ther_Htun · June 28, 2021, 1:50pm

I’m new at Drone ci. I’m trying to git fetch branch, edit and push to a branch. but I can’t use Github personal token and ssh for pushing branch.

    image: docker:git
    secrets: [ssh_key]
    commands:
      - mkdir ~/.ssh
      - echo "${ssh_key}" > ~/.ssh/id_rsa
      - chmod 600 ~/.ssh/id_rsa
      - ssh-agent sh -c 'ssh-add ~/.ssh/id_rsa; git fetch git@github.com'
      - git fetch origin deploy
      - git checkout deploy
      - sed -i "s+dther/golang-http:.*$*+dther/golang-http:${DRONE_COMMIT_SHA}+g" kustomize/bases/hola/deployment.yaml
      - cat kustomize/bases/hola/deployment.yaml
      - git add .
      - git commit -m "Change image version to ${DRONE_COMMIT_SHA}" -a
      - git push origin deploy

The result is like this.

bradrydzewski · June 28, 2021, 2:59pm

when using ${variable} syntax in the commands section you need to escape. see https://docs.drone.io/pipeline/environment/syntax/#common-problems

D_Ther_Htun · June 28, 2021, 3:52pm

even I use like this:

      - echo $ssh_key > ~/.ssh/id_rsa

error is still same

bradrydzewski · June 28, 2021, 4:24pm

this line of the script looks to have an error:

ssh-agent sh -c 'ssh-add ~/.ssh/id_rsa; git fetch git@github.com'

you are trying to git fetch from git@github.com which is not a valid github repositroy.

D_Ther_Htun · June 29, 2021, 3:02pm

The problem is secret can’t write to file.

bradrydzewski · June 29, 2021, 3:11pm

here is a real world example of shell commands that we use in Drone to setup an ssh key. The below commands are verified and confirmed to work, as long as you setup your secret properly.

github.com

drone/drone/blob/v0.8.0/.drone.sh#L7:L17

    
      
          #!/bin/sh
          
          
# only execute this script as part of the pipeline.
          [ -z "$CI" ] && echo "missing ci environment variable" && exit 2
          
          
# only execute the script when github token exists.
          [ -z "$SSH_KEY" ] && echo "missing ssh key" && exit 3
          
          
# write the ssh key.
          mkdir /root/.ssh
          echo -n "$SSH_KEY" > /root/.ssh/id_rsa
          chmod 600 /root/.ssh/id_rsa
          
          
# add github.com to our known hosts.
          touch /root/.ssh/known_hosts
          chmod 600 /root/.ssh/known_hosts
          ssh-keyscan -H github.com > /etc/ssh/ssh_known_hosts 2> /dev/null

The error message in your previous post states that it fails because it is an invalid format. Notice in the example I posted above that we quote the ssh key before writing to a file so that it preserves newlines. This is important and is omitted in your example above, which could explain the failure.

D_Ther_Htun · June 29, 2021, 5:48pm

it is still error

D_Ther_Htun · June 29, 2021, 5:50pm

ssh isn’t ok so I change it without using ssh. but it is still not ok

it is ok on my laptop but not on drone cloud.

github.com

dtherhtun/drone-app/blob/main/.drone.sh

#!/bin/sh

mkdir ~/.ssh
[ -z "$GH_TOKEN" ] && echo "missing github token" && exit 3

git clone https://dtherhtun:$GH_TOKEN@github.com/dtherhtun/drone-app.git -b deploy app
cd app
sed -i "s+dther/golang-http:.*$*+dther/golang-http:${DRONE_COMMIT_SHA}+g" kustomize/bases/hola/deployment.yaml
git add .
git config --global user.name "drone-ci"
git config --global user.email "ci@drone.io"
git commit -m "Change image version to ${DRONE_COMMIT_SHA}" -a
cat .git/config
git push origin deploy

ashwilliams1 · June 29, 2021, 7:46pm

are you certain your token has write access to the repository? It looks like the repository is being successfully cloned which would imply the secret is successfully being used to pull the repository … if pull is successful, but push fails, it would imply the token lacks permission

D_Ther_Htun · June 30, 2021, 7:02am

Yes, token has write access. I have test on my laptop.

Tifinity · September 6, 2021, 11:09am

I have the same problem, did you solve it, how did you solve it，help！！
my private key can work on my laptop but “invalid format” in drone pipline

D_Ther_Htun · September 6, 2021, 4:59pm

Yes, Problem was solved by using another CI.

Tifinity · September 7, 2021, 6:41am

i use this command and it worked:
echo -e “$SSH_KEY” > /root/.ssh/id_rsa