feat: SSH connectivity check + host:port in FORGEJO_SSH_HOST #6

Merged

joshtronic merged 2 commits from devel into master

2026-05-16 20:50:40 +00:00

joshtronic commented

2026-05-16 20:49:29 +00:00

Owner

Two changes:

validate.sh tests SSH explicitly. Parses FORGEJO_SSH_HOST for
host[:port], runs ssh -T -o BatchMode=yes -o ConnectTimeout=10
against the endpoint, classifies the result:
- timeout / refused / DNS error -> "endpoint unreachable, set
  FORGEJO_SSH_HOST=host:port or use ~/.ssh/config"
- permission denied (publickey) -> "key not recognized, add the
  bot's .pub to Forgejo SSH keys"
- welcome / authenticated -> pass
FORGEJO_SSH_HOST accepts host:port directly. Previously the
variable held just the hostname (with port 22 implied), so any
non-default port required ~/.ssh/config gymnastics. Now the
harness builds an ssh://git@host:port/path URL when a port is
present and the shorthand git@host:path URL otherwise. Operator
sets FORGEJO_SSH_HOST=git.example.com:22381 in .env and the
clone Just Works -- no SSH config required.

The clone-URL construction got extracted to a small ssh_clone_url
helper to keep the two callsites (ensure_repo_local + main flow's
clone-if-needed) in sync.

.env.example updated with both forms documented.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Validate light spot: bin/validate.sh said the install was healthy but the first tick failed on git clone because Forgejo's SSH was on a non-default port. HTTPS-to-the-API working doesn't imply SSH-for- clone works -- different port, different auth (key vs token). Surface that gap. Two changes: 1. validate.sh tests SSH explicitly. Parses FORGEJO_SSH_HOST for host[:port], runs `ssh -T -o BatchMode=yes -o ConnectTimeout=10` against the endpoint, classifies the result: - timeout / refused / DNS error -> "endpoint unreachable, set FORGEJO_SSH_HOST=host:port or use ~/.ssh/config" - permission denied (publickey) -> "key not recognized, add the bot's .pub to Forgejo SSH keys" - welcome / authenticated -> pass 2. FORGEJO_SSH_HOST accepts host:port directly. Previously the variable held just the hostname (with port 22 implied), so any non-default port required ~/.ssh/config gymnastics. Now the harness builds an ssh://git@host:port/path URL when a port is present and the shorthand git@host:path URL otherwise. Operator sets FORGEJO_SSH_HOST=git.example.com:22381 in .env and the clone Just Works -- no SSH config required. The clone-URL construction got extracted to a small ssh_clone_url helper to keep the two callsites (ensure_repo_local + main flow's clone-if-needed) in sync. .env.example updated with both forms documented. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

joshtronic added 1 commit

2026-05-16 20:49:30 +00:00

feat: SSH connectivity check + host:port in FORGEJO_SSH_HOST

Lint / check-sync (push) Successful in 4s

Details

Lint / check-sync (pull_request) Successful in 5s

Details

d4232a9d11

Validate light spot: bin/validate.sh said the install was healthy
but the first tick failed on git clone because Forgejo's SSH was on
a non-default port. HTTPS-to-the-API working doesn't imply SSH-for-
clone works -- different port, different auth (key vs token).
Surface that gap.

Two changes:

1. validate.sh tests SSH explicitly. Parses FORGEJO_SSH_HOST for
   host[:port], runs `ssh -T -o BatchMode=yes -o ConnectTimeout=10`
   against the endpoint, classifies the result:
   - timeout / refused / DNS error -> "endpoint unreachable, set
     FORGEJO_SSH_HOST=host:port or use ~/.ssh/config"
   - permission denied (publickey) -> "key not recognized, add the
     bot's .pub to Forgejo SSH keys"
   - welcome / authenticated -> pass

2. FORGEJO_SSH_HOST accepts host:port directly. Previously the
   variable held just the hostname (with port 22 implied), so any
   non-default port required ~/.ssh/config gymnastics. Now the
   harness builds an ssh://git@host:port/path URL when a port is
   present and the shorthand git@host:path URL otherwise. Operator
   sets FORGEJO_SSH_HOST=git.example.com:22381 in .env and the
   clone Just Works -- no SSH config required.

The clone-URL construction got extracted to a small ssh_clone_url
helper to keep the two callsites (ensure_repo_local + main flow's
clone-if-needed) in sync.

.env.example updated with both forms documented.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

joshtronic added 1 commit

2026-05-16 20:49:39 +00:00