From 055546f128f3fa895629b74555b44ec604f6db4f Mon Sep 17 00:00:00 2001
From: BOTAlex <alex@deprived.dev>
Date: Sun, 30 Nov 2025 05:56:08 +0100
Subject: [PATCH] chatgpt workflow fix? snorre cry abou tit

---
 .forgejo/workflows/signal-rebuild.yml | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/.forgejo/workflows/signal-rebuild.yml b/.forgejo/workflows/signal-rebuild.yml
index 2ca161a..dbba01f 100644
--- a/.forgejo/workflows/signal-rebuild.yml
+++ b/.forgejo/workflows/signal-rebuild.yml
@@ -4,23 +4,33 @@ on: [push]
 
 jobs:
   test_service:
-    runs-on: native
+    name: test_service
+    runs-on: native   # make sure your runner has a "native" label
 
     steps:
       - name: Get branch
-        run: echo "BRANCH=$(echo "${{ gitea.ref }}" | cut -d'/' -f3)" >> $GITHUB_ENV
+        run: echo "BRANCH=$(echo \"${{ forgejo.ref }}\" | cut -d'/' -f3)" >> "$FORGEJO_ENV"
+
       - name: Signal deprived.dev for rebuild
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_KEY }}
           GITKEY: ${{ secrets.GITKEY }}
-          PUBLIC_URL_BASE: ${{ variables.PUBLIC_URL_BASE }}
-          PUBLIC_POCKET_URL: ${{ variables.PUBLIC_POCKET_URL }}
+          PUBLIC_URL_BASE: ${{ vars.PUBLIC_URL_BASE }}
+          PUBLIC_POCKET_URL: ${{ vars.PUBLIC_POCKET_URL }}
         run: |
           sshkey=$(mktemp)
-          trap "rm -rf $sshkey" exit
-          echo -e $SSH_PRIVATE_KEY > $sshkey
+          trap "rm -rf \"$sshkey\"" exit
+
+          # write SSH key and lock down permissions
+          echo -e "$SSH_PRIVATE_KEY" > "$sshkey"
+          chmod 600 "$sshkey"
+
           service="build-deprived-website-$BRANCH"
           sshargs="-o LogLevel=ERROR -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no"
+
           echo "Starting systemd oneshot service: $service"
-          ssh -i $sshkey -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no deprivedbuilder@deprived.dev -t "sudo /run/current-system/sw/bin/systemctl start $service"
-          echo "Build Log: $(ssh -i $sshkey $sshargs deprivedbuilder@deprived.dev "cat ~/latest_build.log")"
+          ssh -i "$sshkey" $sshargs deprivedbuilder@deprived.dev -t \
+            "sudo /run/current-system/sw/bin/systemctl start \"$service\""
+
+          echo "Build Log: $(ssh -i "$sshkey" $sshargs deprivedbuilder@deprived.dev "cat ~/latest_build.log")"
+