Question

在我的jenkins管道中，我可以很好地克隆存储库，但是使用SSH Agent插件来推回标签失败。我已经确保github上的deploy密钥具有写权限，所以似乎还有其他问题...

pipeline {
   agent { docker { image 'node:8' } }

   stages {
      stage('Pull Repo') {
          steps {
            git (
                branch: 'master',
                credentialsId: 'cred-id',
                url: 'github.com:***'
            )
            sshagent(['github-omnia']) {
                sh("git tag -a \"release-2.3.${BUILD_NUMBER}\" -m \"Jenkins built ${BUILD_NUMBER}\"")
                sh("git push --tags")
            }
          }
      }
   }
}

我想念什么吗？

编辑： 这是错误的控制台输出

[ssh-agent] Using credentials git (Access to Github-**)
[ssh-agent] Looking for ssh-agent implementation...
[ssh-agent]   Exec ssh-agent (binary ssh-agent on a remote machine)
$ docker exec a6cee721d592b10bb94abbde0471d24a4320dcd07362affb1f18454d6ebe028d ssh-agent
SSH_AUTH_SOCK=/tmp/ssh-TI7dNVoYszsC/agent.12
SSH_AGENT_PID=17
Running ssh-add (command line suppressed)
Identity added: /var/jenkins_home/workspace/Build-And-Deploy-***@tmp/private_key_7884642190516796613.key (/var/jenkins_home/workspace/Build-And-Deploy-***@tmp/private_key_7884642190516796613.key)
[ssh-agent] Started.
[Pipeline] {
[Pipeline] sh
+ git config --global user.email jenkins@***.se
[Pipeline] sh
+ git config --global user.name Jenkins
[Pipeline] sh
+ git remote set-url origin git@github.com:***/***
[Pipeline] sh
+ git tag -a release-2.3.3 -m Jenkins built 3
[Pipeline] sh
+ git push origin --tags
Host key verification failed.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Answer 1

我一直在寻找一种无需完全忽略主机验证，也无需修改Jenkins机器的known_hosts的方法，因为我想使用docker。我最终得到了这样的东西：

在Jenkins中，创建一个类型为“秘密文本”的新凭据（我们将其称为GITHUB_HOST_KEY），并将其值设置为主机密钥，例如：

# gets the host for github and copies it. You can run this from
# any computer that has access to github.com (or whatever your
# git server is)
ssh-keyscan github.com | clip

在您的Jenkins文件中，使用known_hosts之前将字符串保存到sshagent。这是我的管道；它需要一个名为master-v5的分支，并生成一个分支master-v5-dist，其中包含许多构建文件。

pipeline {
    agent { docker { image 'node:14' } }

    stages {
        stage('Checkout') {
            steps {
                git branch: 'master-v5',
                    url: 'git@github.com:internetarchive/bookreader.git',
                    credentialsId: 'YOUR_GH_CREDENTIALS'
            }
        }
        stage('Build') { steps { sh 'npm install && npm run build' } }
        stage('Push') {
            steps {
                sh 'git config user.email "foo@bar.com"'
                sh 'git config user.name "Mr. Foo Bar"'
                
                sh 'git add BookReader'
                sh 'git commit -m Build files [ci skip]'

                withCredentials([string(credentialsId: 'GITHUB_HOST_KEY', variable: 'GITHUB_HOST_KEY')]) {
                    sh 'mkdir -p ~/.ssh && echo "$GITHUB_HOST_KEY" >> ~/.ssh/known_hosts'
                }
                sshagent (credentials: ['YOUR_GH_CREDENTIALS']) {
                    sh 'git push -f origin HEAD:master-v5-dist'
                }
            }
        }
    }
}

这可以确保您使用的是可信任的主机密钥，因为（肯定是）在确定您已连接到真实的github.com时获得了主机密钥。

Jenkins管道ssh代理git push失败

1 个答案: