fix: a release job uses only the key it is given, never the runner's own

Measured on a throwaway Gitea: with the key secret unset, Preview's
publish job would have fallen back to the runner machine's own ssh
configuration — on the development VM, the production publish key — and
published a throwaway 9.9.9 to the real server. It was cancelled before
it ran. And with the key set, the job wrote over the runner account's own
~/.ssh/config and known_hosts.

Now, under Actions, a job without RELEASE_SSH_KEY stops; with it, the key,
its known_hosts and an ssh configuration live in the job's own directory
and every ssh and rsync goes through `ssh -F` (RELEASE_SSH_CONFIG in
release-lib), which reads nothing else. The key is deleted when the job
ends. By hand, nothing changes. Also records the end-to-end measurements
of Release 1 and of Preview's gate job in docs/releasing.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test-release-ci.sh

@@ -85,6 +85,11 @@ point canary 0.2.6.5
 
 cat > "$WORK/bin/ssh" <<'EOF'
 #!/bin/bash
+# ssh [-F CONFIG] HOST COMMAND: run COMMAND here, and note which
+# configuration it was given ("-" for the machine's own).
+config=-
+if [[ "$1" == -F ]]; then config="$2"; shift 2; fi
+echo "ssh $config" >> "${SSH_LOG:-/dev/null}"
 shift
 exec bash -c "$*"
 EOF
@@ -95,7 +100,7 @@ args=()
 while [[ $# -gt 0 ]]; do
     case "$1" in
         --ignore-existing) keep=1 ;;
-        -e) shift ;;
+        -e) echo "rsync $2" >> "${SSH_LOG:-/dev/null}"; shift ;;
         -*) ;;
         *) args+=("$1") ;;
     esac
@@ -266,7 +271,33 @@ check "a Gitea that cannot be asked is never taken as having no release" \
     refuses_saying "could not ask Gitea whether v0.2.6.9 exists" \
     env GITEA_URL=http://127.0.0.1:9 bash -c "RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' import 0.2.6.9 '$H5' '$COMMIT'"
 
-echo "5. build: only from master or a maintenance branch"
+echo "5. the release runner uses the key it is given, and only that"
+H8="$(make_release 0.2.6.8)"
+report "$WORK/reports/gate-report-preview-0.2.6.8.txt" 0.2.6.8 "$H8" "$(serves canary)" "$(serves stable)"
+"$GITEA" upload v0.2.6.8 "$WORK/reports/gate-report-preview-0.2.6.8.txt" >/dev/null
+before="$(packages)"
+check "under Actions, a job with no key stops before anything is published" \
+    refuses_saying "A job never uses the runner's own ssh keys" \
+    env GITHUB_ACTIONS=true bash -c "RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' preview 0.2.6.8 '$H8' gate-report-preview-0.2.6.8.txt"
+check "and nothing was" test "$(packages)" = "$before"
+job="$(mktemp -d -p "$WORK")"
+export SSH_LOG="$WORK/ssh.log"
+: > "$SSH_LOG"
+check "with a key, it publishes" \
+    env GITHUB_ACTIONS=true RELEASE_CI_WORK="$job" RELEASE_SSH_KEY="not a real key" \
+        RELEASE_SSH_KNOWN_HOSTS="10.0.0.1 ssh-ed25519 AAAA" RELEASE_SSH_ADDRESS=10.0.0.1 \
+        RELEASE_SSH_USER=classroom-publish "$CI" preview 0.2.6.8 "$H8" gate-report-preview-0.2.6.8.txt
+check "every ssh and rsync it made used the job's own configuration" \
+    bash -c "[[ -s '$SSH_LOG' ]] && ! grep -v -e 'ssh $job/ssh/config' -e 'rsync ssh -F $job/ssh/config' '$SSH_LOG'"
+check "which names the key, the host key and the account it was given" \
+    bash -c "grep -qx '    IdentityFile $job/ssh/key' '$job/ssh/config' \
+        && grep -qx '    UserKnownHostsFile $job/ssh/known_hosts' '$job/ssh/config' \
+        && grep -qx '    User classroom-publish' '$job/ssh/config' \
+        && grep -qx '    StrictHostKeyChecking yes' '$job/ssh/config'"
+check "and the key is gone when the job ends" test ! -e "$job/ssh/key"
+unset SSH_LOG
+
+echo "6. build: only from master or a maintenance branch"
 check "a feature branch is refused before anything is built" \
     bash -c "GITHUB_REF=refs/heads/feat/something RELEASE_CI_WORK=\$(mktemp -d -p '$WORK') '$CI' build 0.2.6.8 2>&1 \
         | grep -q 'releases are built from master or release/\\*, not refs/heads/feat/something'"