feat: allow a deploy key to be used with asdf validation

README.md

@@ -166,6 +166,10 @@ Setup process:
 1. Ensure that the file [`scripts/install-asdf-plugins.sh`](https://gitlab.com/gitlab-com/runbooks/-/blob/master/scripts/install-asdf-plugins.sh) exists in the repository. Tailor for the `asdf` configuration of the project.
 1. Ensure that the files [`scripts/update-asdf-version-variables.sh`](https://gitlab.com/gitlab-com/runbooks/-/blob/master/scripts/update-asdf-version-variables.sh) exists in the repository.
+1. If the job will need SSH access to GitLab using a [deploy key](https://docs.gitlab.com/ee/user/project/deploy_keys/), create the deploy key for the project to which access will be required. Add the private key to the `VALIDATE_ASDF_TOOL_VERSIONS_DEPLOY_KEY_FILE` CI/CD variable.
+    1. Note that the SSH Agent may fail to parse the private key if a final newline is omitted.
+    1. To generate the key, follow the instructions at <https://docs.gitlab.com/ee/user/ssh.html#generate-an-ssh-key-pair>.
+    1. TL;DR is `ssh-keygen -t rsa -b 2048 -C "asdf-validation deploy key for <project>"`
 1. Add the include to your `.gitlab-ci.yml` file:
 ```yaml
@@ -175,8 +179,8 @@ include:
   # Checks that the `.tool-versions` file is synced with .gitlab-ci-asdf-versions.yml,
   # that all the plugins are declared in `./scripts/install-asdf-plugins.sh`
   # and that ASDF is generally working
+  # see https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/blob/main/README.md#asdf-tool-versions
   - project: 'gitlab-com/gl-infra/common-ci-tasks'
-    ref: v0.0.0 # Look this up https://gitlab.com/gitlab-com/gl-infra/common-ci-tasks/-/releases
     file: asdf-tool-versions.yml
 ```

asdf-tool-versions.yml

@@ -9,7 +9,16 @@ validate_asdf_tool_versions:
     - apt-get update && apt-get install -y
         jq curl git bash build-essential libssl-dev zlib1g-dev
         libbz2-dev libreadline-dev libsqlite3-dev wget unzip
-        ca-certificates
+        ca-certificates openssh-client
+    # Handle the VALIDATE_ASDF_TOOL_VERSIONS_DEPLOY_KEY_FILE token if it exists...
+    - if [[ -n "${VALIDATE_ASDF_TOOL_VERSIONS_DEPLOY_KEY_FILE}" ]]; then
+        eval $(ssh-agent -s);
+        chmod 0600 "$VALIDATE_ASDF_TOOL_VERSIONS_DEPLOY_KEY_FILE";
+        ssh-add "$VALIDATE_ASDF_TOOL_VERSIONS_DEPLOY_KEY_FILE";
+        mkdir -p ~/.ssh;
+        chmod 700 ~/.ssh;
+        ssh-keyscan gitlab.com >> ~/.ssh/known_hosts;
+      fi
     - if [[ -n "${GL_ASDF_LEGACY_VERSIONS_FILE}" ]]; then echo "legacy_version_file = yes" >> ~/.asdfrc; fi
     - git clone https://github.com/asdf-vm/asdf.git "${ASDF_DIR}"
     - source "${ASDF_DIR}/asdf.sh"