fix(ci): reuse provider egress for backend-core artifacts

scripts/src/deploy-ssh-identity.ts

@@ -21,6 +21,7 @@ interface GithubSshIdentity {
 const identityId = "github.com";
 const defaultPrivateKeyPath = "/root/.ssh/id_ed25519";
 const defaultKnownHostsPath = "/root/.ssh/known_hosts";
+const providerGatewayWsEgressProxyUrl = "http://127.0.0.1:18789";
 
 function pgLiteral(value: string): string {
   return `'${value.replace(/'/gu, "''")}'`;
@@ -255,6 +256,66 @@ function shellQuote(value: string): string {
   return `'${value.replace(/'/gu, `'\\''`)}'`;
 }
 
+export function gitSshHttpConnectProxySource(): string {
+  return String.raw`#!/usr/bin/env python3
+import os
+import select
+import socket
+import sys
+from urllib.parse import urlparse
+
+if len(sys.argv) != 3:
+    raise SystemExit("usage: unidesk-git-ssh-http-connect.py host port")
+
+target_host = sys.argv[1]
+target_port = int(sys.argv[2])
+proxy = urlparse(os.environ.get("UNIDESK_GIT_SSH_HTTP_PROXY", "http://127.0.0.1:18789"))
+proxy_host = proxy.hostname or "127.0.0.1"
+proxy_port = proxy.port or 80
+
+sock = socket.create_connection((proxy_host, proxy_port), timeout=20)
+sock.sendall(f"CONNECT {target_host}:{target_port} HTTP/1.1\r\nHost: {target_host}:{target_port}\r\n\r\n".encode("ascii"))
+header = b""
+while b"\r\n\r\n" not in header:
+    chunk = sock.recv(4096)
+    if not chunk:
+        raise SystemExit("proxy closed before CONNECT response")
+    header += chunk
+head, rest = header.split(b"\r\n\r\n", 1)
+if not (head.startswith(b"HTTP/1.1 200") or head.startswith(b"HTTP/1.0 200")):
+    sys.stderr.write(head.decode("latin1", "replace") + "\n")
+    raise SystemExit(1)
+if rest:
+    os.write(1, rest)
+
+stdin_open = True
+sock.setblocking(False)
+while True:
+    readers = [sock]
+    if stdin_open:
+        readers.append(sys.stdin.buffer)
+    ready, _, _ = select.select(readers, [], [])
+    if sock in ready:
+        try:
+            data = sock.recv(65536)
+        except BlockingIOError:
+            data = b""
+        if not data:
+            break
+        os.write(1, data)
+    if stdin_open and sys.stdin.buffer in ready:
+        data = os.read(0, 65536)
+        if data:
+            sock.sendall(data)
+        else:
+            stdin_open = False
+            try:
+                sock.shutdown(socket.SHUT_WR)
+            except OSError:
+                pass
+`;
+}
+
 function distributeGithubIdentity(providerId: string, identity: GithubSshIdentity): { ok: boolean; detail: string; raw: unknown } {
   const payload = JSON.stringify({
     privateKey: identity.privateKey,
@@ -262,12 +323,23 @@ function distributeGithubIdentity(providerId: string, identity: GithubSshIdentit
     knownHosts: identity.knownHosts,
   });
   const remotePython = remoteInstallPythonSource();
+  const proxyPython = gitSshHttpConnectProxySource();
   const remoteCommand = [
+    "set -euo pipefail",
     `python3 -c ${shellQuote(remotePython)}`,
-    "auth_output=$(ssh -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -T git@github.com 2>&1 || true)",
+    `proxy_url=${shellQuote(providerGatewayWsEgressProxyUrl)}`,
+    "curl -fsSI --max-time 20 -x \"$proxy_url\" https://github.com >/dev/null",
+    "git_ssh_proxy=/tmp/unidesk-git-ssh-http-connect.py",
+    "cat > \"$git_ssh_proxy\" <<'UNIDESK_GIT_SSH_PROXY'",
+    proxyPython,
+    "UNIDESK_GIT_SSH_PROXY",
+    "chmod 700 \"$git_ssh_proxy\"",
+    "export UNIDESK_GIT_SSH_HTTP_PROXY=\"$proxy_url\"",
+    "export GIT_SSH_COMMAND=\"ssh -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -i $HOME/.ssh/id_ed25519 -o 'ProxyCommand=$git_ssh_proxy %h %p'\"",
+    "auth_output=$(ssh -o BatchMode=yes -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$HOME/.ssh/known_hosts -i $HOME/.ssh/id_ed25519 -o \"ProxyCommand=$git_ssh_proxy %h %p\" -T git@github.com 2>&1 || true)",
     "printf '%s\\n' \"$auth_output\"",
     "printf '%s\\n' \"$auth_output\" | grep -q 'successfully authenticated'",
-  ].join(" && ");
+  ].join("\n");
   const result = spawnSync(process.execPath, [
     rootPath("scripts", "cli.ts"),
     "ssh",