feat(deploy): distribute code-queue github ssh identity

scripts/src/deploy.ts

@@ -2,6 +2,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runCommand } from "./command";
 import { type UniDeskConfig, type UniDeskMicroserviceConfig, repoRoot, rootPath } from "./config";
+import { ensureGithubSshIdentityForProvider } from "./deploy-ssh-identity";
 import { startJob } from "./jobs";
 import { coreInternalFetch } from "./microservices";
 
@@ -893,6 +894,40 @@ function pushStep(steps: StepResult[], result: StepResult): boolean {
   return result.ok;
 }
 
+async function ensureGithubSshIdentityStep(config: UniDeskConfig, service: UniDeskMicroserviceConfig): Promise<StepResult> {
+  const startedAt = nowIso();
+  const startedMs = Date.now();
+  progressLine("github-ssh-identity", "start", { serviceId: service.id, providerId: service.providerId });
+  try {
+    const result = await ensureGithubSshIdentityForProvider(config, service.providerId);
+    progressLine("github-ssh-identity", result.ok ? "succeeded" : "failed", {
+      serviceId: service.id,
+      providerId: service.providerId,
+      elapsedMs: elapsedMs(startedMs),
+      fingerprint: result.fingerprint,
+      seededFromLocal: result.seededFromLocal,
+      detail: result.ok ? result.detail : compactTail(result.detail, 1200),
+    });
+    return {
+      step: "github-ssh-identity",
+      ok: result.ok,
+      detail: result.detail,
+      startedAt,
+      finishedAt: nowIso(),
+      raw: result.raw,
+    };
+  } catch (error) {
+    const detail = error instanceof Error ? error.message : String(error);
+    progressLine("github-ssh-identity", "failed", {
+      serviceId: service.id,
+      providerId: service.providerId,
+      elapsedMs: elapsedMs(startedMs),
+      detail: compactTail(detail, 1200),
+    });
+    return { step: "github-ssh-identity", ok: false, detail, startedAt, finishedAt: nowIso(), raw: null };
+  }
+}
+
 async function applyOneService(config: UniDeskConfig, service: UniDeskMicroserviceConfig, desired: DeployManifestService, options: DeployOptions): Promise<Record<string, unknown>> {
   const steps: StepResult[] = [];
   const startedAt = nowIso();
@@ -904,6 +939,10 @@ async function applyOneService(config: UniDeskConfig, service: UniDeskMicroservi
 
   const runId = `${Date.now().toString(36)}-${Math.random().toString(16).slice(2, 8)}`;
   const exportDir = targetExportDir(service, runId);
+  if (service.id === "code-queue" && !targetIsMain(service)) {
+    const identity = await ensureGithubSshIdentityStep(config, service);
+    if (!pushStep(steps, identity)) return { ok: false, serviceId: service.id, startedAt, finishedAt: nowIso(), before, steps };
+  }
   const prepare = await step(config, service, "prepare-source", prepareSourceScript(service, desired, exportDir), targetIsMain(service) ? repoRoot : "/home/ubuntu", Math.min(options.timeoutMs, 180_000), !targetIsMain(service));
   if (!pushStep(steps, prepare)) return { ok: false, serviceId: service.id, startedAt, finishedAt: nowIso(), before, steps };
   const resolvedCommit = parseFullCommit(prepare.detail) || parseFullCommit(JSON.stringify(prepare.raw));