CI: Handle SSH host keys in upload script

.github/workflows/build.yml

@@ -1,15 +1,29 @@
 name: Build and Deploy
 on:
   workflow_dispatch:
+    inputs:
+      upload_packages:
+        description: 'Upload packages'
+        required: true
+        type: choice
+        default: 'on-merge'
+        options:
+          - 'on-merge'
+          - 'dry-run'
+          - 'skip'
+          - 'yes'
   pull_request:
     types:
+      - opened
+      - synchronize
+      - reopened
       - closed
     branches:
       - 'wpe-android'
 
 jobs:
   build:
-    if: ${{ (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/wpe-android') || (github.event_name == 'pull_request' && github.event.pull_request.merged == true) }}
+    if: ${{ (github.event_name == 'workflow_dispatch') || (github.event_name == 'pull_request' && github.event.pull_request.merged == true) }}
     runs-on: self-hosted
     strategy:
       matrix:
@@ -34,9 +48,12 @@ jobs:
           path: ./wpewebkit-android-${{ matrix.target }}*
           if-no-files-found: error
       - name: Upload packages to wpewebkit.org
+        if: ${{ inputs.upload_packages == 'yes' || inputs.upload_packages == 'dry-run' || (github.event.pull_request.merged == true && inputs.upload_packages == 'on-merge') }}
         run: |
           python3 ./.github/workflows/upload.py "./wpewebkit-android-${{ matrix.target }}*" || \
           echo "**:warning: WARNING :warning:** Cannot upload ./wpewebkit-android-${{ matrix.target }}... files to wpewebkit.org" >> $GITHUB_STEP_SUMMARY
           exit 0
         env:
+          UPLOAD_DRY_RUN: ${{ inputs.upload_packages == 'dry-run' }}
           UPLOAD_KEY_PASSWD: ${{ secrets.UPLOAD_KEY_PASSWD }}
+          UPLOAD_SSH_KNOWN_HOSTS: ${{ secrets.UPLOAD_SSH_KNOWN_HOSTS }}

.github/workflows/upload.py

@@ -12,6 +12,7 @@
 import os
 import sys
 
+dry_run = os.environ.get("UPLOAD_DRY_RUN", "false").lower().strip() in ("1", "yes", "true")
 log = logging.getLogger(__name__)
 
 _PKGNAME_REGEX = re.compile(r"""
@@ -74,7 +75,9 @@ def __repr__(self) -> str:
 
 
 async def with_sftp(fn, *arg, **kw):
-    async with asyncssh.connect("wpewebkit.org", port=7575, username="www-data", passphrase=os.getenv("UPLOAD_KEY_PASSWD")) as conn:
+    async with asyncssh.connect("wpewebkit.org", port=7575, username="www-data",
+                                known_hosts=asyncssh.import_known_hosts(os.getenv("UPLOAD_SSH_KNOWN_HOSTS")),
+                                passphrase=os.getenv("UPLOAD_KEY_PASSWD")) as conn:
         async with conn.start_sftp_client() as sftp:
             return await fn(sftp, *arg, **kw)
 
@@ -122,7 +125,10 @@ async def upload_tarball(sftp, path: Path, progress: bool):
     remotedir = f"wpewebkit/android/bootstrap/{spec.version}"
     print("Remote location:", remotedir)
     if not await sftp.isdir(remotedir):
-        await sftp.mkdir(remotedir)
+        if dry_run:
+            log.info("dry-run: Skipped target directory creation")
+        else:
+            await sftp.mkdir(remotedir)
 
     if spec.datecode:
         log.warn("Package '%s' already has a datecode, continuing anyway", path)
@@ -140,6 +146,10 @@ async def upload_tarball(sftp, path: Path, progress: bool):
     print("Remote symlink:", symlink_name)
     print("Remote filename:", str(spec))
 
+    if dry_run:
+        log.info("dry-run: Skipped package upload and symlink update.")
+        return
+
     progress_handler = None
     if progress:
         progress_handler = show_progress
@@ -153,7 +163,12 @@ async def upload_tarball(sftp, path: Path, progress: bool):
 
 
 async def main(path, progress):
-    logging.basicConfig(level=logging.WARN)
+    if dry_run:
+        logging.basicConfig(level=logging.INFO)
+        log.info("Note: UPLOAD_DRY_RUN was set, SFTP connection still used "
+                 "but packages will NOT be uploaded.")
+    else:
+        logging.basicConfig(level=logging.WARN)
     files = [path]
     if "*" in path:
         files = glob(path)