CI always fails for external contributions

[emersion]

Selftest cannot run in forks, see e.g. #42

[mxmehl]

The selftest involves a deployment using the SSH key secret. I am not sure if there is any way how we could support this safely for PRs from forks. Do you see an option?

[emersion]

I think we could maybe use something like act to run the workflow in the runner without using GitHub directly. Or maybe even just fire up the runner?

[mxmehl]

But how would that remediate the security issue of potentially exposing the secret SSH key to untrusted users?

I think the main issue is with this SSH-based authentication we rely on in the first place. If we have SSH keys, they should be scoped to a specific directory, based on the PR number or another immutable variable. That would require some server-side logic though.

[emersion]

We can fire up a local SSH server in CI.

[mxmehl]

I am not sure I fully understand your approach. May I ask you to explain?