A public SSH key is the shareable half of an SSH key pair. Store the private half as a protected GitHub Actions secret, and install the public half on the remote virtual machine. section 4.1.2
Use a purpose-built public key when automating access:
- Generate a separate pair for GitHub Actions instead of exposing a personal private key. section 4.1.2
- Paste github_actions_key.pub into the Akamai Connected Cloud SSH Keys console. section 4.1.3
- Keep github_actions_key, without the .pub suffix, in the SSH_PRIVATE_KEY repository secret. section 4.1.2
- Connect without a password when the private key is available to the workflow and the public key is installed remotely. section 4.1.5
Automated NGINX installation
A GitHub Actions workflow writes its stored private key to ~/.ssh/id_rsa, applies chmod 600, and uses the matching public key already installed on the remote instance. It then connects through SSH and runs apt update followed by apt install nginx -y. section 4.1.5
Listing 4.3 Creating a new SSH key
# windows/mac/linux ssh-keygen -t rsa -b 4096 -f github_actions_key -N ""
Generate the matching private and public files with ssh-keygen before distributing them to GitHub Actions and the cloud provider. section 4.1.2
