Release SSH host keys no longer managed – read below 👇 · webfactory/ssh-agent

Starting with this release, this action no longer writes GitHub's SSH host keys into the known_hosts SSH config file upon start.

GitHub changed their host keys on short notice this morning, see https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/. We took this as an opportunity to stop maintaining GH SSH keys in the code shipped with this action (#171).

What you need to do:

On GitHub hosted runners, nothing. ✔︎ These runners ship with SSH host keys (for github.com) maintained by directly by GitHub.
On self-hosted runners, review and fix your SSH known_hosts file:
- First, you'll find it bloated with redundant entries for github.com, as described in #106. Remove these entries.
- Review https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/. You probably removed the old (invalid) SSH key in the previous step.
- Configure GitHub's current SSH keys as documented on https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/githubs-ssh-key-fingerprints
- As long as versions before v0.8.0 of this action here are run on the self-hosted runner, the old entries will come back. Keep an eye on it, possibly you'll have to rinse & repeat.

Update to actions/checkout@v3 by @mpdude in #143
Allow the user to override the commands for git, ssh-agent, and ssh-add by @DilumAluthge in #154

New Contributors

Full Changelog: v0.7.0...v0.8.0