Jenkins 管道中的 Git 使用錯誤的 SSH 私鑰推回 Git 存儲庫

Question

我正在拉一個公共 git 存儲庫，我正在嘗試使用 denpal（SSH 私鑰）憑據將我的更改推回存儲庫。

stages {
  stage('Git clone') {
    steps {
      git branch: 'feature/Jenkinsfile',
        credentialsId: 'denpal',
        url: 'git@github.com:test/denpal.git'
    }
  }
  stage('Test Git') {
    steps {
      withCredentials([sshUserPrivateKey(credentialsId: 'denpal', keyFileVariable: 'SSH_KEY')]) {
        sh '''
        git commit --allow-empty -m "test withCredentials"
        git push origin feature/Jenkinsfile
        '''
      }
    }
  }

不幸的是，這給出了以下錯誤：

 > git --version # timeout=10
using GIT_SSH to set credentials denpal
 > git fetch --tags --force --progress git@github.com:test/denpal.git +refs/heads/*:refs/remotes/origin/*
 > git rev-parse refs/remotes/origin/feature/Jenkinsfile^{commit} # timeout=10
 > git rev-parse refs/remotes/origin/origin/feature/Jenkinsfile^{commit} # timeout=10
Checking out Revision ... (refs/remotes/origin/feature/Jenkinsfile)
 > git config core.sparsecheckout # timeout=10
 > git checkout -f ...
 > git branch -a -v --no-abbrev # timeout=10
 > git branch -D feature/Jenkinsfile # timeout=10
 > git checkout -b feature/Jenkinsfile ...
Commit message: "empty"
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (Test Git)
[Pipeline] withCredentials
Masking only exact matches of $SSH_KEY
[Pipeline] {
[Pipeline] sh
+ git commit --allow-empty -m test withCredentials
[feature/Jenkinsfile 3ff21fc] test withCredentials
+ git push origin feature/Jenkinsfile
ERROR: Permission to test/denpal.git denied to technology-labs.
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
[Pipeline] }
[Pipeline] // withCredentials  

我也試過這個，但這也失敗了：

withCredentials([sshUserPrivateKey(credentialsId: 'denpal', keyFileVariable: 'private_key', passphraseVariable: '', usernameVariable: 'git')]){ 

知道我做錯了什么嗎？

Answer 1

withCredentials()和sshUserPrivateKey行將私鑰寫入臨時文件並將位置分配給$SSH_KEY ，但沒有使用它，因為之后沒有對$SSH_KEY引用。

您可以使用$GIT_SSH_COMMAND ( docs ) 將私鑰文件告知 ssh 和 git。

代替：

git push origin feature/Jenkinsfile

和：

GIT_SSH_COMMAND="ssh -i $SSH_KEY" git push origin feature/Jenkinsfile

Answer 2

對上面 Rob 的回答的更全面的描述，讓 git checkout 與 Jenkins 聲明式管道語法的子模塊一起工作。

#!/usr/bin/env groovy

pipeline {
    agent any
    stages {

        stage ('Clone') {
            steps {
                checkout scm
                withCredentials([sshUserPrivateKey(credentialsId: 'bitbucket_ssh', keyFileVariable: 'SSH_KEY')]) {
                    sh 'GIT_SSH_COMMAND="ssh -i $SSH_KEY" git submodule update --init'
                }
            }
        }
    ...
    }
}

這是https://issues.jenkins.io/browse/JENKINS-20941的解決方法