From fc7ed6bd15abe9bb855c286357617990f1ec2e80 Mon Sep 17 00:00:00 2001
From: Jose Henrique <jose.henrique.ivan@gmail.com>
Date: Mon, 13 Jul 2026 19:39:29 -0300
Subject: [PATCH] fix: strip CRLF from inputs + add .gitattributes (eol=lf) --
 fixes ssh username 'invalid characters'

---
 .gitattributes             |  1 +
 build-and-push/action.yaml | 10 +++++++++-
 deploy-restart/action.yaml |  3 ++-
 kubectl-apply/action.yaml  |  8 +++++++-
 ssh-deploy/action.yaml     | 15 +++++++++++++++
 5 files changed, 34 insertions(+), 3 deletions(-)
 create mode 100644 .gitattributes

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..4431c9f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+*.yaml eol=lf
diff --git a/build-and-push/action.yaml b/build-and-push/action.yaml
index 9b5d8f2..4a9e016 100644
--- a/build-and-push/action.yaml
+++ b/build-and-push/action.yaml
@@ -72,6 +72,13 @@ runs:
         BUILDER_HOST: ${{ inputs.docker_host }}
         BUILDER_USER: ${{ inputs.docker_user }}
       run: |
+        # Defensive: strip any stray CR (CRLF checkout via core.autocrlf can
+        # turn "root" into "root\r", which ssh rejects with
+        # "remote username contains invalid characters").
+        SSH_KEY=$(printf '%s' "${SSH_KEY}" | tr -d '\r')
+        BUILDER_HOST=$(printf '%s' "${BUILDER_HOST}" | tr -d '\r')
+        BUILDER_USER=$(printf '%s' "${BUILDER_USER}" | tr -d '\r')
+
         mkdir -p ~/.ssh
         echo "${SSH_KEY}" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
@@ -161,7 +168,8 @@ runs:
       run: |
         ARGS=""
         while IFS= read -r line; do
-          trimmed=$(echo "${line}" | xargs)
+          # strip stray CR (CRLF checkout) and surrounding whitespace
+          trimmed=$(printf '%s' "${line}" | tr -d '\r' | xargs)
           if [ -n "${trimmed}" ]; then
             ARGS="${ARGS} --build-arg ${trimmed}"
           fi
diff --git a/deploy-restart/action.yaml b/deploy-restart/action.yaml
index e44e338..624dd49 100644
--- a/deploy-restart/action.yaml
+++ b/deploy-restart/action.yaml
@@ -54,7 +54,8 @@ runs:
       env:
         KUBE_CONFIG: ${{ inputs.kube_config }}
       run: |
-        echo "${KUBE_CONFIG}" > kubeconfig.yaml
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > kubeconfig.yaml
         kubectl --kubeconfig=kubeconfig.yaml cluster-info
 
     - name: Rollout restart
diff --git a/kubectl-apply/action.yaml b/kubectl-apply/action.yaml
index c9e38a3..d713c5d 100644
--- a/kubectl-apply/action.yaml
+++ b/kubectl-apply/action.yaml
@@ -63,7 +63,8 @@ runs:
       env:
         KUBE_CONFIG: ${{ inputs.kube_config }}
       run: |
-        echo "${KUBE_CONFIG}" > kubeconfig.yaml
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > kubeconfig.yaml
         kubectl --kubeconfig=kubeconfig.yaml cluster-info
 
     - name: Apply manifests
@@ -73,6 +74,11 @@ runs:
         MANIFESTS: ${{ inputs.manifests }}
         NAMESPACE: ${{ inputs.namespace }}
       run: |
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        NAMESPACE=$(printf '%s' "${NAMESPACE}" | tr -d '\r')
+        MANIFEST=$(printf '%s' "${MANIFEST}" | tr -d '\r')
+        MANIFESTS=$(printf '%s' "${MANIFESTS}" | tr -d '\r')
+
         NS_FLAG=""
         if [ -n "${NAMESPACE}" ] && [ "${NAMESPACE// }" != "" ]; then
           NS_FLAG="-n ${NAMESPACE}"
diff --git a/ssh-deploy/action.yaml b/ssh-deploy/action.yaml
index 7d17106..3efcf0a 100644
--- a/ssh-deploy/action.yaml
+++ b/ssh-deploy/action.yaml
@@ -74,6 +74,12 @@ runs:
         SSH_HOST: ${{ inputs.ssh_host }}
         SSH_PORT: ${{ inputs.ssh_port }}
       run: |
+        # strip stray CR (CRLF checkout via core.autocrlf) so ssh never sees
+        # an invalid username/host like "root\r"
+        SSH_KEY=$(printf '%s' "${SSH_KEY}" | tr -d '\r')
+        SSH_HOST=$(printf '%s' "${SSH_HOST}" | tr -d '\r')
+        SSH_PORT=$(printf '%s' "${SSH_PORT}" | tr -d '\r')
+
         mkdir -p ~/.ssh
         echo "${SSH_KEY}" > ~/.ssh/id_deploy
         chmod 600 ~/.ssh/id_deploy
@@ -97,6 +103,15 @@ runs:
         OVERRIDE_IMAGE: ${{ inputs.image }}
         OVERRIDE_TAG: ${{ inputs.image_tag }}
       run: |
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        SSH_HOST=$(printf '%s' "${SSH_HOST}" | tr -d '\r')
+        SSH_PORT=$(printf '%s' "${SSH_PORT}" | tr -d '\r')
+        SSH_USERNAME=$(printf '%s' "${SSH_USERNAME}" | tr -d '\r')
+        REMOTE_DIR=$(printf '%s' "${REMOTE_DIR}" | tr -d '\r')
+        COMPOSE_FILES=$(printf '%s' "${COMPOSE_FILES}" | tr -d '\r')
+        OVERRIDE_IMAGE=$(printf '%s' "${OVERRIDE_IMAGE}" | tr -d '\r')
+        OVERRIDE_TAG=$(printf '%s' "${OVERRIDE_TAG}" | tr -d '\r')
+
         # Build -f flags if compose_files is provided
         COMPOSE_FLAGS=""
         if [ -n "${COMPOSE_FILES}" ] && [ "${COMPOSE_FILES// }" != "" ]; then