fix: strip CRLF from inputs + add .gitattributes (eol=lf) -- fixes ssh username 'invalid characters'

.gitattributes

@@ -0,0 +1 @@
+*.yaml eol=lf

build-and-push/action.yaml

@@ -72,6 +72,13 @@ runs:
         BUILDER_HOST: ${{ inputs.docker_host }}
         BUILDER_USER: ${{ inputs.docker_user }}
       run: |
+        # Defensive: strip any stray CR (CRLF checkout via core.autocrlf can
+        # turn "root" into "root\r", which ssh rejects with
+        # "remote username contains invalid characters").
+        SSH_KEY=$(printf '%s' "${SSH_KEY}" | tr -d '\r')
+        BUILDER_HOST=$(printf '%s' "${BUILDER_HOST}" | tr -d '\r')
+        BUILDER_USER=$(printf '%s' "${BUILDER_USER}" | tr -d '\r')
+
         mkdir -p ~/.ssh
         echo "${SSH_KEY}" > ~/.ssh/id_ed25519
         chmod 600 ~/.ssh/id_ed25519
@@ -161,7 +168,8 @@ runs:
       run: |
         ARGS=""
         while IFS= read -r line; do
-          trimmed=$(echo "${line}" | xargs)
+          # strip stray CR (CRLF checkout) and surrounding whitespace
+          trimmed=$(printf '%s' "${line}" | tr -d '\r' | xargs)
           if [ -n "${trimmed}" ]; then
             ARGS="${ARGS} --build-arg ${trimmed}"
           fi

deploy-restart/action.yaml

@@ -54,7 +54,8 @@ runs:
       env:
         KUBE_CONFIG: ${{ inputs.kube_config }}
       run: |
-        echo "${KUBE_CONFIG}" > kubeconfig.yaml
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > kubeconfig.yaml
         kubectl --kubeconfig=kubeconfig.yaml cluster-info
 
     - name: Rollout restart

kubectl-apply/action.yaml

@@ -63,7 +63,8 @@ runs:
       env:
         KUBE_CONFIG: ${{ inputs.kube_config }}
       run: |
-        echo "${KUBE_CONFIG}" > kubeconfig.yaml
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > kubeconfig.yaml
         kubectl --kubeconfig=kubeconfig.yaml cluster-info
 
     - name: Apply manifests
@@ -73,6 +74,11 @@ runs:
         MANIFESTS: ${{ inputs.manifests }}
         NAMESPACE: ${{ inputs.namespace }}
       run: |
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        NAMESPACE=$(printf '%s' "${NAMESPACE}" | tr -d '\r')
+        MANIFEST=$(printf '%s' "${MANIFEST}" | tr -d '\r')
+        MANIFESTS=$(printf '%s' "${MANIFESTS}" | tr -d '\r')
+
         NS_FLAG=""
         if [ -n "${NAMESPACE}" ] && [ "${NAMESPACE// }" != "" ]; then
           NS_FLAG="-n ${NAMESPACE}"

ssh-deploy/action.yaml

@@ -74,6 +74,12 @@ runs:
         SSH_HOST: ${{ inputs.ssh_host }}
         SSH_PORT: ${{ inputs.ssh_port }}
       run: |
+        # strip stray CR (CRLF checkout via core.autocrlf) so ssh never sees
+        # an invalid username/host like "root\r"
+        SSH_KEY=$(printf '%s' "${SSH_KEY}" | tr -d '\r')
+        SSH_HOST=$(printf '%s' "${SSH_HOST}" | tr -d '\r')
+        SSH_PORT=$(printf '%s' "${SSH_PORT}" | tr -d '\r')
+
         mkdir -p ~/.ssh
         echo "${SSH_KEY}" > ~/.ssh/id_deploy
         chmod 600 ~/.ssh/id_deploy
@@ -97,6 +103,15 @@ runs:
         OVERRIDE_IMAGE: ${{ inputs.image }}
         OVERRIDE_TAG: ${{ inputs.image_tag }}
       run: |
+        # strip stray CR (CRLF checkout via core.autocrlf)
+        SSH_HOST=$(printf '%s' "${SSH_HOST}" | tr -d '\r')
+        SSH_PORT=$(printf '%s' "${SSH_PORT}" | tr -d '\r')
+        SSH_USERNAME=$(printf '%s' "${SSH_USERNAME}" | tr -d '\r')
+        REMOTE_DIR=$(printf '%s' "${REMOTE_DIR}" | tr -d '\r')
+        COMPOSE_FILES=$(printf '%s' "${COMPOSE_FILES}" | tr -d '\r')
+        OVERRIDE_IMAGE=$(printf '%s' "${OVERRIDE_IMAGE}" | tr -d '\r')
+        OVERRIDE_TAG=$(printf '%s' "${OVERRIDE_TAG}" | tr -d '\r')
+
         # Build -f flags if compose_files is provided
         COMPOSE_FLAGS=""
         if [ -n "${COMPOSE_FILES}" ] && [ "${COMPOSE_FILES// }" != "" ]; then