Fix deployment key whitespace

Fixes #77 (closed)

.gitlab-ci.yml

@@ -73,41 +73,8 @@ system-tests:
 # A template for a job that can update one of the grids.
 .update-grid: &UPDATE_GRID
   stage: "deploy"
-  script:
-    # Announce our intentions.
-    - |
-      echo "Hello $GITLAB_USER_LOGIN from $CI_JOB_NAME. I was triggered by $CI_PIPELINE_SOURCE"
-      echo "and I am deploying the $CI_COMMIT_BRANCH branch to the $CI_ENVIRONMENT_NAME environment."
-
-    # Copy the deploy key from the environment to a file so we can actually
-    # tell ssh to use it.
-    - |
-      # Make sure the deploy key file is not readable by anyone else.  Not
-      # that there should be anyone else looking - but OpenSSH won't even read
-      # it if it looks like it is too open.
-      umask 077
-
-      # Make up a safe-ish place on the filesystem to write the key.
-      KEY_PATH="$(mktemp -d)/deploy_key"
-
-      # The environment variable holding the path to the key is configured
-      # with GitLab using Terraform so we can retain some bare minimum level
-      # of confidentiality.
-      #
-      # It contains the *path to the key*.  It does not contain the key
-      # itself.
-      base64 --decode "${PRIVATESTORAGEIO_SSH_DEPLOY_KEY_PATH}" > "${KEY_PATH}"
-
-    # Update the deployment
-    - |
-      ./ci-tools/update-grid-servers "${KEY_PATH}" "${CI_ENVIRONMENT_NAME}"
-
-    # Remove the key from the filesystem to reduce the chance of unintentional
-    # disclosure.  Overall our handling of this key is still not *particulary*
-    # safe or secure but that's why the key is only authorized to perform a
-    # single very specific operation.
-    - |
-      rm -v "${KEY_PATH}"
+  script: |
+    env --ignore-environment - NIX_PATH=$NIX_PATH GITLAB_USER_LOGIN=$GITLAB_USER_LOGIN CI_JOB_NAME=$CI_JOB_NAME CI_PIPELINE_SOURCE=$CI_PIPELINE_SOURCE CI_COMMIT_BRANCH=$CI_COMMIT_BRANCH ./ci-tools/update-grid-servers "${PRIVATESTORAGEIO_SSH_DEPLOY_KEY_PATH}" "${CI_ENVIRONMENT_NAME}"
 
 # Update the staging deployment - only on a merge to the staging branch.
 update-staging: