Host key verification fails with multiple uses in same job

[PedrelliMath]

URL

No response

Issue Description

When using the same job to deploy to multiple environments, the job fails with the following error:

"Host key verification failed."

I worked around this issue by splitting the deployment into separate jobs for each environment.

Log Output

error during connect: Get "http://docker.example.com/v1.49/info": command [ssh -o ConnectTimeout=30 -T -l *** -p *** -- *** docker system dial-stdio] has exited with exit status 255, make sure the URL is valid, and Docker 18.09 or later is installed on the remote host: stderr=Host key verification failed.

[smashedr]

That sounds like a bug I would like to get fixed!

If the repository is public, it would be very helpful to get a link to the action logs...

The test does a double deployment in a single job, however; to the same host with the same key. I will have to add another environment to the test harness just to attempt to reproduce the issue. Thank you very much for raising this issue, but I may need a few days to setup a reproduction.

[PedrelliMath]

In my case, its diferent hosts and diferent keys.

Private repo sorry

[smashedr]

Just a quick update; I did a test locally but was not able to reproduce the issue. I would have expected this to reproduce the issue.

This test deployed to 2 different hosts, with 2 different users and 2 different SSH keys in a single job.
Test run logs: log.txt

- name: "1: Write YAML"
  if: ${{ !cancelled() }}
  uses: teunmooij/yaml@v1
  with:
    to-file: "docker-compose.yaml"
    data: |
      {"version":"3.8","services":{"alpine":{"image":"alpine:latest","command":"tail -f /dev/null"}}}

- name: "1: Test Host 1"
  if: ${{ !cancelled() }}
  uses: ./
  with:
    name: test_stack-deploy
    file: docker-compose.yaml
    host: ${{ secrets.DOCKER_HOST }}
    port: ${{ secrets.DOCKER_PORT }}
    user: ${{ secrets.DOCKER_USER }}
    ssh_key: ${{ secrets.DOCKER_SSH_KEY }}
    detach: true
    summary: false

- name: "2: Write YAML"
  if: ${{ !cancelled() && !github.event.act }}
  uses: teunmooij/yaml@v1
  with:
    to-file: "docker-compose.yaml"
    data: |
      {"version":"3.8","services":{"alpine":{"image":"alpine:latest","command":"tail -f /dev/null"}}}

- name: "2: Test Host 2"
  if: ${{ !cancelled() && !github.event.act }}
  uses: ./
  with:
    name: test_stack-deploy
    file: docker-compose.yaml
    host: ${{ secrets.DOCKER_HOST2 }}
    port: ${{ secrets.DOCKER_PORT }}
    user: ${{ secrets.DOCKER_USER2 }}
    ssh_key: ${{ secrets.DOCKER_SSH_KEY2 }}
    mode: compose
    summary: false

I can't imagine what could be different in the github actions environment. But when I get some spare time over the weekend I can setup another environment for testing from github actions and add some more secrets.

In the mean time, I would be glad to review your logs, just make sure there is NO SENSITIVE information in them. You can view the raw logs from the steps below:

[PedrelliMath]

  deploy-producao:
    name: 'Deploy Prod'
    runs-on: ubuntu-latest
    needs:
      - build-and-push-image
    timeout-minutes: 5
    steps:
      - name: 'Checkout'
        uses: actions/checkout@v2
        with:
          token: ${{ secrets.GHCR_PASS }}
      
      - name: Extract Tag
        run: echo "RELEASE_TAG=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV

      - name: Print Tag
        run: echo "Tag is $RELEASE_TAG"
    
      - name: create env file
        run: |
          echo "GIT_RELEASE_TAG=$RELEASE_TAG" >> ./envfile

      - name: 'Docker Stack Deploy Env 1'
        uses: cssnr/stack-deploy-action@v1.0.1
        with:
          host: ${{ secrets.ENV1_DOCKER_HOST }}
          port: ${{ secrets.ENV1_DOCKER_PORT }}
          user: ${{ secrets.ENV1_DOCKER_USER }}
          ssh_key: '${{ secrets.ENV1_DOCKER_SSH_KEY }}'
          registry_auth: true
          registry_host: ${{ env.REGISTRY }}
          registry_user: ${{ secrets.GHCR_USER }}
          registry_pass: ${{ secrets.GHCR_PASS }}
          file: docker-stack-prod.yaml
          name: env-stack
          env_file: ./envfile

      - name: 'Docker Stack Deploy Env 2'
        uses: cssnr/stack-deploy-action@v1.0.1
        with:
          host: ${{ secrets.ENV2_DOCKER_HOST }}
          port: ${{ secrets.ENV2_DOCKER_PORT }}
          user: ${{ secrets.ENV2_DOCKER_USER }}
          ssh_key: '${{ secrets.ENV2_DOCKER_SSH_KEY }}'
          registry_auth: true
          registry_host: ${{ env.REGISTRY }}
          registry_user: ${{ secrets.GHCR_USER }}
          registry_pass: ${{ secrets.GHCR_PASS }}
          file: docker-stack-prod.yaml
          name: env-stack
          env_file: ./envfile

I also tested with the latest action version (1.3.2) but still the same

Raw logs:

2025-05-14T18:45:57.9028515Z ##[group]Run cssnr/stack-deploy-action@v1.0.1
2025-05-14T18:45:57.9028880Z with:
2025-05-14T18:45:57.9029145Z host: ***
2025-05-14T18:45:57.9029392Z port: ***
2025-05-14T18:45:57.9029632Z user: ***
2025-05-14T18:45:57.9031461Z ssh_key: ***

2025-05-14T18:45:57.9031716Z registry_auth: true
2025-05-14T18:45:57.9031975Z registry_host: ghcr.io
2025-05-14T18:45:57.9032279Z registry_user: ***
2025-05-14T18:45:57.9032668Z registry_pass: ***
2025-05-14T18:45:57.9032941Z file: docker-stack-prod.yaml
2025-05-14T18:45:57.9033235Z name: env-stack
2025-05-14T18:45:57.9033480Z env_file: ./envfile
2025-05-14T18:45:57.9033720Z env:
2025-05-14T18:45:57.9033939Z REGISTRY: ghcr.io
2025-05-14T18:45:57.9034191Z IMAGE_NAME: /
2025-05-14T18:45:57.9034462Z RELEASE_TAG: 1.0.1
2025-05-14T18:45:57.9034701Z ##[endgroup]
2025-05-14T18:45:57.9132055Z ##[command]/usr/bin/docker run --name c1b9eadf9c6dadf4734a8e4c741b4e66b93_d18044 --label 744c1b --workdir /github/workspace --rm -e "REGISTRY" -e "IMAGE_NAME" -e "RELEASE_TAG" -e "INPUT_HOST" -e "INPUT_PORT" -e "INPUT_USER" -e "INPUT_SSH_KEY" -e "INPUT_REGISTRY_AUTH" -e "INPUT_REGISTRY_HOST" -e "INPUT_REGISTRY_USER" -e "INPUT_REGISTRY_PASS" -e "INPUT_FILE" -e "INPUT_NAME" -e "INPUT_ENV_FILE" -e "INPUT_PASS" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e "ACTIONS_RESULTS_URL" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/runner_file_commands":"/github/file_commands" -v "/home/runner/work/ans-api/ans-api":"/github/workspace" 744c1b:9eadf9c6dadf4734a8e4c741b4e66b93
2025-05-14T18:45:58.6615011Z Running: /main.sh as: root in: /github/workspace
2025-05-14T18:45:59.0168440Z # : SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
2025-05-14T18:45:59.5813576Z # : SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
2025-05-14T18:46:00.1470386Z # : SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
2025-05-14T18:46:00.7128000Z # : SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
2025-05-14T18:46:00.8850933Z # : SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.13
2025-05-14T18:46:01.0584541Z �[36mAdding SSH Key to SSH Agent
2025-05-14T18:46:01.0641475Z Agent pid 14
2025-05-14T18:46:01.0687555Z Identity added: /root/.ssh/id_rsa ()
2025-05-14T18:46:01.0695565Z �[36mVerifying Docker and Setting Context.
2025-05-14T18:46:03.7039102Z remote
2025-05-14T18:46:03.7040360Z Successfully created context "remote"
2025-05-14T18:46:03.7135688Z Current context is now "remote"
2025-05-14T18:46:03.7137592Z remote
2025-05-14T18:46:03.7227319Z NAME DESCRIPTION DOCKER ENDPOINT ERROR
2025-05-14T18:46:03.7228872Z default Current DOCKER_HOST based configuration unix:///var/run/docker.sock
2025-05-14T18:46:03.7231565Z remote * ssh://@:**
2025-05-14T18:46:03.7238561Z �[36mSourcing Environment File: �[37;1m./envfile
2025-05-14T18:46:03.7249462Z File: ./envfile
2025-05-14T18:46:03.7250253Z Size: *** Blocks: 8 IO Block: 4096 regular file
2025-05-14T18:46:03.7252212Z Device: 801h/2049d Inode: 320239 Links: 1
2025-05-14T18:46:03.7253235Z Access: (0644/-rw-r--r--) Uid: ( 1001/ UNKNOWN) Gid: ( 118/ UNKNOWN)
2025-05-14T18:46:03.7256246Z Access: 2025-05-14 18:45:57.895897976 +0000
2025-05-14T18:46:03.7256791Z Modify: 2025-05-14 18:45:57.895897976 +0000
2025-05-14T18:46:03.7257533Z Change: 2025-05-14 18:45:57.895897976 +0000
2025-05-14T18:46:03.7260308Z �[36mLogging in to Registry: �[37;1mghcr.io
2025-05-14T18:46:09.2100673Z WARNING! Your password will be stored unencrypted in /github/home/.docker/config.json.
2025-05-14T18:46:09.2103759Z Configure a credential helper to remove this warning. See
2025-05-14T18:46:09.2105086Z https://docs.docker.com/engine/reference/commandline/login/#credentials-store
2025-05-14T18:46:09.2106682Z
2025-05-14T18:46:09.2107689Z Login Succeeded
2025-05-14T18:46:09.2144814Z Adding extra arg: --with-registry-auth
2025-05-14T18:46:09.2147804Z �[36mDeploying Stack: �[37;1msisdim-stack
2025-05-14T18:46:14.4436046Z Updating service env-stack**** (id: b59czxs7tn7r3uhu5z21j8qlh)
2025-05-14T18:46:16.2549525Z �[32;1mFinished Success.
2025-05-14T18:46:16.3572699Z ##[group]Run cssnr/stack-deploy-action@v1.0.1
2025-05-14T18:46:16.3573085Z with:
2025-05-14T18:46:16.3573344Z host: ***
2025-05-14T18:46:16.3573583Z port: ***
2025-05-14T18:46:16.3573818Z user: ***
2025-05-14T18:46:16.3575547Z ssh_key: ***

2025-05-14T18:46:16.3575802Z registry_auth: true
2025-05-14T18:46:16.3576066Z registry_host: ghcr.io
2025-05-14T18:46:16.3576359Z registry_user: ***
2025-05-14T18:46:16.3576783Z registry_pass: ***
2025-05-14T18:46:16.3577399Z file: docker-stack-prod.yaml
2025-05-14T18:46:16.3577771Z name: env-stack
2025-05-14T18:46:16.3578030Z env_file: ./envfile
2025-05-14T18:46:16.3578281Z env:
2025-05-14T18:46:16.3578504Z REGISTRY: ghcr.io
2025-05-14T18:46:16.3578767Z IMAGE_NAME: /
2025-05-14T18:46:16.3579063Z RELEASE_TAG: 1.0.1
2025-05-14T18:46:16.3579309Z ##[endgroup]
2025-05-14T18:46:16.3592487Z ##[command]/usr/bin/docker run --name c1b9eadf9c6dadf4734a8e4c741b4e66b93_d683d5 --label 744c1b --workdir /github/workspace --rm -e "REGISTRY" -e "IMAGE_NAME" -e "RELEASE_TAG" -e "INPUT_HOST" -e "INPUT_PORT" -e "INPUT_USER" -e "INPUT_SSH_KEY" -e "INPUT_REGISTRY_AUTH" -e "INPUT_REGISTRY_HOST" -e "INPUT_REGISTRY_USER" -e "INPUT_REGISTRY_PASS" -e "INPUT_FILE" -e "INPUT_NAME" -e "INPUT_ENV_FILE" -e "INPUT_PASS" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e "ACTIONS_RESULTS_URL" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/home/runner/work/_temp/_github_home":"/github/home" -v "/home/runner/work/_temp/_github_workflow":"/github/workflow" -v "/home/runner/work/_temp/_runner_file_commands":"/github/file_commands" -v "/home/runner/work/ans-api/ans-api":"/github/workspace" 744c1b:9eadf9c6dadf4734a8e4c741b4e66b93
2025-05-14T18:46:16.5889029Z Running: /main.sh as: root in: /github/workspace
2025-05-14T18:46:16.9385582Z # : SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11
2025-05-14T18:46:17.1061410Z # : SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11
2025-05-14T18:46:17.6684544Z # : SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11
2025-05-14T18:46:18.2266339Z # : SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11
2025-05-14T18:46:18.7853040Z # : SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.11
2025-05-14T18:46:18.9578956Z �[36mAdding SSH Key to SSH Agent
2025-05-14T18:46:18.9637466Z Agent pid 14
2025-05-14T18:46:18.9675912Z Identity added: /root/.ssh/id_rsa ()
2025-05-14T18:46:18.9685648Z �[36mVerifying Docker and Setting Context.
2025-05-14T18:46:21.7469894Z remote
2025-05-14T18:46:21.7470603Z Current context is now "remote"
2025-05-14T18:46:21.7571246Z NAME DESCRIPTION DOCKER ENDPOINT ERROR
2025-05-14T18:46:21.7572826Z default Current DOCKER_HOST based configuration unix:///var/run/docker.sock
2025-05-14T18:46:21.7573842Z remote * ssh://@:*
2025-05-14T18:46:21.7581659Z �[36mSourcing Environment File: �[37;1m./envfile
2025-05-14T18:46:21.7589711Z File: ./envfile
2025-05-14T18:46:21.7595498Z Size: *** Blocks: 8 IO Block: 4096 regular file
2025-05-14T18:46:21.7596187Z Device: 801h/2049d Inode: 320239 Links: 1
2025-05-14T18:46:21.7596881Z Access: (0644/-rw-r--r--) Uid: ( 1001/ UNKNOWN) Gid: ( 118/ UNKNOWN)
2025-05-14T18:46:21.7598106Z Access: 2025-05-14 18:46:03.723966973 +0000
2025-05-14T18:46:21.7598643Z Modify: 2025-05-14 18:45:57.895897976 +0000
2025-05-14T18:46:21.7599192Z Change: 2025-05-14 18:45:57.895897976 +0000
2025-05-14T18:46:21.7599893Z �[36mLogging in to Registry: �[37;1mghcr.io
2025-05-14T18:46:25.8966496Z error during connect: Post "http://docker.example.com/v1.24/auth": command [ssh -o ConnectTimeout=30 -l *** -p *** -- *** docker system dial-stdio] has exited with exit status 255, please make sure the URL is valid, and Docker 18.09 or later is installed on the remote host: stderr=Host key verification failed.
2025-05-14T18:46:25.8968545Z
2025-05-14T18:46:25.8974328Z �[31;1mScript Exited with Error: 1
2025-05-14T18:46:25.9888460Z Post job cleanup.
2025-05-14T18:46:26.0839780Z [command]/usr/bin/git version
2025-05-14T18:46:26.0887928Z git version 2.49.0
2025-05-14T18:46:26.0933797Z Temporarily overriding HOME='/home/runner/work/_temp/47dc09b5-63da-4c8f-9a44-bf719d06161d' before making global git config changes
2025-05-14T18:46:26.0937469Z Adding repository directory to the temporary git global config as a safe directory
2025-05-14T18:46:26.0939613Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/ans-api/ans-api
2025-05-14T18:46:26.0974940Z [command]/usr/bin/git config --local --name-only --get-regexp core.sshCommand
2025-05-14T18:46:26.1008913Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
2025-05-14T18:46:26.1256170Z [command]/usr/bin/git config --local --name-only --get-regexp http.https://github.com/.extraheader
2025-05-14T18:46:26.1274940Z http.https://github.com/.extraheader
2025-05-14T18:46:26.1286145Z [command]/usr/bin/git config --local --unset-all http.https://github.com/.extraheader
2025-05-14T18:46:26.1319236Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http.https://github.com/.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
2025-05-14T18:46:26.1689170Z Cleaning up orphan processes

[TrezOne]

I might be able to help with this one, although my set up is a tad different since I'm using a self-hosted instance of Gitea with the Gitea Runner (aside from some slight differences, Gitea and Github are almost identical in functionality). I was testing the new version of the action (v1.4.0) which ran successfully. Afterwards, I went into the settings of the repo I was testing it against to clean up some seemingly unused secrets, primarily the public key used by the Gitea Runner. Which is where I started running into problems.

Fast forward to now, I re-added the public key as a secret in the repo and bam! The action succeeded after restoration.

[smashedr]

I also created a new action, that may work better for multiple/complex deployments.

See the README.md on GitHub for more details: https://github.com/cssnr/docker-context-action

Feel free to open a Discussion or Issue over there if you have more questions...