From 19b019a8d877c8561fc787c63d4066ec10d9b72f Mon Sep 17 00:00:00 2001
From: Mathias Bergqvist <mthbqv@gmail.com>
Date: Mon, 20 Apr 2026 21:38:11 +0200
Subject: [PATCH] fix: ensure SSH key cleanup on failure in CD workflow

---
 .gitea/workflows/cd.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/cd.yml b/.gitea/workflows/cd.yml
index c6f160e..ebdab4c 100644
--- a/.gitea/workflows/cd.yml
+++ b/.gitea/workflows/cd.yml
@@ -32,6 +32,8 @@ jobs:
 
       - name: Update infra repo
         run: |
+          set -e
+          trap 'rm -rf /tmp/infra-update; rm -f ~/.ssh/infra_deploy_key' EXIT
           IMAGE_TAG="${{ github.sha }}"
           mkdir -p ~/.ssh
           echo "${{ secrets.INFRA_DEPLOY_KEY }}" > ~/.ssh/infra_deploy_key
@@ -52,6 +54,4 @@ jobs:
           GIT_SSH_COMMAND="ssh -i ~/.ssh/infra_deploy_key -o IdentitiesOnly=yes" \
             git push
 
-          rm -rf /tmp/infra-update
-          rm ~/.ssh/infra_deploy_key
           echo "Infra repo updated: ${SERVICE} → ${IMAGE_TAG}"