Push the provider sync with a deploy key instead of a PAT

[ndbroadbent]

The 0.2.0 release's "Push + Tag Provider" job (run) failed with could not read Username: GitHub no longer accepted TF_PROVIDER_GITHUB_TOKEN, a PAT last used for v0.1.12 in January. A local test of the same push showed that both a wrong token and an empty one fail with exactly that message, and a valid token works.

Changes

• The job pushes over SSH with TF_PROVIDER_DEPLOY_KEY (a release environment secret): a deploy key with write access to terraform-provider-logstruct only. Deploy keys don't expire.
• GitHub's host keys come from api.github.com/meta, so the key is only offered to github.com.
• Before cloning or changing anything, the job checks the secret is set and GitHub accepts it, and fails with a clear error otherwise.
• release_workflow_test.rb checks the job uses the deploy key, no longer uses the token, and checks the key before cloning.
• AGENTS.md describes the deploy key and the provider repo's GPG signing key.

Tested

• The new step's script, run locally against the real repo, with its two pushes replaced by echoes:
  • With the deploy key: clones, skips the existing v0.2.0 tag, and would push a new tag.
  • With no key: fails with the "isn't set" error.
  • With a wrong key: fails with the "didn't accept" error before cloning.
• The workflow tests (4) and the pre-commit hooks pass: 491 tests, Sorbet, RuboCop, cspell and Prettier. actionlint is clean.

Already done for v0.2.0

• The deploy key is added to the provider repo (write access) and its private half is the TF_PROVIDER_DEPLOY_KEY secret.
• v0.2.0's provider sync was pushed with that key, the same commit and tag this job makes: 342bc85 and tag v0.2.0.
• After this merges, the old TF_PROVIDER_GITHUB_TOKEN secret gets deleted.

Summary by CodeRabbit

• Release Process
  • Terraform provider releases now authenticate through an SSH deploy key, with host verification and key validation before publishing.
• Documentation
  • Updated release setup guidance to cover the deploy key and provider signing requirements.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f93950a3-3a2e-404c-b3f0-886438c4075c

📥 Commits

Reviewing files that changed from the base of the PR and between 8bb8303 and 3f8a2ae.

📒 Files selected for processing: 3

• .github/workflows/release.yml
• AGENTS.md
• test/workflows/release_workflow_test.rb

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Walkthrough

The release workflow now uses TF_PROVIDER_DEPLOY_KEY to authenticate to the Terraform provider repository and pushes provider changes and release tags over SSH. Documentation and a workflow test cover the updated setup.

Changes

Provider SSH publishing

Layer / File(s)	Summary
Authenticate and publish over SSH .github/workflows/release.yml, AGENTS.md, test/workflows/release_workflow_test.rb	The workflow requires the deploy key, verifies SSH hosts using keys from GitHub’s metadata endpoint, and checks repository access before cloning. It pushes the updated branch and release tag over SSH. Documentation describes the deploy key and provider signing-key requirement. The test checks the deploy-key setup, credential patterns, and access check order.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Workflow as GitHub Actions workflow
  participant Metadata as GitHub metadata endpoint
  participant Provider as Terraform provider repository
  Workflow->>Metadata: Fetch published SSH host keys
  Workflow->>Provider: Check access with git ls-remote
  Workflow->>Provider: Clone repository over SSH
  Workflow->>Provider: Push main branch and release tag over SSH

Loading

Merge Risk: ⚪ Minimal · up to 3f8a2

The provider publishing workflow and its setup documentation consistently use the release-environment deploy key. No material merge-blocking issue is identified.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: replacing the provider synchronization PAT with a deploy key.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{A rabbit checks the key at dawn
Then hops where trusted host keys shine
The branch and tag take SSH paths
The release notes keep the steps in line
I nibble carrots, pleased with the flow}

_{Comment @coderabbitai help to get the list of available commands.}