From f3d8460cb6905fdbc1ba97565e71977c4c4c64ea Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Sun, 17 May 2026 23:04:54 -0400
Subject: [PATCH] chore: harden temporary secret file cleanup in CI

---
 .gitea/workflows/cicd.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.gitea/workflows/cicd.yml b/.gitea/workflows/cicd.yml
index 4544328..1e753e9 100644
--- a/.gitea/workflows/cicd.yml
+++ b/.gitea/workflows/cicd.yml
@@ -22,6 +22,8 @@ jobs:
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
+          umask 077
+          trap 'rm -f ~/.ssh/id_rsa' EXIT
           echo "=== Minimal Repository Checkout for Base Dockerfile ==="
 
           # Set up SSH key securely (temporary file approach)
@@ -166,6 +168,8 @@ jobs:
         env:
           SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
+          umask 077
+          trap 'rm -f ~/.ssh/id_rsa' EXIT
           echo "=== Minimal Repository Checkout for Complete Dockerfile ==="
 
           # Set up SSH key securely (temporary file approach)
@@ -196,6 +200,8 @@ jobs:
           GITHUB_SHA: ${{ github.sha }}
           REGISTRY_USER: ${{ secrets.REGISTRY_USER || github.actor }}
         run: |
+          umask 077
+          trap 'rm -f /tmp/ssh_key' EXIT
           echo "=== Building Complete CICD Image with Secure Secrets ==="
 
           # Login to registry