fix: secure GitHub Actions deployment with temporary SSH access

[sprahasingh]

No description provided.

[codelens-gh]

CodeLens Pre-Review Analysis

Outcome: Incomplete; an external service prevented full analysis

11 hunks scanned · 16 similar past patterns matched

Historically grounded findings

Suggested checks from historical patterns

These are speculative checks, not asserted defects.

---

Finding 1: The actions/checkout step uses a tag reference (v7.0.1) instead of a pinned SHA, which violates the repository’s policy on pinned actions

Location: .github/workflows/production.yml · line 40
Model confidence (uncalibrated): 90% | What to verify: Pin actions/checkout to a specific commit SHA instead of a tag

Your code (this PR):

    if: >-
      github.event_name == 'push' || github.event_name == 'pull_request' ||
      (github.event_name == 'workflow_dispatch' && (inputs.operation == 'deploy' || inputs.operation == 'deploy_existing'))

Evidence: Past reviewers flagged unpinned action references as a security issue

Past reviews that triggered this (2 matches):

Similarity	Source repository	File	Reviewer comment	Link
86%	tiangolo/fastapi	.github/workflows/run-tests.yml	"## zizmor / unpinned action reference: action is not pinned to a hash (required by blank..."	view
86%	tiangolo/fastapi	.github/workflows/run-tests.yml	"## zizmor / unpinned action reference: action is not pinned to a hash (required by blank..."	view

---

Suggested check 2: Having both push and pull_request triggers with an if condition that matches both can cause the test job to run twice for the same commit

Location: .github/workflows/production.yml · line 40
Model confidence (uncalibrated): 85% | What to verify: Add appropriate filters or adjust the if expression to ensure the job runs only once per commit

Your code (this PR):

    if: >-
      github.event_name == 'push' || github.event_name == 'pull_request' ||
      (github.event_name == 'workflow_dispatch' && (inputs.operation == 'deploy' || inputs.operation == 'deploy_existing'))

Evidence: A previous comment noted that push without a filter together with pull_request can lead to duplicate job executions

Past reviews that triggered this (1 match):

Similarity	Source repository	File	Reviewer comment	Link
84%	encode/httpx	.github/workflows/test-suite.yml	"Usually I just open a pull request in my fork for CI if I need to test it before opening a..."	view

---

Generated by CodeLens. Historically grounded findings cite their source reviews; general analysis is labeled separately.

General change overview (not historical evidence)

Changed areas (5 files; +979/-5 lines):

• .github/workflows/production.yml (+87/-3)
• docs/ghcr-deployment.md (+210/-0)
• scripts/manage_temporary_ssh.py (+326/-0)
• tests/test_temporary_ssh_access.py (+351/-0)
• tests/test_verify_ghcr_publication.py (+5/-2)
  Test files changed: tests/test_temporary_ssh_access.py, tests/test_verify_ghcr_publication.py

Analysis status: Groq synthesis failed after its bounded retries. This review is incomplete; no no-findings conclusion was reached.

Note: This analysis is partial. Review the analysis status above for the reason and the scope that was not completed.

[codelens-gh]

CodeLens Pre-Review Analysis

Outcome: Completed with no actionable findings

5 hunks scanned · 14 similar past patterns found

Completed with no actionable findings. Historical comments were retrieved, but none could be credibly tied to a defect in the changed code.

---

---

Generated by CodeLens. Historically grounded findings cite their source reviews; general analysis is labeled separately.

General change overview (not historical evidence)

Changed areas (2 files; +13/-2 lines):

• .github/workflows/production.yml (+4/-0)
• tests/test_temporary_ssh_access.py (+9/-2)
  Test files changed: tests/test_temporary_ssh_access.py