Verify SSH host keys in reusable mirror workflow #762

Summary

The shared reusable workflow .github/workflows/mirror-reusable.yml accepts live ssh-keyscan output as trusted host keys before it pushes mirrors over SSH.

Affected mirror jobs are GitLab, Bitbucket, Codeberg, SourceHut, Disroot, and configurable Gitea.

Required change

Replace each unchecked ssh-keyscan use with verification against approved, pinned SSH host keys or fingerprints before git push.

For the configurable Gitea host, define a secure configuration mechanism for its approved host key or fingerprint. Do not obtain the approved value from the same unauthenticated network connection that is being verified.

Rationale

An attacker that can alter DNS or the network path can provide a counterfeit SSH host key. The workflow can then push repository contents to a counterfeit endpoint.

Affected area

• hyperpolymath/standards/.github/workflows/mirror-reusable.yml

Acceptance criteria

• The workflow does not append unverified ssh-keyscan output to ~/.ssh/known_hosts.
• Each SSH mirror target verifies an approved host key or fingerprint before its push.
• The configurable Gitea target requires an approved host key or fingerprint.
• Mirror jobs still skip safely when their required private key is absent.
• The change documents how callers configure any required approved key material.
• Downstream callers receive an updated immutable workflow pin after the fix merges.

Backlinks

• Downstream PR: fix(ci): repair shared scanner, mirror trust and repository validation natsci-studio#82
• Review discussion: fix(ci): repair shared scanner, mirror trust and repository validation natsci-studio#82 (comment)

Requested by: @hyperpolymath