Support for accessing to private repositories using different methods

[Serafin-dev]

Description

For security reasons we would like to adopt deploy keys as our access method to private repositories.
The Picasso workflow uses this ssh-agent to make this possible. According to the ssh-agent here you can manage deploy keys.
I have not been able to make it work though. Not quite sure if this is the action not really supporting it. I checked everything was done as the documentation describes but still.

Also, @mariajgrimaldi could you please provide feedback about the tests you did for Github Apps? Thanks!

[mariajgrimaldi]

@Serafin-dev: Thanks for the report! I've tested this only with an SSH key associated with a service account, not with a deployment key, but technically, it shouldn't be that different. Have you tested the action in an isolated environment to confirm your theory? This issue opened a few days ago: webfactory/ssh-agent#232, which suggests the same as you did.

As for the github apps authentication method, I haven't tested the approach. Mainly because it needed modifications in tutor-contrib-picasso (here, specifically) to use tokens instead of assuming that an SSH agent is configured with the proper permissions. Or maybe there is another approach that allows the host to recognize the token instead of passing it in the gh URL, I'm not sure though.

[Serafin-dev]

@mariajgrimaldi thanks for your response.
I have not tested it in an isolated environment apart from the action.
Regarding tests on Github Apps, could you please leave a comment here when you have any update on tthis?