From 7186257987b73e0c9886d57b3a5316f10fa59441 Mon Sep 17 00:00:00 2001
From: Neil Borromeo <neil@malogica.com>
Date: Sat, 25 Apr 2026 22:05:30 +0800
Subject: [PATCH] Trust resolved deploy host addresses

---
 .forgejo/workflows/deploy-hugo-site.yml | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/.forgejo/workflows/deploy-hugo-site.yml b/.forgejo/workflows/deploy-hugo-site.yml
index 2d833f3..46662c6 100644
--- a/.forgejo/workflows/deploy-hugo-site.yml
+++ b/.forgejo/workflows/deploy-hugo-site.yml
@@ -84,7 +84,13 @@ jobs:
           if [[ -n "${DEPLOY_KNOWN_HOSTS:-}" ]]; then
             printf '%s\n' "$DEPLOY_KNOWN_HOSTS" > "$HOME/.ssh/known_hosts"
           else
-            ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}" "${DEPLOY_SSH_HOST}" > "$HOME/.ssh/known_hosts"
+            {
+              ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}" "${DEPLOY_SSH_HOST}"
+              getent ahosts "${DEPLOY_SSH_HOST}" \
+                | awk '{ print $1 }' \
+                | sort -u \
+                | xargs -r -n1 ssh-keyscan -H -p "${DEPLOY_SSH_PORT:-22}"
+            } > "$HOME/.ssh/known_hosts"
           fi
           chmod 0600 "$HOME/.ssh/known_hosts"