From b3943566b52f5f6c4bc6cdc2982c6f9550ebff08 Mon Sep 17 00:00:00 2001
From: Ethan Paul <ethan@freedom.press>
Date: Mon, 1 Dec 2025 15:04:04 -0500
Subject: [PATCH] Update act runner to use dedicated local SSH key for access

---
 act-runner/rebuild.bash | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/act-runner/rebuild.bash b/act-runner/rebuild.bash
index eb9af28..7a10dfe 100644
--- a/act-runner/rebuild.bash
+++ b/act-runner/rebuild.bash
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-set -e
+set -eo pipefail
 
 if [ $# -lt 1 ]; then
   echo "ERROR: Specify config path"
@@ -24,6 +24,7 @@ SSH_KEY="${HOME}/.ssh/_${HOSTNAME}_act_runner_ed25519"
 
 IGNITION_PATH="${CONFIG_PATH}/${NAME}.ign"
 IMAGE_PATH="${CONFIG_PATH}/${NAME}.qcow2"
+DOWNLOAD_PATH="$(mktemp -d)"
 KVM="qemu:///session"
 
 if ! systemctl is-active libvirtd --quiet; then
@@ -46,16 +47,14 @@ if [[ $all_vms == *"${NAME}"* ]]; then
     rm "${IGNITION_PATH}"
 fi
 
-download_dir=$(mktemp -d)
-
 podman run \
   --rm \
-  -v "${download_dir}:/data:z" \
+  -v "${DOWNLOAD_PATH}:/data:z" \
   -w /data \
   quay.io/coreos/coreos-installer:release \
   download -s "${STREAM}" -p qemu -f qcow2.xz --decompress
 
-download_image=$(command ls "${download_dir}"/*.qcow2)
+download_image=$(command ls "${DOWNLOAD_PATH}"/*.qcow2)
 
 mv "${download_image}" "${IMAGE_PATH}"