WIP: more variables

vault_oidc_ssh_cert_action.py

@@ -74,30 +74,36 @@ def generate_and_sign() -> None:
     vault_server = os.environ["VAULT_SERVER"].strip()
     vault_token = os.environ["VAULT_TOKEN"].strip()
 
+    key_fname = "id_github"
+    pub_fname = f"{key_fname}.pub"
+    cert_fname = f"{key_fname}-cert.pub"
+
     outdir = tempfile.mkdtemp(prefix="ssh-cert-")
-    out_key = os.path.join(outdir, "id_github")
-    out_cert = os.path.join(outdir, "id_github-cert.pub")
+    out_key_path = os.path.join(outdir, key_fname)
+    out_cert_path = os.path.join(outdir, cert_fname)
 
     with tempfile.TemporaryDirectory(prefix="ssh-keygen-") as workdir:
-        os.chdir(workdir)
+        work_key_path = os.path.join(workdir, key_fname)
+        work_pub_path = os.path.join(workdir, pub_fname)
+        work_cert_path = os.path.join(workdir, cert_fname)
 
         subprocess.run(
-            ["ssh-keygen", "-q", "-t", "ed25519", "-N", "''", "-f", "./id_github"],
+            ["ssh-keygen", "-q", "-t", "ed25519", "-N", "''", "-f", work_key_path],
             check=True,
         )
 
-        with open("./id_github.pub", mode="r", encoding="utf-8") as pubkf:
+        with open(work_pub_path, mode="r", encoding="utf-8") as pubkf:
             pubkey = pubkf.read()
 
         ssh_cert: str = _issue_ssh_cert(
             vault_server, vault_token, ssh_backend, ssh_role, pubkey
         )
-        with open("./id_github-cert.pub", mode="w", encoding="utf-8") as certf:
+        with open(work_cert_path, mode="w", encoding="utf-8") as certf:
             certf.write(ssh_cert)
 
-        os.rename("./id_github", out_key)
-        os.rename("./id_github-cert.pub", out_cert)
+        os.rename(work_key_path, out_key_path)
+        os.rename(work_cert_path, out_cert_path)
 
     with open(os.environ["GITHUB_OUTPUT"], mode="a", encoding="utf-8") as ghof:
-        ghof.write(f"cert_path={out_cert}\n")
-        ghof.write(f"key_path={out_key}\n")
+        ghof.write(f"cert_path={out_cert_path}\n")
+        ghof.write(f"key_path={out_key_path}\n")