Use separate read-only deploy keys for both private GitHub repositories

deploy/gitea-multi-plugin.yml

@@ -21,12 +21,17 @@ jobs:
       - name: Configure SSH for private GitHub
         env:
           DEPLOY_KEY: ${{ secrets.SCENE_SEARCH_DEPLOY_KEY }}
+          FACE_DEPLOY_KEY: ${{ secrets.FACIAL_RECOGNITION_DEPLOY_KEY }}
         run: |
           set -eu
           test -n "$DEPLOY_KEY"
           install -m 700 -d ~/.ssh
           printf '%s\n' "$DEPLOY_KEY" > ~/.ssh/id_ed25519
           chmod 600 ~/.ssh/id_ed25519
+          if [ -n "$FACE_DEPLOY_KEY" ]; then
+            printf '%s\n' "$FACE_DEPLOY_KEY" > ~/.ssh/facial_deploy_key
+            chmod 600 ~/.ssh/facial_deploy_key
+          fi
           ssh-keyscan -H github.com >> ~/.ssh/known_hosts
 
       - name: Clone source repositories
@@ -38,7 +43,8 @@ jobs:
           set -eu
           git clone --depth 1 git@github.com:MrSleeps/jellyfin-scene-search.git source
           if [ "$PLUGIN" = "facial-recognition" ]; then
-            git clone --depth 1 git@github.com:MrSleeps/jellyfin-facial-recognition.git facial
+            test -s ~/.ssh/facial_deploy_key || { echo "Set FACIAL_RECOGNITION_DEPLOY_KEY secret"; exit 1; }
+            GIT_SSH_COMMAND="ssh -i ~/.ssh/facial_deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes" git clone --depth 1 git@github.com:MrSleeps/jellyfin-facial-recognition.git facial
             test "$(python3 -c 'import json;print(json.load(open("facial/jellyfin-plugin/manifest.json"))["version"])')" = "$VERSION"
           else
             test "$(sed -n 's/.*<Version>\(.*\)<\/Version>.*/\1/p' source/jellyfin-plugin/Jellyfin.Plugin.SceneSearch/Jellyfin.Plugin.SceneSearch.csproj | head -1)" = "$VERSION"