Satisfy prepare:ssh with a throwaway key in secretless build jobs

hypernode-deploy's prepare:ssh task hard-fails when the ssh-agent has no
identities (it lists loaded keys unconditionally), so builds without
SSH_PRIVATE_KEY cannot pass even though building needs no server access.
Generate a key that grants access to nothing instead of reintroducing
the real deploy key into jobs that run untrusted pull request code.

Author: Jonathan Visser

.github/workflows/deploy.yaml

@@ -30,6 +30,10 @@ jobs:
         run: |
           echo "DOCS_BASE_URL=https://docs.hypernode.com/" >> $GITHUB_ENV
           echo "DOCS_INDEX_FOLLOW=1" >> $GITHUB_ENV
+      # The prepare:ssh task fails on an empty ssh-agent, but building needs no
+      # server access, so satisfy it with a key that grants access to nothing.
+      - name: Generate a throwaway SSH key for the build
+        run: mkdir -p ~/.ssh && ssh-keygen -t ed25519 -N '' -q -f ~/.ssh/id_ed25519
       - run: hypernode-deploy build -vvv
       - name: archive production artifacts
         uses: actions/upload-artifact@v4

.github/workflows/pr-build.yaml

@@ -18,6 +18,10 @@ jobs:
           fetch-depth: 0
       - name: Add repository to git safe directories
         run: git config --global --add safe.directory $GITHUB_WORKSPACE
+      # The prepare:ssh task fails on an empty ssh-agent, but building needs no
+      # server access, so satisfy it with a key that grants access to nothing.
+      - name: Generate a throwaway SSH key for the build
+        run: mkdir -p ~/.ssh && ssh-keygen -t ed25519 -N '' -q -f ~/.ssh/id_ed25519
       - run: hypernode-deploy build -vvv
       - name: archive build artifact
         uses: actions/upload-artifact@v4