fix(git): mount git-gate known hosts

bot_bottle/backend/docker/compose.py

@@ -212,6 +212,11 @@ def _sidecar_bundle_service(plan: DockerBottlePlan) -> dict[str, Any]:
                 keypath,
                 f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-key",
             ))
+            if u.known_hosts_file:
+                volumes.append(_bind(
+                    u.known_hosts_file,
+                    f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-known_hosts",
+                ))
         extra_map = git_gate_aggregate_extra_hosts(gp.upstreams)
         extra_hosts = [f"{host}:{ip}" for host, ip in sorted(extra_map.items())]
 

bot_bottle/backend/smolmachines/launch.py

@@ -366,6 +366,12 @@ def _bundle_launch_spec(
                 f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-key",
                 True,
             ))
+            if u.known_hosts_file:
+                volumes.append((
+                    str(u.known_hosts_file),
+                    f"{GIT_GATE_CREDS_DIR_IN_CONTAINER}/{u.name}-known_hosts",
+                    True,
+                ))
 
     # --- supervise --------------------------------------------
     sp = plan.supervise_plan

bot_bottle/git_gate.py

@@ -71,6 +71,7 @@ class GitGateUpstream:
     upstream_port: str
     identity_file: str
     known_host_key: str
+    known_hosts_file: Path = Path()
     extra_hosts: Mapping[str, str] = field(default_factory=_empty_str_map)
 
 
@@ -408,10 +409,33 @@ class GitGate(ABC):
         # not via `sh`, so the script needs the x bit. docker cp
         # preserves source mode into the container.
         access_hook.chmod(0o700)
+        upstreams_with_files: list[GitGateUpstream] = []
+        for u in upstreams:
+            known_hosts_file = Path()
+            if u.known_host_key:
+                known_hosts_file = stage_dir / f"{u.name}-known_hosts"
+                known_hosts_file.write_text(
+                    git_gate_known_hosts_line(
+                        u.upstream_host, u.upstream_port, u.known_host_key,
+                    )
+                )
+                known_hosts_file.chmod(0o600)
+            upstreams_with_files.append(
+                GitGateUpstream(
+                    name=u.name,
+                    upstream_url=u.upstream_url,
+                    upstream_host=u.upstream_host,
+                    upstream_port=u.upstream_port,
+                    identity_file=u.identity_file,
+                    known_host_key=u.known_host_key,
+                    known_hosts_file=known_hosts_file,
+                    extra_hosts=dict(u.extra_hosts),
+                )
+            )
         return GitGatePlan(
             slug=slug,
             entrypoint_script=entrypoint,
             hook_script=hook,
             access_hook_script=access_hook,
-            upstreams=upstreams,
+            upstreams=tuple(upstreams_with_files),
         )