From 802904646c3cfe95f29f22b4db826fd7fd7ad9fb Mon Sep 17 00:00:00 2001
From: weichen <weichen@home.local>
Date: Mon, 12 Oct 2026 14:30:13 +0000
Subject: [PATCH] Keep clone credentials through nested RDM pins fetch in CI

Why: the realcombo steps unset the URL-scoped token env before
'submodule update', so nested pins fell back to raw SSH URLs and failed
host-key verification on the runner (first svc-realcombo run 2605).
Evidence: job log run 2605 shows ssh clone failures; reordered steps
keep insteadOf + token header active through the pins fetch.
Impact: ci.yaml ordering only.
---
 .gitea/workflows/ci.yaml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 731204ca..37b25a61 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -398,12 +398,14 @@ jobs:
           export GIT_CONFIG_KEY_3="core.hooksPath"
           export GIT_CONFIG_VALUE_3="/dev/null"
           git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
+          # 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
+          # 之后再 unset。
+          git -C rdm submodule update --init --recursive
+          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
                 GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
           unset SUBMODULE_TOKEN
-          git -C rdm submodule update --init --recursive
-          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           make -C rdm build
       - name: Real-combination identity gates over real PostgreSQL (U3, required)
         env:
@@ -604,12 +606,14 @@ jobs:
           export GIT_CONFIG_KEY_3="core.hooksPath"
           export GIT_CONFIG_VALUE_3="/dev/null"
           git clone --depth=1 "$SERVER/weichen/Agent-System-RDM.git" rdm
+          # 凭据环境须保持到 pins 子模块取完（insteadOf + token 头覆盖嵌套 SSH URL），
+          # 之后再 unset。
+          git -C rdm submodule update --init --recursive
+          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 \
                 GIT_CONFIG_KEY_1 GIT_CONFIG_VALUE_1 GIT_CONFIG_KEY_2 \
                 GIT_CONFIG_VALUE_2 GIT_CONFIG_KEY_3 GIT_CONFIG_VALUE_3
           unset SUBMODULE_TOKEN
-          git -C rdm submodule update --init --recursive
-          echo "RDM commit: $(git -C rdm rev-parse HEAD)"
           make -C rdm build
       - name: Run real-combination lifecycle gates (SQLite, U3, required)
         env: