diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index a084d4c..6ebd9c9 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -8,7 +8,18 @@ jobs:
   vet-and-test:
     runs-on: nightly
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回，凭据只以 URL 限定的 extraheader 存在于单个 git 进程。
+          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
+          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init -q .
+          git -c "http.${url}.extraheader=AUTHORIZATION: token ${TOKEN}" -c credential.helper= -c core.hooksPath=/dev/null fetch -q --depth=1 "$url" "$GITHUB_SHA"
+          git checkout -q --detach FETCH_HEAD
+          unset TOKEN
       - run: go vet ./... && go test -count=1 ./...
   docker-checkout-hostgateway:
     runs-on: ubuntu-latest
@@ -16,5 +27,16 @@ jobs:
     env:
       GITHUB_SERVER_URL: http://gitea:3000
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回，凭据只以 URL 限定的 extraheader 存在于单个 git 进程。
+          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
+          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init -q .
+          git -c "http.${url}.extraheader=AUTHORIZATION: token ${TOKEN}" -c credential.helper= -c core.hooksPath=/dev/null fetch -q --depth=1 "$url" "$GITHUB_SHA"
+          git checkout -q --detach FETCH_HEAD
+          unset TOKEN
       - run: test -f go.mod && echo "docker-mode checkout via host-gateway OK"
diff --git a/policy/guidelines-adoption.md b/policy/guidelines-adoption.md
index 5b579bd..928cf53 100644
--- a/policy/guidelines-adoption.md
+++ b/policy/guidelines-adoption.md
@@ -39,3 +39,4 @@
 - 挂载不改变 `go test` 行为。
 - 既有文件（`AGENTS.md`、`PROJECT.md`、`AGENT-EXECUTION.md`、本文件）经 `governance init --adopt` 保留内容；新增文件为 `scripts/`、`.task/templates/task-card.md`、`.gitea/workflows/governance.yml`。
 - 回退只恢复 gitlink、`.gitmodules` 与新增入口文件（`scripts/`、`.gitea/workflows/governance.yml`、`.task/templates/task-card.md`），不改码值。
+- `.gitea/workflows/ci.yml` 的两处 `uses: actions/checkout@v4` 已替换为自包含的内联检出步骤，因为 runner 无法访问 github.com；各作业的运行步骤保持不变。