agent-exec transport 6ba5a4665af9480243d2329a4d0e4b40/e7fec88ba66a

.gitea/workflows/ci.yml

@@ -8,7 +8,18 @@ jobs:
   vet-and-test:
     runs-on: nightly
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回，凭据只以 URL 限定的 extraheader 存在于单个 git 进程。
+          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
+          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init -q .
+          git -c "http.${url}.extraheader=AUTHORIZATION: token ${TOKEN}" -c credential.helper= -c core.hooksPath=/dev/null fetch -q --depth=1 "$url" "$GITHUB_SHA"
+          git checkout -q --detach FETCH_HEAD
+          unset TOKEN
       - run: go vet ./... && go test -count=1 ./...
   docker-checkout-hostgateway:
     runs-on: ubuntu-latest
@@ -16,5 +27,16 @@ jobs:
     env:
       GITHUB_SERVER_URL: http://gitea:3000
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 自包含检出（runner 无法访问 github.com 上的 actions/checkout）：固定 SHA 浅取回，凭据只以 URL 限定的 extraheader 存在于单个 git 进程。
+          case "$GITHUB_SHA" in *[!0-9a-fA-F]*|"") echo "Checkout requires a fixed commit SHA" >&2; exit 1;; esac
+          url="${GITHUB_SERVER_URL%/}/${GITHUB_REPOSITORY}.git"
+          git init -q .
+          git -c "http.${url}.extraheader=AUTHORIZATION: token ${TOKEN}" -c credential.helper= -c core.hooksPath=/dev/null fetch -q --depth=1 "$url" "$GITHUB_SHA"
+          git checkout -q --detach FETCH_HEAD
+          unset TOKEN
       - run: test -f go.mod && echo "docker-mode checkout via host-gateway OK"