fix(ci): Replace GitHub actions/checkout with Forgejo auth

Use CI_RUNNER and CI_RUNNER_SECRET for repo clone authentication.
Embed credentials in git clone URL: https://user:token@host/repo.git

Removes dependency on GITHUB_TOKEN (GitHub-specific) and improves Forgejo compatibility.

.forgejo/workflows/argocd-sync.yaml

@@ -12,7 +12,11 @@ jobs:
     runs-on: docker
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        run: |
+          CLONE_URL="https://${{ secrets.CI_RUNNER }}:${{ secrets.CI_RUNNER_SECRET }}@${{ gitea.repository_clone_url | replace 'https://', '' }}"
+          git clone --depth 1 "$CLONE_URL" .
+          git fetch origin ${{ gitea.ref }}:current-branch
+          git checkout current-branch
 
       - name: Install ArgoCD CLI
         run: |

.forgejo/workflows/security-scan.yaml

@@ -16,7 +16,11 @@ jobs:
     runs-on: docker
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        run: |
+          CLONE_URL="https://${{ secrets.CI_RUNNER }}:${{ secrets.CI_RUNNER_SECRET }}@${{ gitea.repository_clone_url | replace 'https://', '' }}"
+          git clone --depth 1 "$CLONE_URL" .
+          git fetch origin ${{ gitea.ref }}:current-branch
+          git checkout current-branch
 
       - name: Install Tools
         run: |

.forgejo/workflows/validate-k8s.yaml

@@ -18,7 +18,11 @@ jobs:
     runs-on: docker
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        run: |
+          CLONE_URL="https://${{ secrets.CI_RUNNER }}:${{ secrets.CI_RUNNER_SECRET }}@${{ gitea.repository_clone_url | replace 'https://', '' }}"
+          git clone --depth 1 "$CLONE_URL" .
+          git fetch origin ${{ gitea.ref }}:current-branch
+          git checkout current-branch
 
       - name: Install Tools
         run: |