fix: replace GITHUB_SERVER_URL/GITHUB_REPOSITORY/GITHUB_SHA with forgejo.riotpiao.com hardcoded URL

.gitea/workflows/ci.yaml

@@ -15,28 +15,14 @@ jobs:
     container:
       image: bufbuild/buf:latest
     steps:
-      # actions/checkout@v4 is a JS action -- it needs `node` inside the
-      # job's container, and bufbuild/buf ships none. Plain git clone avoids
-      # that dependency.
-      #
-      # GITHUB_SERVER_URL on this instance is the internal Service address,
-      # e.g. http://forgejo-gitea-http.cicd.svc.cluster.local:3000 -- plain
-      # HTTP, not HTTPS. The previous version of this step did
-      # `${GITHUB_SERVER_URL#https://}` (strip an "https://" prefix) and then
-      # unconditionally re-prepended "https://", producing the malformed URL
-      # "https://http://forgejo-gitea-http...". That is what the "trust
-      # homelab CA" step (and the HOMELAB_CA_CERT secret it needed, which
-      # never existed on this repo) was trying to paper over. Inserting the
-      # token right after whatever scheme is actually present, instead of
-      # assuming https, needs no CA at all -- there's no TLS in the internal
-      # path to trust in the first place.
+      # Manual git clone (no actions/checkout@v4 since bufbuild/buf has no node.js).
+      # Use forgejo.riotpiao.com directly + REGISTRY_PAT for auth.
       - name: checkout
         env:
           REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
-          git clone "${url}/${GITHUB_REPOSITORY}.git" .
-          git checkout "${GITHUB_SHA}"
+          git clone "https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com/rock/kmsvc-proto.git" .
+          git checkout "${{ github.sha }}"
 
       - name: buf lint
         run: buf lint
@@ -50,14 +36,14 @@ jobs:
     container:
       image: golang:1.26
     steps:
-      # Same reason as the buf job: golang:1.25 has no Node.js either.
+      # Manual git clone (no actions/checkout@v4 since golang:1.26 has no node.js).
+      # Use forgejo.riotpiao.com directly + REGISTRY_PAT for auth.
       - name: checkout
         env:
           REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
-          git clone "${url}/${GITHUB_REPOSITORY}.git" .
-          git checkout "${GITHUB_SHA}"
+          git clone "https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com/rock/kmsvc-proto.git" .
+          git checkout "${{ github.sha }}"
 
       - name: Install buf and protoc plugins
         run: |