From a08fe6502760d42fd9600fed6de5e82e23cbbbb3 Mon Sep 17 00:00:00 2001
From: rock <locartrock@gmail.com>
Date: Sun, 30 Aug 2026 20:27:04 -0700
Subject: [PATCH] fix: replace GITHUB_SERVER_URL/GITHUB_REPOSITORY/GITHUB_SHA
 with forgejo.riotpiao.com hardcoded URL

---
 .gitea/workflows/ci.yaml | 30 ++++++++----------------------
 1 file changed, 8 insertions(+), 22 deletions(-)

diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index 7c6153e..a094166 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -15,28 +15,14 @@ jobs:
     container:
       image: bufbuild/buf:latest
     steps:
-      # actions/checkout@v4 is a JS action -- it needs `node` inside the
-      # job's container, and bufbuild/buf ships none. Plain git clone avoids
-      # that dependency.
-      #
-      # GITHUB_SERVER_URL on this instance is the internal Service address,
-      # e.g. http://forgejo-gitea-http.cicd.svc.cluster.local:3000 -- plain
-      # HTTP, not HTTPS. The previous version of this step did
-      # `${GITHUB_SERVER_URL#https://}` (strip an "https://" prefix) and then
-      # unconditionally re-prepended "https://", producing the malformed URL
-      # "https://http://forgejo-gitea-http...". That is what the "trust
-      # homelab CA" step (and the HOMELAB_CA_CERT secret it needed, which
-      # never existed on this repo) was trying to paper over. Inserting the
-      # token right after whatever scheme is actually present, instead of
-      # assuming https, needs no CA at all -- there's no TLS in the internal
-      # path to trust in the first place.
+      # Manual git clone (no actions/checkout@v4 since bufbuild/buf has no node.js).
+      # Use forgejo.riotpiao.com directly + REGISTRY_PAT for auth.
       - name: checkout
         env:
           REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
-          git clone "${url}/${GITHUB_REPOSITORY}.git" .
-          git checkout "${GITHUB_SHA}"
+          git clone "https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com/rock/kmsvc-proto.git" .
+          git checkout "${{ github.sha }}"
 
       - name: buf lint
         run: buf lint
@@ -50,14 +36,14 @@ jobs:
     container:
       image: golang:1.26
     steps:
-      # Same reason as the buf job: golang:1.25 has no Node.js either.
+      # Manual git clone (no actions/checkout@v4 since golang:1.26 has no node.js).
+      # Use forgejo.riotpiao.com directly + REGISTRY_PAT for auth.
       - name: checkout
         env:
           REGISTRY_PAT: ${{ secrets.REGISTRY_PAT }}
         run: |
-          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${REGISTRY_PAT}@#")
-          git clone "${url}/${GITHUB_REPOSITORY}.git" .
-          git checkout "${GITHUB_SHA}"
+          git clone "https://oauth2:${REGISTRY_PAT}@forgejo.riotpiao.com/rock/kmsvc-proto.git" .
+          git checkout "${{ github.sha }}"
 
       - name: Install buf and protoc plugins
         run: |