From c6131bc111c6cd84d4463a2b66c04deda3ff8f11 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Fri, 21 Aug 2026 18:11:40 -0700
Subject: [PATCH] fix(ci): move to .gitea/workflows, fix malformed clone URL,
 drop unused CA-trust step

---
 .forgejo/workflows/ci.yaml | 79 --------------------------------------
 .gitea/workflows/ci.yaml   | 75 ++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 79 deletions(-)
 delete mode 100644 .forgejo/workflows/ci.yaml
 create mode 100644 .gitea/workflows/ci.yaml

diff --git a/.forgejo/workflows/ci.yaml b/.forgejo/workflows/ci.yaml
deleted file mode 100644
index 035434d..0000000
--- a/.forgejo/workflows/ci.yaml
+++ /dev/null
@@ -1,79 +0,0 @@
-name: ci
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  buf:
-    runs-on: docker
-    container:
-      image: bufbuild/buf:latest
-    steps:
-      # actions/checkout@v4 is a JS action — it needs `node` inside the job's
-      # container to run, but bufbuild/buf has no Node.js. Plain git clone has
-      # no such dependency and works in any image.
-      #
-      # The runner's own homelab CA isn't trusted by this container's
-      # default CA bundle, so https clone fails cert verification — install
-      # the CA before cloning.
-      - name: trust homelab CA
-        env:
-          HOMELAB_CA_CERT: ${{ secrets.HOMELAB_CA_CERT }}
-        run: |
-          mkdir -p /usr/local/share/ca-certificates
-          echo "$HOMELAB_CA_CERT" > /usr/local/share/ca-certificates/homelab-ca.crt
-          update-ca-certificates
-
-      - name: checkout
-        env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git clone "https://x-access-token:${GIT_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
-          git checkout "${GITHUB_SHA}"
-
-      - name: buf lint
-        run: buf lint
-
-      - name: buf breaking (against main)
-        run: buf breaking --against '.git#branch=main'
-        if: github.ref != 'refs/heads/main'
-
-  codegen-check:
-    runs-on: docker
-    container:
-      image: golang:1.25
-    steps:
-      # Same reason as the buf job: golang:1.25 has no Node.js, so the JS
-      # action actions/checkout@v4 can't run here — plain git clone instead.
-      - name: trust homelab CA
-        env:
-          HOMELAB_CA_CERT: ${{ secrets.HOMELAB_CA_CERT }}
-        run: |
-          mkdir -p /usr/local/share/ca-certificates
-          echo "$HOMELAB_CA_CERT" > /usr/local/share/ca-certificates/homelab-ca.crt
-          apt-get update -qq && apt-get install -y -qq ca-certificates >/dev/null
-          update-ca-certificates
-
-      - name: checkout
-        env:
-          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git clone "https://x-access-token:${GIT_TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" .
-          git checkout "${GITHUB_SHA}"
-
-      - name: Install buf and protoc plugins
-        run: |
-          go install github.com/bufbuild/buf/cmd/buf@latest
-          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
-          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
-          go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@latest
-
-      - name: Regenerate and diff
-        run: |
-          export PATH="$PATH:$(go env GOPATH)/bin"
-          buf generate
-          git diff --exit-code -- gen || (echo "::error::gen/ is out of date — run buf generate and commit the result" && exit 1)
-
-      - name: go build
-        run: go build ./...
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
new file mode 100644
index 0000000..4b9cd37
--- /dev/null
+++ b/.gitea/workflows/ci.yaml
@@ -0,0 +1,75 @@
+# Path is .gitea/workflows/, not .forgejo/workflows/ -- verified live on this
+# Forgejo instance (forgejo.riotpiao.com) that a .forgejo/workflows/*.yaml
+# file never creates an action_run row on push, for any repo. This CI has
+# never once executed until this move.
+name: ci
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  buf:
+    runs-on: docker
+    container:
+      image: bufbuild/buf:latest
+    steps:
+      # actions/checkout@v4 is a JS action -- it needs `node` inside the
+      # job's container, and bufbuild/buf ships none. Plain git clone avoids
+      # that dependency.
+      #
+      # GITHUB_SERVER_URL on this instance is the internal Service address,
+      # e.g. http://forgejo-gitea-http.cicd.svc.cluster.local:3000 -- plain
+      # HTTP, not HTTPS. The previous version of this step did
+      # `${GITHUB_SERVER_URL#https://}` (strip an "https://" prefix) and then
+      # unconditionally re-prepended "https://", producing the malformed URL
+      # "https://http://forgejo-gitea-http...". That is what the "trust
+      # homelab CA" step (and the HOMELAB_CA_CERT secret it needed, which
+      # never existed on this repo) was trying to paper over. Inserting the
+      # token right after whatever scheme is actually present, instead of
+      # assuming https, needs no CA at all -- there's no TLS in the internal
+      # path to trust in the first place.
+      - name: checkout
+        env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${GIT_TOKEN}@#")
+          git clone "${url}/${GITHUB_REPOSITORY}.git" .
+          git checkout "${GITHUB_SHA}"
+
+      - name: buf lint
+        run: buf lint
+
+      - name: buf breaking (against main)
+        run: buf breaking --against '.git#branch=main'
+        if: github.ref != 'refs/heads/main'
+
+  codegen-check:
+    runs-on: docker
+    container:
+      image: golang:1.25
+    steps:
+      # Same reason as the buf job: golang:1.25 has no Node.js either.
+      - name: checkout
+        env:
+          GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          url=$(echo "${GITHUB_SERVER_URL}" | sed -E "s#(https?://)#\1x-access-token:${GIT_TOKEN}@#")
+          git clone "${url}/${GITHUB_REPOSITORY}.git" .
+          git checkout "${GITHUB_SHA}"
+
+      - name: Install buf and protoc plugins
+        run: |
+          go install github.com/bufbuild/buf/cmd/buf@latest
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+          go install github.com/grpc-ecosystem/grpc-gateway/v2/protoc-gen-grpc-gateway@latest
+
+      - name: Regenerate and diff
+        run: |
+          export PATH="$PATH:$(go env GOPATH)/bin"
+          buf generate
+          git diff --exit-code -- gen || (echo "::error::gen/ is out of date — run buf generate and commit the result" && exit 1)
+
+      - name: go build
+        run: go build ./...