From 03e39a883dd74e5d0ca48b19b51f4aa415fe5d68 Mon Sep 17 00:00:00 2001 From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com> Date: Fri, 10 Jul 2026 16:08:12 +0200 Subject: [PATCH] ci: authenticate tramiton fetch via extraheader (actions/checkout form) The placeholder-username URL form returned "Repository not found". Switch to the canonical http.extraheader Basic-auth used by actions/checkout (x-access-token:) to remove the username variable. Definitive test of whether the Collaborative Owner grant covers a cargo git-dep clone. Refs #118. Co-Authored-By: Claude Fable 5 --- .gitea/workflows/ci.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml index 1e57418..0bfebf3 100644 --- a/.gitea/workflows/ci.yml +++ b/.gitea/workflows/ci.yml @@ -50,17 +50,19 @@ jobs: RUSTC_WRAPPER: "" # compliance-agent has a git dependency on tramiton-core (a private repo on - # this Gitea instance). Rewrite its SSH URL to HTTPS + the ephemeral Actions - # token so the runner can fetch it — no PAT needed. This works because - # sharang/tramiton lists sharang as a Collaborative Owner (tramiton → - # Settings → Actions), which lets this repo's Actions read tramiton. + # this Gitea instance). Rewrite its SSH URL to HTTPS and authenticate with + # the ephemeral Actions token using the same Basic-auth extraheader form + # that actions/checkout uses (username `x-access-token`) — no PAT needed, + # provided sharang/tramiton grants this repo access via Collaborative Owners + # (tramiton → Settings → Actions). - name: Configure git auth for private tramiton dependency - run: | - git config --global \ - url."https://gitea-actions:${{ github.token }}@gitea.meghsakha.com/".insteadOf \ - "ssh://git@gitea.meghsakha.com:22222/" env: + GITEA_ACTIONS_TOKEN: ${{ github.token }} RUSTC_WRAPPER: "" + run: | + AUTH=$(printf 'x-access-token:%s' "$GITEA_ACTIONS_TOKEN" | base64 -w0) + git config --global http."https://gitea.meghsakha.com/".extraheader "Authorization: Basic $AUTH" + git config --global url."https://gitea.meghsakha.com/".insteadOf "ssh://git@gitea.meghsakha.com:22222/" # Format (no compilation needed) - name: Format