From 5f59635bf89ea8c9a18e87831fab5da4512bf7d4 Mon Sep 17 00:00:00 2001
From: Sharang Parnerkar <30073382+mighty840@users.noreply.github.com>
Date: Fri, 10 Jul 2026 16:13:02 +0200
Subject: [PATCH] ci: fetch private tramiton dep via read-only SSH deploy key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gitea PATs can't be scoped to a single repo and the ephemeral Actions token
can't clone a private git dependency (verified: "Repository not found" even with
Collaborative Owners + the actions/checkout extraheader form). A read-only Deploy
Key is per-repo least privilege: load it from the TRAMITON_DEPLOY_KEY secret and
let cargo fetch tramiton over SSH (dep URL is already ssh://…:22222).

Refs #118.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 0bfebf3..3883cdd 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -50,19 +50,23 @@ jobs:
           RUSTC_WRAPPER: ""
 
       # compliance-agent has a git dependency on tramiton-core (a private repo on
-      # this Gitea instance). Rewrite its SSH URL to HTTPS and authenticate with
-      # the ephemeral Actions token using the same Basic-auth extraheader form
-      # that actions/checkout uses (username `x-access-token`) — no PAT needed,
-      # provided sharang/tramiton grants this repo access via Collaborative Owners
-      # (tramiton → Settings → Actions).
-      - name: Configure git auth for private tramiton dependency
+      # this Gitea instance). The ephemeral Actions token can NOT clone it even
+      # with a Collaborative Owner grant (that only covers `uses:` actions), and
+      # Gitea PATs can't be scoped to a single repo. So use a read-only Deploy
+      # Key (per-repo): add the public key to sharang/tramiton → Settings →
+      # Deploy Keys (read-only), and the matching private key as this repo's
+      # TRAMITON_DEPLOY_KEY secret. cargo fetches the dep over SSH using it.
+      - name: Configure SSH deploy key for private tramiton dependency
         env:
-          GITEA_ACTIONS_TOKEN: ${{ github.token }}
+          TRAMITON_DEPLOY_KEY: ${{ secrets.TRAMITON_DEPLOY_KEY }}
           RUSTC_WRAPPER: ""
         run: |
-          AUTH=$(printf 'x-access-token:%s' "$GITEA_ACTIONS_TOKEN" | base64 -w0)
-          git config --global http."https://gitea.meghsakha.com/".extraheader "Authorization: Basic $AUTH"
-          git config --global url."https://gitea.meghsakha.com/".insteadOf "ssh://git@gitea.meghsakha.com:22222/"
+          apt-get update && apt-get install -y --no-install-recommends openssh-client
+          mkdir -p ~/.ssh && chmod 700 ~/.ssh
+          printf '%s\n' "$TRAMITON_DEPLOY_KEY" > ~/.ssh/tramiton_ci
+          chmod 600 ~/.ssh/tramiton_ci
+          printf 'Host gitea.meghsakha.com\n  HostName gitea.meghsakha.com\n  Port 22222\n  User git\n  IdentityFile ~/.ssh/tramiton_ci\n  IdentitiesOnly yes\n  StrictHostKeyChecking accept-new\n' > ~/.ssh/config
+          chmod 600 ~/.ssh/config
 
       # Format (no compilation needed)
       - name: Format