From ffb94124275e05dbe61409f57ea8b2ce64bba594 Mon Sep 17 00:00:00 2001 From: Valmo Trindade Date: Tue, 14 Jul 2026 19:17:50 +0000 Subject: [PATCH] Use transient auth for DEV workflow fetches --- .gitea/workflows/dev-workshop.yml | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/.gitea/workflows/dev-workshop.yml b/.gitea/workflows/dev-workshop.yml index d2ee5e7..226ab5d 100644 --- a/.gitea/workflows/dev-workshop.yml +++ b/.gitea/workflows/dev-workshop.yml @@ -93,12 +93,21 @@ jobs: } configure_git_auth() { + git_auth_args=() local token="${GITEA_TOKEN:-${GITHUB_TOKEN:-}}" if [[ -n "$token" ]]; then - git remote set-url origin "https://x-access-token:${token}@git.valmo.dev/projectbraf/braf.git" + local basic_auth + basic_auth="$(printf 'x-access-token:%s' "$token" | base64 | tr -d '\n')" + git_auth_args=( + -c "http.https://git.valmo.dev/.extraheader=AUTHORIZATION: Basic ${basic_auth}" + ) fi } + git_auth() { + git "${git_auth_args[@]}" "$@" + } + install_runtime install_mikero @@ -106,7 +115,7 @@ jobs: git config --global --add safe.directory /repo configure_git_auth git lfs install --local - git fetch --no-tags origin "$GIT_SHA" || git fetch --no-tags origin main + git_auth fetch --no-tags origin "$GIT_SHA" || git_auth fetch --no-tags origin main if is_zero_sha "$GIT_BEFORE" || ! git cat-file -e "$GIT_BEFORE^{commit}" 2>/dev/null; then mapfile -t changed_addons < <( @@ -153,7 +162,7 @@ jobs: echo "Changed addons: $(addon_csv "${changed_addons[@]}")" echo "Fetching LFS only for: $include" - git lfs fetch origin "$GIT_SHA" --include="$include" --exclude="*" + git_auth lfs fetch origin "$GIT_SHA" --include="$include" --exclude="*" git lfs checkout "${changed_addons[@]}" else echo "Only workshop metadata changed; using cached PBOs."