Use transient auth for DEV workflow fetches

.gitea/workflows/dev-workshop.yml

@@ -93,12 +93,21 @@ jobs:
           }
 
           configure_git_auth() {
+            git_auth_args=()
             local token="${GITEA_TOKEN:-${GITHUB_TOKEN:-}}"
             if [[ -n "$token" ]]; then
-              git remote set-url origin "https://x-access-token:${token}@git.valmo.dev/projectbraf/braf.git"
+              local basic_auth
+              basic_auth="$(printf 'x-access-token:%s' "$token" | base64 | tr -d '\n')"
+              git_auth_args=(
+                -c "http.https://git.valmo.dev/.extraheader=AUTHORIZATION: Basic ${basic_auth}"
+              )
             fi
           }
 
+          git_auth() {
+            git "${git_auth_args[@]}" "$@"
+          }
+
           install_runtime
           install_mikero
 
@@ -106,7 +115,7 @@ jobs:
           git config --global --add safe.directory /repo
           configure_git_auth
           git lfs install --local
-          git fetch --no-tags origin "$GIT_SHA" || git fetch --no-tags origin main
+          git_auth fetch --no-tags origin "$GIT_SHA" || git_auth fetch --no-tags origin main
 
           if is_zero_sha "$GIT_BEFORE" || ! git cat-file -e "$GIT_BEFORE^{commit}" 2>/dev/null; then
             mapfile -t changed_addons < <(
@@ -153,7 +162,7 @@ jobs:
 
             echo "Changed addons: $(addon_csv "${changed_addons[@]}")"
             echo "Fetching LFS only for: $include"
-            git lfs fetch origin "$GIT_SHA" --include="$include" --exclude="*"
+            git_auth lfs fetch origin "$GIT_SHA" --include="$include" --exclude="*"
             git lfs checkout "${changed_addons[@]}"
           else
             echo "Only workshop metadata changed; using cached PBOs."