From 8ddb427edd7c54f3598ee218cacddf6601644d74 Mon Sep 17 00:00:00 2001 From: "soroush.asadi" Date: Thu, 28 May 2026 11:46:34 +0330 Subject: [PATCH] fix(ci): replace actions/checkout with shell git for container jobs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit actions/checkout@v4 is a JS action executed inside the job container: - dotnet/sdk:10.0 has no Node.js → exit 127 - node:20-alpine has no git → checkout fails Fix: manual git clone via shell using http.extraheader for token auth. Token never appears in process list or git log. deploy job (self-hosted:host) keeps actions/checkout — the act_runner image has both node and git. Also removes defaults.run.working-directory from Node.js jobs (the checkout step must start in workspace root, not web/). Co-Authored-By: Claude Sonnet 4.6 --- .gitea/workflows/ci-cd.yml | 138 +++++++++++++++++++++++++++++-------- 1 file changed, 110 insertions(+), 28 deletions(-) diff --git a/.gitea/workflows/ci-cd.yml b/.gitea/workflows/ci-cd.yml index d051865..682056e 100644 --- a/.gitea/workflows/ci-cd.yml +++ b/.gitea/workflows/ci-cd.yml @@ -22,7 +22,19 @@ concurrency: # - container: image: overrides the base image for the job ✅ # - services: creates sidecar containers on the same network ✅ # - workspace is properly mounted into the container ✅ -# - No need for actions/setup-dotnet or actions/setup-node ✅ +# +# WHY we don't use actions/checkout@v4 in container jobs: +# actions/checkout is a JavaScript action — the runner executes it with +# `node index.js` INSIDE the job container. +# +# mcr.microsoft.com/dotnet/sdk → no Node.js → exit 127 +# node:20-alpine → no git → checkout fails +# +# Fix: plain shell git clone (TOKEN via http.extraheader so it never +# appears in the process list or git log). +# +# deploy (self-hosted:host) runs on the runner itself which HAS node+git, +# so actions/checkout@v4 works there normally. # ───────────────────────────────────────────────────────────────────────────── jobs: @@ -31,7 +43,6 @@ jobs: api-build: name: "CI · API (dotnet build + test)" runs-on: ubuntu-latest - # .NET SDK baked into the image — no internet download needed container: image: mcr.microsoft.com/dotnet/sdk:10.0 services: @@ -54,7 +65,16 @@ jobs: --health-timeout 3s --health-retries 10 steps: - - uses: actions/checkout@v4 + - name: Checkout + env: + TOKEN: ${{ github.token }} + REF: ${{ github.ref }} + run: | + git init + git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" + git config http.extraheader "Authorization: Bearer ${TOKEN}" + git fetch --depth=1 origin "${REF}" + git checkout FETCH_HEAD - name: Restore run: dotnet restore src/Meezi.API/Meezi.API.csproj @@ -75,7 +95,16 @@ jobs: container: image: mcr.microsoft.com/dotnet/sdk:10.0 steps: - - uses: actions/checkout@v4 + - name: Checkout + env: + TOKEN: ${{ github.token }} + REF: ${{ github.ref }} + run: | + git init + git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" + git config http.extraheader "Authorization: Bearer ${TOKEN}" + git fetch --depth=1 origin "${REF}" + git checkout FETCH_HEAD - name: Restore run: dotnet restore src/Meezi.Admin.API/Meezi.Admin.API.csproj @@ -89,13 +118,26 @@ jobs: runs-on: ubuntu-latest container: image: node:20-alpine - defaults: - run: - working-directory: web/dashboard steps: - - uses: actions/checkout@v4 - - run: npm install --legacy-peer-deps --ignore-scripts - - run: npx tsc --noEmit + - name: Checkout + env: + TOKEN: ${{ github.token }} + REF: ${{ github.ref }} + run: | + apk add --no-cache git + git init + git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" + git config http.extraheader "Authorization: Bearer ${TOKEN}" + git fetch --depth=1 origin "${REF}" + git checkout FETCH_HEAD + + - name: Install dependencies + working-directory: web/dashboard + run: npm install --legacy-peer-deps --ignore-scripts + + - name: TypeScript check + working-directory: web/dashboard + run: npx tsc --noEmit env: NEXT_PUBLIC_API_URL: http://localhost:5080 @@ -105,13 +147,26 @@ jobs: runs-on: ubuntu-latest container: image: node:20-alpine - defaults: - run: - working-directory: web/admin steps: - - uses: actions/checkout@v4 - - run: npm install --legacy-peer-deps --ignore-scripts - - run: npx tsc --noEmit + - name: Checkout + env: + TOKEN: ${{ github.token }} + REF: ${{ github.ref }} + run: | + apk add --no-cache git + git init + git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" + git config http.extraheader "Authorization: Bearer ${TOKEN}" + git fetch --depth=1 origin "${REF}" + git checkout FETCH_HEAD + + - name: Install dependencies + working-directory: web/admin + run: npm install --legacy-peer-deps --ignore-scripts + + - name: TypeScript check + working-directory: web/admin + run: npx tsc --noEmit env: NEXT_PUBLIC_ADMIN_API_URL: http://localhost:5081 @@ -121,13 +176,26 @@ jobs: runs-on: ubuntu-latest container: image: node:20-alpine - defaults: - run: - working-directory: web/website steps: - - uses: actions/checkout@v4 - - run: npm install --legacy-peer-deps --ignore-scripts - - run: npx tsc --noEmit + - name: Checkout + env: + TOKEN: ${{ github.token }} + REF: ${{ github.ref }} + run: | + apk add --no-cache git + git init + git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" + git config http.extraheader "Authorization: Bearer ${TOKEN}" + git fetch --depth=1 origin "${REF}" + git checkout FETCH_HEAD + + - name: Install dependencies + working-directory: web/website + run: npm install --legacy-peer-deps --ignore-scripts + + - name: TypeScript check + working-directory: web/website + run: npx tsc --noEmit env: MEEZI_API_URL: http://localhost:5080 @@ -137,19 +205,33 @@ jobs: runs-on: ubuntu-latest container: image: node:20-alpine - defaults: - run: - working-directory: web/finder steps: - - uses: actions/checkout@v4 - - run: npm install --legacy-peer-deps --ignore-scripts - - run: npx tsc --noEmit + - name: Checkout + env: + TOKEN: ${{ github.token }} + REF: ${{ github.ref }} + run: | + apk add --no-cache git + git init + git remote add origin "${{ github.server_url }}/${{ github.repository }}.git" + git config http.extraheader "Authorization: Bearer ${TOKEN}" + git fetch --depth=1 origin "${REF}" + git checkout FETCH_HEAD + + - name: Install dependencies + working-directory: web/finder + run: npm install --legacy-peer-deps --ignore-scripts + + - name: TypeScript check + working-directory: web/finder + run: npx tsc --noEmit env: NEXT_PUBLIC_API_URL: http://localhost:5080 # ───────────────────────────────────────────────────────────────────────────── # DEPLOY — only on push to main, only if ALL CI jobs pass. # self-hosted:host — runs directly on your server where Docker is installed. +# The runner itself (gitea/act_runner) has node+git, so actions/checkout works. # ───────────────────────────────────────────────────────────────────────────── deploy: name: "Deploy · all services"