fix(ci): replace actions/checkout with shell git for container jobs

actions/checkout@v4 is a JS action executed inside the job container: - dotnet/sdk:10.0 has no Node.js → exit 127 - node:20-alpine has no git → checkout fails Fix: manual git clone via shell using http.extraheader for token auth. Token never appears in process list or git log. deploy job (self-hosted:host) keeps actions/checkout — the act_runner image has both node and git. Also removes defaults.run.working-directory from Node.js jobs (the checkout step must start in workspace root, not web/<app>). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-28 11:46:34 +03:30
parent 6c868f5f30
commit 8ddb427edd
1 changed files with 110 additions and 28 deletions
@@ -22,7 +22,19 @@ concurrency:
 #   - container: image: overrides the base image for the job ✅
 #   - services: creates sidecar containers on the same network ✅
 #   - workspace is properly mounted into the container ✅
-#   - No need for actions/setup-dotnet or actions/setup-node ✅
+#
+# WHY we don't use actions/checkout@v4 in container jobs:
+#   actions/checkout is a JavaScript action — the runner executes it with
+#   `node index.js` INSIDE the job container.
+#
+#   mcr.microsoft.com/dotnet/sdk  → no Node.js  → exit 127
+#   node:20-alpine                → no git       → checkout fails
+#
+#   Fix: plain shell git clone (TOKEN via http.extraheader so it never
+#   appears in the process list or git log).
+#
+# deploy (self-hosted:host) runs on the runner itself which HAS node+git,
+# so actions/checkout@v4 works there normally.
 # ─────────────────────────────────────────────────────────────────────────────

 jobs:
@@ -31,7 +43,6 @@ jobs:
  api-build:
    name: "CI · API (dotnet build + test)"
    runs-on: ubuntu-latest
-    # .NET SDK baked into the image — no internet download needed
    container:
      image: mcr.microsoft.com/dotnet/sdk:10.0
    services:
@@ -54,7 +65,16 @@ jobs:
          --health-timeout 3s
          --health-retries 10
    steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD

      - name: Restore
        run: dotnet restore src/Meezi.API/Meezi.API.csproj
@@ -75,7 +95,16 @@ jobs:
    container:
      image: mcr.microsoft.com/dotnet/sdk:10.0
    steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD

      - name: Restore
        run: dotnet restore src/Meezi.Admin.API/Meezi.Admin.API.csproj
@@ -89,13 +118,26 @@ jobs:
    runs-on: ubuntu-latest
    container:
      image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/dashboard
    steps:
-      - uses: actions/checkout@v4
-      - run: npm install --legacy-peer-deps --ignore-scripts
-      - run: npx tsc --noEmit
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/dashboard
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/dashboard
+        run: npx tsc --noEmit
        env:
          NEXT_PUBLIC_API_URL: http://localhost:5080

@@ -105,13 +147,26 @@ jobs:
    runs-on: ubuntu-latest
    container:
      image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/admin
    steps:
-      - uses: actions/checkout@v4
-      - run: npm install --legacy-peer-deps --ignore-scripts
-      - run: npx tsc --noEmit
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/admin
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/admin
+        run: npx tsc --noEmit
        env:
          NEXT_PUBLIC_ADMIN_API_URL: http://localhost:5081

@@ -121,13 +176,26 @@ jobs:
    runs-on: ubuntu-latest
    container:
      image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/website
    steps:
-      - uses: actions/checkout@v4
-      - run: npm install --legacy-peer-deps --ignore-scripts
-      - run: npx tsc --noEmit
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/website
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/website
+        run: npx tsc --noEmit
        env:
          MEEZI_API_URL: http://localhost:5080

@@ -137,19 +205,33 @@ jobs:
    runs-on: ubuntu-latest
    container:
      image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/finder
    steps:
-      - uses: actions/checkout@v4
-      - run: npm install --legacy-peer-deps --ignore-scripts
-      - run: npx tsc --noEmit
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/finder
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/finder
+        run: npx tsc --noEmit
        env:
          NEXT_PUBLIC_API_URL: http://localhost:5080

 # ─────────────────────────────────────────────────────────────────────────────
 # DEPLOY — only on push to main, only if ALL CI jobs pass.
 # self-hosted:host — runs directly on your server where Docker is installed.
+# The runner itself (gitea/act_runner) has node+git, so actions/checkout works.
 # ─────────────────────────────────────────────────────────────────────────────
  deploy:
    name: "Deploy · all services"