fix(ci): replace actions/checkout with shell git for container jobs

actions/checkout@v4 is a JS action executed inside the job container:
- dotnet/sdk:10.0 has no Node.js  → exit 127
- node:20-alpine  has no git      → checkout fails

Fix: manual git clone via shell using http.extraheader for token auth.
Token never appears in process list or git log. deploy job (self-hosted:host)
keeps actions/checkout — the act_runner image has both node and git.

Also removes defaults.run.working-directory from Node.js jobs (the checkout
step must start in workspace root, not web/<app>).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.gitea/workflows/ci-cd.yml

@@ -22,7 +22,19 @@ concurrency:
 #   - container: image: overrides the base image for the job ✅
 #   - services: creates sidecar containers on the same network ✅
 #   - workspace is properly mounted into the container ✅
-#   - No need for actions/setup-dotnet or actions/setup-node ✅
+#
+# WHY we don't use actions/checkout@v4 in container jobs:
+#   actions/checkout is a JavaScript action — the runner executes it with
+#   `node index.js` INSIDE the job container.
+#
+#   mcr.microsoft.com/dotnet/sdk  → no Node.js  → exit 127
+#   node:20-alpine                → no git       → checkout fails
+#
+#   Fix: plain shell git clone (TOKEN via http.extraheader so it never
+#   appears in the process list or git log).
+#
+# deploy (self-hosted:host) runs on the runner itself which HAS node+git,
+# so actions/checkout@v4 works there normally.
 # ─────────────────────────────────────────────────────────────────────────────
 
 jobs:
@@ -31,7 +43,6 @@ jobs:
   api-build:
     name: "CI · API (dotnet build + test)"
     runs-on: ubuntu-latest
-    # .NET SDK baked into the image — no internet download needed
     container:
       image: mcr.microsoft.com/dotnet/sdk:10.0
     services:
@@ -54,7 +65,16 @@ jobs:
           --health-timeout 3s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
 
       - name: Restore
         run: dotnet restore src/Meezi.API/Meezi.API.csproj
@@ -75,7 +95,16 @@ jobs:
     container:
       image: mcr.microsoft.com/dotnet/sdk:10.0
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
 
       - name: Restore
         run: dotnet restore src/Meezi.Admin.API/Meezi.Admin.API.csproj
@@ -89,13 +118,26 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/dashboard
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
-      - run: npm install --legacy-peer-deps --ignore-scripts
+        env:
-      - run: npx tsc --noEmit
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/dashboard
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/dashboard
+        run: npx tsc --noEmit
         env:
           NEXT_PUBLIC_API_URL: http://localhost:5080
 
@@ -105,13 +147,26 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/admin
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
-      - run: npm install --legacy-peer-deps --ignore-scripts
+        env:
-      - run: npx tsc --noEmit
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/admin
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/admin
+        run: npx tsc --noEmit
         env:
           NEXT_PUBLIC_ADMIN_API_URL: http://localhost:5081
 
@@ -121,13 +176,26 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/website
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
-      - run: npm install --legacy-peer-deps --ignore-scripts
+        env:
-      - run: npx tsc --noEmit
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/website
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/website
+        run: npx tsc --noEmit
         env:
           MEEZI_API_URL: http://localhost:5080
 
@@ -137,19 +205,33 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: node:20-alpine
-    defaults:
-      run:
-        working-directory: web/finder
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
-      - run: npm install --legacy-peer-deps --ignore-scripts
+        env:
-      - run: npx tsc --noEmit
+          TOKEN: ${{ github.token }}
+          REF: ${{ github.ref }}
+        run: |
+          apk add --no-cache git
+          git init
+          git remote add origin "${{ github.server_url }}/${{ github.repository }}.git"
+          git config http.extraheader "Authorization: Bearer ${TOKEN}"
+          git fetch --depth=1 origin "${REF}"
+          git checkout FETCH_HEAD
+
+      - name: Install dependencies
+        working-directory: web/finder
+        run: npm install --legacy-peer-deps --ignore-scripts
+
+      - name: TypeScript check
+        working-directory: web/finder
+        run: npx tsc --noEmit
         env:
           NEXT_PUBLIC_API_URL: http://localhost:5080
 
 # ─────────────────────────────────────────────────────────────────────────────
 # DEPLOY — only on push to main, only if ALL CI jobs pass.
 # self-hosted:host — runs directly on your server where Docker is installed.
+# The runner itself (gitea/act_runner) has node+git, so actions/checkout works.
 # ─────────────────────────────────────────────────────────────────────────────
   deploy:
     name: "Deploy · all services"