From 23594e1f9b7934d4394c3c096d0e643e0c764a21b082da69833d64c1b0bafc8c Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 25 Oct 2026 15:40:01 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20skip=20actions/checkout=20=E2=80=94=20do?=
 =?UTF-8?q?=20manual=20git=20clone=20(checkout=20does=20git=20init=20witho?=
 =?UTF-8?q?ut=20--object-format=3Dsha256)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .forgejo/workflows/validate.yml | 35 ++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/.forgejo/workflows/validate.yml b/.forgejo/workflows/validate.yml
index e01288d..5968dc5 100644
--- a/.forgejo/workflows/validate.yml
+++ b/.forgejo/workflows/validate.yml
@@ -6,8 +6,10 @@ on:
     branches: [main]
 
 # The repository uses the sha256 git object format. Git < 2.42 cannot speak
-# the sha256 wire protocol, so we must run the job in a container whose Debian
-# base has a recent-enough git (bookworm ships 2.39, trixie ships 2.47+).
+# the sha256 wire protocol, and actions/checkout@v4 does `git init` without
+# --object-format=sha256, which produces `fatal: mismatched algorithms:
+# client sha1; server sha256`. We therefore skip actions/checkout entirely
+# and clone manually from a trixie-based container (git 2.47+).
 jobs:
   json-schema:
     name: JSON Schema (ajv)
@@ -21,19 +23,23 @@ jobs:
           apt-get update
           apt-get install -y --no-install-recommends git curl ca-certificates
           git --version
-          node --version
 
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Clone repository (sha256-aware)
+        run: |
+          set -euo pipefail
+          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
+            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
+          cd "${GITHUB_WORKSPACE}"
+          git log -1 --oneline
 
       - name: Install ajv-cli + ajv-formats
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           npm install --prefix /tmp/ajv ajv-cli@5 ajv-formats@3
 
       - name: Validate every JSON Schema parses as JSON
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           find schemas -type f -name '*.json' -print | while read -r f; do
@@ -42,6 +48,7 @@ jobs:
           done
 
       - name: Meta-validate each schema against JSON Schema 2020-12
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           export NODE_PATH=/tmp/ajv/node_modules
@@ -51,6 +58,7 @@ jobs:
           done
 
       - name: Validate example payloads against their schemas (if any)
+        working-directory: ${{ github.workspace }}
         run: |
           set -euo pipefail
           export NODE_PATH=/tmp/ajv/node_modules
@@ -77,10 +85,13 @@ jobs:
           apt-get install -y --no-install-recommends git curl ca-certificates
           git --version
 
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
+      - name: Clone repository (sha256-aware)
+        run: |
+          set -euo pipefail
+          git clone --depth=1 --branch="${GITHUB_REF_NAME}" \
+            "https://x-access-token:${GITHUB_TOKEN}@forgejo.basicstack.de/${GITHUB_REPOSITORY}.git" "${GITHUB_WORKSPACE}"
+          cd "${GITHUB_WORKSPACE}"
+          git log -1 --oneline
 
       - name: Install OPA
         run: |
@@ -92,7 +103,9 @@ jobs:
           "$HOME/.local/bin/opa" version
 
       - name: opa fmt (fail on any diff)
+        working-directory: ${{ github.workspace }}
         run: opa fmt --list --diff policies/
 
       - name: opa test
+        working-directory: ${{ github.workspace }}
         run: opa test policies/ -v