Prefer local kankali:2222 SSH clone with HTTP fallback

.gitea/workflows/renovate.yml

@@ -250,9 +250,20 @@ jobs:
           SELECTED_TOKEN="${SELECTED_TOKEN_RESULT#*:}"
           export RENOVATE_TOKEN="${SELECTED_TOKEN}"
           export RENOVATE_HOST_RULES="[{\"matchHost\":\"${ENDPOINT_AUTHORITY}\",\"token\":\"${SELECTED_TOKEN}\",\"authType\":\"Token-Only\"}]"
-          # Rewrite external clone URLs to an authenticated internal URL for git operations.
+          # Rewrite external clone URLs to local-network git transport.
           export RENOVATE_GIT_REWRITE_FROM="https://dogar.darkhelm.org/"
           export RENOVATE_GIT_REWRITE_TO="http://${RENOVATE_GIT_USERNAME}:${SELECTED_TOKEN}@kankali.darkhelm.lan:3001/"
+
+          # Prefer local SSH for git on kankali:2222 when keys are available in the container.
+          if docker run --rm ${DOCKER_ADD_HOST_ARG} \
+            --entrypoint /bin/sh \
+            "${RENOVATE_IMAGE}" \
+            -lc 'GIT_SSH_COMMAND="ssh -o StrictHostKeyChecking=no -o BatchMode=yes -o ConnectTimeout=5" git ls-remote --heads "ssh://git@kankali.darkhelm.lan:2222/'"${TARGET_REPO}"'.git" >/dev/null 2>&1'; then
+            export RENOVATE_GIT_REWRITE_TO="ssh://git@kankali.darkhelm.lan:2222/"
+            echo "✓ Renovate git rewrite transport: local SSH (kankali:2222)"
+          else
+            echo "⚠ Local SSH git auth unavailable in Renovate container; using internal HTTP token fallback"
+          fi
           unset SELECTED_TOKEN RESULT_TOKEN
 
           echo "✓ Renovate auth preflight passed with ${SELECTED_TOKEN_SOURCE}"
@@ -287,6 +298,7 @@ jobs:
               -e LOG_LEVEL \
               -e NODE_TLS_REJECT_UNAUTHORIZED \
               -e GIT_SSL_NO_VERIFY=1 \
+              -e GIT_SSH_COMMAND='ssh -o StrictHostKeyChecking=no' \
               -e RENOVATE_TOKEN \
               -e RENOVATE_GIT_USERNAME \
               -e RENOVATE_GIT_REWRITE_FROM \