From b5d7f461c091b888e0ff6d3a2fae47b734fc238f Mon Sep 17 00:00:00 2001
From: copilotcoder <copilotcoder@darkhelm.org>
Date: Thu, 28 May 2026 20:32:36 -0400
Subject: [PATCH] CICD debugging

Signed-off-by: copilotcoder <copilotcoder@darkhelm.org>
---
 .gitea/workflows/cicd-start.yaml | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

diff --git a/.gitea/workflows/cicd-start.yaml b/.gitea/workflows/cicd-start.yaml
index 9b5a035..2e49ba4 100644
--- a/.gitea/workflows/cicd-start.yaml
+++ b/.gitea/workflows/cicd-start.yaml
@@ -81,8 +81,7 @@ jobs:
       - name: Compute base hash and base-needed signal
         id: base-decision
         env:
-          PACKAGE_ACCESS_TOKEN: ${{ secrets.PACKAGE_ACCESS_TOKEN }}
-          REPO_FULL: ${{ github.repository }}
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
         run: |
           set -e
 
@@ -95,24 +94,27 @@ jobs:
           if [ -f "Dockerfile.cicd-base" ] && [ -f ".dockerignore" ]; then
             BASE_HASH=$(compute_hash "Dockerfile.cicd-base" ".dockerignore")
           else
-            API_BASE="http://${GITEA_REGISTRY_IP}:3000/api/v1"
-            REPO_OWNER="${REPO_FULL%/*}"
-            REPO_NAME="${REPO_FULL#*/}"
+            umask 077
+            trap 'rm -f ~/.ssh/id_rsa' EXIT
 
-            if [ -z "${PACKAGE_ACCESS_TOKEN}" ]; then
-              echo "❌ PACKAGE_ACCESS_TOKEN is empty"
+            if [ -z "${SSH_PRIVATE_KEY}" ]; then
+              echo "❌ SSH_PRIVATE_KEY is empty"
               exit 1
             fi
 
-            curl -fsS \
-              -H "Authorization: token ${PACKAGE_ACCESS_TOKEN}" \
-              "${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/raw/Dockerfile.cicd-base?ref=${GITHUB_SHA}" \
-              -o /tmp/Dockerfile.cicd-base
+            mkdir -p ~/.ssh /tmp/base-hash-repo
+            echo "${SSH_PRIVATE_KEY}" > ~/.ssh/id_rsa
+            chmod 600 ~/.ssh/id_rsa
+            ssh-keyscan -p "${GITEA_SSH_PORT}" "${GITEA_SSH_HOST}" >> ~/.ssh/known_hosts 2>/dev/null
 
-            curl -fsS \
-              -H "Authorization: token ${PACKAGE_ACCESS_TOKEN}" \
-              "${API_BASE}/repos/${REPO_OWNER}/${REPO_NAME}/raw/.dockerignore?ref=${GITHUB_SHA}" \
-              -o /tmp/.dockerignore
+            cd /tmp/base-hash-repo
+            git init -q
+            git remote add origin "${GITEA_REPO_SSH_URL}"
+            GIT_SSH_COMMAND="ssh -i ~/.ssh/id_rsa -o IdentitiesOnly=yes -o StrictHostKeyChecking=no" \
+              git fetch --depth 1 origin "${GITHUB_SHA}"
+
+            git show FETCH_HEAD:Dockerfile.cicd-base > /tmp/Dockerfile.cicd-base
+            git show FETCH_HEAD:.dockerignore > /tmp/.dockerignore
 
             BASE_HASH=$(compute_hash "/tmp/Dockerfile.cicd-base" "/tmp/.dockerignore")
           fi