Remove actions deps

.gitea/workflows/ci.yaml

@@ -4,12 +4,19 @@ name: CI
 # push and PR. No deploy pipeline — sherlock is operator-installed via
 # `go install`, not host-deployed.
 #
+# Why no actions/checkout + actions/setup-go:
+#   act_runner re-clones every third-party JS action from github.com per
+#   job. setup-go is large and that clone routinely hangs / times out on
+#   the homelab runner. We avoid the failure mode entirely by doing the
+#   checkout with plain git and downloading Go directly from go.dev.
+#   /usr/local/go persists across jobs in the host-executor runner
+#   container, so subsequent runs are no-ops.
+#
 # Runner notes:
-#   - The Charlie runner image (gitea/act_runner + git/sops/docker-cli/bash)
-#     does NOT ship a Go toolchain. setup-go installs one at job time.
+#   - Charlie runner image: gitea/act_runner + git/sops/docker-cli/bash/sudo
+#     (alpine-based). No Go preinstalled — installed lazily below.
 #   - runs-on: self-hosted picks any Charlie runner. No SSH-into-host
-#     gymnastics required because there's no docker build / no host state
-#     to mutate; everything runs inside the runner container.
+#     because there's no docker build / no host state to mutate.
 
 on:
   push:
@@ -17,18 +24,50 @@ on:
   pull_request:
   workflow_dispatch:
 
+env:
+  GO_VERSION: "1.23.4"
+
 jobs:
   build:
     runs-on: self-hosted
+    defaults:
+      run:
+        shell: sh
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: Install Go and curl
+        run: |
+          set -eu
+          if ! command -v curl >/dev/null 2>&1; then
+            apk add --no-cache curl
+          fi
+          want="go${GO_VERSION}"
+          have="$(/usr/local/go/bin/go env GOVERSION 2>/dev/null || echo none)"
+          if [ "$have" != "$want" ]; then
+            echo "installing Go ${GO_VERSION} (had: ${have})"
+            curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-amd64.tar.gz" -o /tmp/go.tgz
+            rm -rf /usr/local/go
+            tar -C /usr/local -xzf /tmp/go.tgz
+            rm -f /tmp/go.tgz
+          else
+            echo "Go ${GO_VERSION} already installed"
+          fi
+          echo "/usr/local/go/bin" >> "$GITHUB_PATH"
+          echo "$HOME/go/bin" >> "$GITHUB_PATH"
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: "1.23"
-          cache: true
+      - name: Checkout
+        run: |
+          set -eu
+          cd "$GITHUB_WORKSPACE"
+          # Wipe any leftovers from a previous job using the same workspace.
+          rm -rf ./* ./.[!.]* 2>/dev/null || true
+          git init -q
+          git remote add origin "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          # Gitea injects GITHUB_TOKEN per job; use it as a one-shot
+          # Authorization header (not persisted to .git/config).
+          auth=$(printf '%s' "x-access-token:${GITHUB_TOKEN}" | base64 -w0)
+          git -c "http.extraheader=Authorization: Basic ${auth}" \
+              fetch --depth=1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
 
       - name: go vet
         run: go vet ./...