From b6eae28234785b896b3922895d4815308da67394 Mon Sep 17 00:00:00 2001
From: vjrj <vjrj@comunes.org>
Date: Thu, 16 Jul 2026 11:32:08 +0200
Subject: [PATCH] ci(forgejo): manual git checkout instead of
 actions/checkout@v4

The cirruslabs/flutter job image has no Node.js, so JS-based actions fail with
'exec: node: not found'. Check out with plain git over the internal forgejo:3000
URL + job token, keeping the workflows Node-free.
---
 .forgejo/workflows/ci.yml      | 40 ++++++++++++++++++++++++++++------
 .forgejo/workflows/release.yml | 11 +++++++++-
 2 files changed, 43 insertions(+), 8 deletions(-)

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 9331d0a..4c065ed 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -1,9 +1,11 @@
 # Per-push gate for git.comunes.org (Forgejo Actions): analyze + tests.
-# Mirrors the local verification gate in docs/design/testing.md. Ported from the
-# retired .gitlab-ci.yml. Flutter pinned to the developer toolchain (3.41.9).
+# Mirrors the local verification gate in docs/design/testing.md. Flutter pinned
+# to the developer toolchain (3.41.9).
 #
-# NOTE: `runs-on` must match a label your Forgejo runner registered with; adjust
-# if the Comunes runner uses something other than `docker`.
+# NOTE: `runs-on` must match a label your Forgejo runner registered with.
+# We check out with plain git (a `run:` step) instead of actions/checkout@v4:
+# the cirruslabs/flutter image has no Node.js, and JS-based actions need it
+# ("exec: node: not found"). Manual checkout keeps the workflow Node-free.
 
 name: ci
 
@@ -18,7 +20,15 @@ jobs:
     container:
       image: ghcr.io/cirruslabs/flutter:3.41.9
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
       - run: flutter pub get
       - run: dart format --output=none --set-exit-if-changed .
       - run: flutter analyze
@@ -28,7 +38,15 @@ jobs:
     container:
       image: ghcr.io/cirruslabs/flutter:3.41.9
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
       - run: flutter pub get
       - name: dart test
         working-directory: packages/commons_core
@@ -39,7 +57,15 @@ jobs:
     container:
       image: ghcr.io/cirruslabs/flutter:3.41.9
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
       # SQLCipher so the "no plaintext at rest" security test actually runs.
       - run: apt-get update -qq && apt-get install -y -qq libsqlcipher-dev
       - run: flutter pub get
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 558a89c..f3c1c3d 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -26,8 +26,17 @@ jobs:
     container:
       image: ghcr.io/cirruslabs/flutter:3.41.9
     steps:
+      # Manual git checkout (no Node): the flutter image has no node, so JS
+      # actions like actions/checkout@v4 fail with "exec: node: not found".
       - name: Checkout
-        uses: actions/checkout@v4
+        env:
+          TOKEN: ${{ github.token }}
+        run: |
+          git config --global --add safe.directory '*'
+          git init -q .
+          git remote add origin "http://x-access-token:${TOKEN}@forgejo:3000/${GITHUB_REPOSITORY}.git"
+          git fetch -q --depth 1 origin "${GITHUB_SHA}"
+          git checkout -q FETCH_HEAD
 
       - name: Generate code (i18n + Drift)
         working-directory: apps/app_seeds