fix: fetch Hestia sources without custom SSH secrets

.gitea/README.md

@@ -2,20 +2,24 @@
 
 [workflows](workflows/README.md) contains repository workflows.
 
-## CI checkout prerequisites
+## CI source checkout
 
 All workflows use `runs-on: ces-control`; no shared Runner configuration is changed.
-Configure repository or organization secrets `CODEX_BOT_SSH_KEY` (the dedicated
-codex-bot private SSH key) and `GITEA_SSH_KNOWN_HOSTS` (the independently verified
-known_hosts entry for `[gitea.entroia.com]:22222`). The bot needs read access to the
-repository and its Aster submodule. Workflows use an isolated SSH command with
-`-F /dev/null`, `IdentitiesOnly=yes`, an explicit key and port, strict host-key
-checking, and temporary credential files removed after checkout. Keys are never
-written into tracked files. Missing secrets fail checkout explicitly.
+`actions/checkout@v4` reads source over HTTPS using Gitea's automatically supplied
+`GITEA_TOKEN`. No additional SSH key or known_hosts secrets are required, and
+`persist-credentials: false` prevents credentials from being retained for later
+build steps.
 
-The SSH submodule URL's repository owner is separate from the authenticated bot.
-Local Git operations must use the same dedicated bot identity; configure the
-checkout's isolated command in `GIT_SSH_COMMAND` for submodule initialization.
+Consumer workflows read the exact Aster commit from the checked-out project's
+`vendor/aster` gitlink, then use another standard checkout into that directory and
+verify the resulting HEAD. They do not follow Aster main automatically. Aster is
+currently a public repository, so reading it does not require private cross-repo
+authorization. If that visibility changes, diagnose the job token's read access
+instead of assuming an SSH key must be distributed.
+
+The SSH URL in `.gitmodules` is retained for developer Git operations, which
+continue to use the dedicated codex-bot identity. CI's built-in job token is
+separate from local developer credentials.
 
 Workflow definitions do not prove CI passed. CI/deployment state is not queried
 automatically. Local runtime checks are not performed for Aster, Lyra or Hestia;

.gitea/workflows/README.md

@@ -1,5 +1,5 @@
 # Hestia Server workflows
 
-[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. Checkout and secret requirements are in [the parent README](../README.md).
+[ci.yml](ci.yml) verifies this project on main pushes, pull requests and manual dispatch. It runs on ces-control, with a 60-minute timeout. HTTPS checkout and job token details are in [the parent README](../README.md).
 
 [deploy.yml](deploy.yml) is main-only and manual-only. It repeats verification, builds the runtime image, then runs the existing deployment script. Production resource names, paths, lock and database mounts remain unchanged.

.gitea/workflows/ci.yml

@@ -13,35 +13,34 @@ jobs:
     env:
       DOCKER_BUILDKIT: "0"
     steps:
-      - name: Checkout with codex-bot
-        env:
-          CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }}
-          GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }}
-          SOURCE_SHA: ${{ gitea.sha }}
-          SOURCE_REPOSITORY: ${{ gitea.repository }}
+      - name: Checkout project
+        id: checkout_project
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          persist-credentials: false
+      - name: Read pinned Aster revision
+        id: aster_revision
         run: |
           set -eu
-          test -n "$CODEX_BOT_SSH_KEY"
-          test -n "$GITEA_SSH_KNOWN_HOSTS"
-          case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac
-          test "${#SOURCE_SHA}" -eq 40
-          umask 077
-          checkout_keys=$(mktemp -d)
-          trap 'rm -rf "$checkout_keys"' EXIT
-          printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key"
-          printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts"
-          unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS
-          export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts"
-          git init .
-          source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git"
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "$source_url"
-          else
-            git remote add origin "$source_url"
-          fi
-          git fetch --no-tags --depth=1 origin "$SOURCE_SHA"
-          git checkout --detach --force FETCH_HEAD
-          git submodule update --init --recursive
+          aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }')
+          case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac
+          test "${#aster_sha}" -eq 40
+          printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT"
+      - name: Checkout pinned Aster
+        id: checkout_aster
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          repository: Zayden-Jung/endorphin-aster-vm
+          ref: ${{ steps.aster_revision.outputs.sha }}
+          path: vendor/aster
+          persist-credentials: false
+      - name: Verify Aster revision
+        env:
+          EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }}
+        run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA"
+
       - name: Verify SQLite, PostgreSQL and HTTP host
         env:
           ASTER_RELEASE_SHA: ${{ gitea.sha }}

.gitea/workflows/deploy.yml

@@ -16,35 +16,34 @@ jobs:
       DOCKER_BUILDKIT: "0"
       ASTER_RELEASE_SHA: ${{ gitea.sha }}
     steps:
-      - name: Checkout with codex-bot
-        env:
-          CODEX_BOT_SSH_KEY: ${{ secrets.CODEX_BOT_SSH_KEY }}
-          GITEA_SSH_KNOWN_HOSTS: ${{ secrets.GITEA_SSH_KNOWN_HOSTS }}
-          SOURCE_SHA: ${{ gitea.sha }}
-          SOURCE_REPOSITORY: ${{ gitea.repository }}
+      - name: Checkout project
+        id: checkout_project
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          persist-credentials: false
+      - name: Read pinned Aster revision
+        id: aster_revision
         run: |
           set -eu
-          test -n "$CODEX_BOT_SSH_KEY"
-          test -n "$GITEA_SSH_KNOWN_HOSTS"
-          case "$SOURCE_SHA" in *[!0-9a-f]*|'') exit 1;; esac
-          test "${#SOURCE_SHA}" -eq 40
-          umask 077
-          checkout_keys=$(mktemp -d)
-          trap 'rm -rf "$checkout_keys"' EXIT
-          printf '%s\n' "$CODEX_BOT_SSH_KEY" > "$checkout_keys/key"
-          printf '%s\n' "$GITEA_SSH_KNOWN_HOSTS" > "$checkout_keys/known_hosts"
-          unset CODEX_BOT_SSH_KEY GITEA_SSH_KNOWN_HOSTS
-          export GIT_SSH_COMMAND="ssh -F /dev/null -o IdentitiesOnly=yes -i $checkout_keys/key -p 22222 -o StrictHostKeyChecking=yes -o UserKnownHostsFile=$checkout_keys/known_hosts"
-          git init .
-          source_url="ssh://git@gitea.entroia.com:22222/$SOURCE_REPOSITORY.git"
-          if git remote get-url origin >/dev/null 2>&1; then
-            git remote set-url origin "$source_url"
-          else
-            git remote add origin "$source_url"
-          fi
-          git fetch --no-tags --depth=1 origin "$SOURCE_SHA"
-          git checkout --detach --force FETCH_HEAD
-          git submodule update --init --recursive
+          aster_sha=$(git ls-tree HEAD -- vendor/aster | awk '$1 == "160000" && $2 == "commit" && $4 == "vendor/aster" { print $3 }')
+          case "$aster_sha" in *[!0-9a-f]*|'') echo "Invalid Aster gitlink" >&2; exit 1;; esac
+          test "${#aster_sha}" -eq 40
+          printf 'sha=%s\n' "$aster_sha" >> "$GITHUB_OUTPUT"
+      - name: Checkout pinned Aster
+        id: checkout_aster
+        uses: actions/checkout@v4
+        with:
+          github-server-url: ${{ gitea.server_url }}
+          repository: Zayden-Jung/endorphin-aster-vm
+          ref: ${{ steps.aster_revision.outputs.sha }}
+          path: vendor/aster
+          persist-credentials: false
+      - name: Verify Aster revision
+        env:
+          EXPECTED_ASTER_SHA: ${{ steps.aster_revision.outputs.sha }}
+        run: test "$(git -C vendor/aster rev-parse HEAD)" = "$EXPECTED_ASTER_SHA"
+
       - name: Verify SQLite, PostgreSQL and HTTP host
         env:
           ASTER_RELEASE_SHA: ${{ gitea.sha }}

README.md

@@ -19,4 +19,4 @@ Server 默认监听 127.0.0.1:8080，可由 ASTER_LISTEN 调整；宿主 JSON
 
 Host 和 Server 不连接数据库。Storage 仅在显式 DatabaseConfig 下连接，不创建应用表；真实 PostgreSQL 与 SQLite 测试均由 Hestia CI 承担。生产既有数据库、卷和目录完整保留。
 
-main 推送和 PR 只验证；生产部署须显式手动触发 deploy.yml，且再次验证成功后才构建并发布。保留旧 ASTER_* 变量、Compose 项目／服务、镜像名和生产路径，不把拆仓当成数据迁移。见 [部署](docs/operations/deployment.md)。本地不构建／测试或运行 Docker，不主动查询 CI／部署。CI 所需 bot SSH secrets 见 [.gitea](.gitea/README.md)。
+main 推送和 PR 只验证；生产部署须显式手动触发 deploy.yml，且再次验证成功后才构建并发布。保留旧 ASTER_* 变量、Compose 项目／服务、镜像名和生产路径，不把拆仓当成数据迁移。见 [部署](docs/operations/deployment.md)。本地不构建／测试或运行 Docker，不主动查询 CI／部署。CI 使用内置任务凭据检出源码，说明见 [.gitea](.gitea/README.md)。

docs/operations/validation.md

@@ -6,4 +6,4 @@ ci.yml 在 main push、PR 和手动触发时运行 scripts/ci-ces-control.sh。
 
 smoke.py 验证管理 cli 的对象释放、JSON 跨进程读写／缺失导入、Server 的健康／只读对象信息和 SIGTERM 退出，并检查失效数据库变量不导致隐式连接或创建 SQLite。Endor 五段样例的真实 run／eval 报告属于 Lyra CI，不由 Hestia 执行。
 
-生产部署位于单独手动工作流，必须重复通过以上验证。SSH 凭据要求见 ../../.gitea/README.md。工作流定义不代表实际通过，未查询结果如实注明。返回 [运维](README.md)。
+生产部署位于单独手动工作流，必须重复通过以上验证。HTTPS checkout 与内置任务凭据说明见 [.gitea](../../.gitea/README.md)。工作流定义不代表实际通过，未查询结果如实注明。返回 [运维](README.md)。

vendor/README.md

@@ -8,4 +8,4 @@ git submodule update --init --recursive
 
 根 Cargo.toml 通过子模块路径链接库；子模块保留自己的 Cargo workspace。父仓库 Cargo.lock 负责宿主依赖图。构建宿主会自动编译所需引擎库，无需启动 Aster 服务。更新时先取得明确的已发布 Aster commit，再 checkout --detach 并提交父仓库 gitlink；不要提交指向未发布引擎提交的宿主版本。
 
-CI 获取私有子模块的 bot SSH secrets 要求见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。
+CI 通过 HTTPS 获取固定 Aster 提交，使用内置任务凭据；说明见 [.gitea](../.gitea/README.md)。Aster 源码和本目录 README 是本目录直接子项。返回 [项目入口](../README.md)。