Add fresh Gitea LFS verification mode

.github/workflows/docker_build.yml

@@ -59,6 +59,11 @@ on:
         required: true
         default: 'false'
         type: boolean
+      verify_gitea_lfs:
+        description: 'Force LFS download from an empty temporary cache'
+        required: true
+        default: 'false'
+        type: boolean
 
 # Only allow one deployment at a time; queue new ones (never cancel a running deploy).
 # The build-all job checks if it's still the latest commit on main and skips if not,
@@ -136,6 +141,7 @@ jobs:
         env:
           GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
           GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
+          GITEA_LFS_VERIFY_FRESH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.verify_gitea_lfs == 'true' }}
           GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh --include="src/main/go/net/eagle0/admin_server/static/tiles/*"
 

ci/github_actions/fetch_lfs.sh

@@ -46,6 +46,18 @@ git lfs ls-files | wc -l
 
 GITEA_LFS_PULL=()
 FALLBACK_GITHUB_LFS_PULL=()
+GITEA_LFS_STORAGE_CONFIG=()
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    if [ -z "${RUNNER_TEMP:-}" ]; then
+        echo "ERROR: RUNNER_TEMP must be set for fresh Gitea LFS verification"
+        exit 1
+    fi
+
+    GITEA_LFS_STORAGE=$(mktemp -d "$RUNNER_TEMP/gitea-lfs-verification.XXXXXX")
+    GITEA_LFS_STORAGE_CONFIG=(-c "lfs.storage=$GITEA_LFS_STORAGE")
+    echo "Using empty temporary Git LFS storage for verification"
+fi
 
 if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
     if [ -z "${GITEA_LFS_TOKEN:-}" ]; then
@@ -63,6 +75,7 @@ if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
         git
         -c "http.https://gitea.eagle0.net/.extraheader=AUTHORIZATION: basic $GITEA_BASIC_AUTH"
         -c "lfs.url=$GITEA_LFS_URL"
+        "${GITEA_LFS_STORAGE_CONFIG[@]}"
         lfs
         pull
     )
@@ -70,7 +83,13 @@ elif [ "${GITHUB_ACTIONS:-}" = "true" ]; then
     echo "Gitea LFS credentials are unavailable; skipping directly to the temporary GitHub fallback"
 else
     # Local callers can use their configured Git credential helper.
-    GITEA_LFS_PULL=(git -c "lfs.url=$GITEA_LFS_URL" lfs pull)
+    GITEA_LFS_PULL=(
+        git
+        -c "lfs.url=$GITEA_LFS_URL"
+        "${GITEA_LFS_STORAGE_CONFIG[@]}"
+        lfs
+        pull
+    )
 fi
 
 if [ -n "${GITHUB_TOKEN:-}" ]; then