Route CI LFS through Gitea (#8812)

* Route CI LFS through Gitea

* Add fresh Gitea LFS verification mode

* Expose fresh LFS verification failures

* Avoid duplicate Gitea LFS auth headers

.github/workflows/docker_build.yml

@@ -59,6 +59,11 @@ on:
         required: true
         default: 'false'
         type: boolean
+      verify_gitea_lfs:
+        description: 'Force LFS download from an empty temporary cache'
+        required: true
+        default: 'false'
+        type: boolean
 
 # Only allow one deployment at a time; queue new ones (never cancel a running deploy).
 # The build-all job checks if it's still the latest commit on main and skips if not,
@@ -134,6 +139,9 @@ jobs:
       - name: Fetch LFS files needed for admin server
         if: steps.check-latest.outputs.skip != 'true'
         env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
+          GITEA_LFS_VERIFY_FRESH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.verify_gitea_lfs == 'true' }}
           GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh --include="src/main/go/net/eagle0/admin_server/static/tiles/*"
 

.github/workflows/ios_testflight.yml

@@ -154,6 +154,8 @@ jobs:
 
       - name: Fetch LFS files
         env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
           GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
 

.github/workflows/mac_build.yml

@@ -159,6 +159,8 @@ jobs:
 
       - name: Fetch LFS files
         env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
           GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
 

.github/workflows/unity_build.yml

@@ -148,6 +148,8 @@ jobs:
 
       - name: Fetch LFS files
         env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
           GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
       - name: Ensure Unity version installed
@@ -265,6 +267,8 @@ jobs:
 
       - name: Fetch LFS files
         env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
           GITHUB_TOKEN: ${{ github.token }}
         run: ./ci/github_actions/fetch_lfs.sh
       - name: Ensure Unity version installed

.lfsconfig

@@ -0,0 +1,3 @@
+[lfs]
+	url = https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs
+	pushurl = https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs

ci/github_actions/fetch_lfs.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
-# Fetch LFS files from Gitea mirror with retry.
+# Fetch LFS files from the private Gitea LFS repository with retry.
 #
-# Gitea's mirror-sync API is async — the webhook fires on push but the
-# actual sync may still be in progress when CI starts. Retry with backoff
-# to bridge the gap.
+# The primary endpoint is committed in .lfsconfig. CI supplies Gitea
+# credentials through GITEA_LFS_USERNAME and GITEA_LFS_TOKEN. GitHub LFS
+# remains a temporary fallback while the Gitea migration is verified.
 #
 # Usage:
 #   ./ci/github_actions/fetch_lfs.sh                          # full pull
@@ -16,6 +16,15 @@ export PATH="${COMMON_PATHS}:${PATH}"
 
 MAX_ATTEMPTS=5
 RETRY_DELAY=15
+GITEA_LFS_URL="https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs"
+GITEA_CREDENTIAL_FILE=""
+
+cleanup() {
+    if [ -n "$GITEA_CREDENTIAL_FILE" ]; then
+        rm -f -- "$GITEA_CREDENTIAL_FILE"
+    fi
+}
+trap cleanup EXIT
 
 if [ -n "${GITHUB_PATH:-}" ]; then
     for path in /opt/homebrew/bin /usr/local/bin; do
@@ -43,34 +52,106 @@ git lfs install --local --force
 echo "LFS objects before pull:"
 git lfs ls-files | wc -l
 
-GIT_LFS_PULL=(git lfs pull)
+GITEA_LFS_PULL=()
 FALLBACK_GITHUB_LFS_PULL=()
+GITEA_CREDENTIAL_CONFIG=()
+GITEA_LFS_STORAGE_CONFIG=()
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    if [ -z "${RUNNER_TEMP:-}" ]; then
+        echo "ERROR: RUNNER_TEMP must be set for fresh Gitea LFS verification"
+        exit 1
+    fi
+
+    MAX_ATTEMPTS=1
+    GITEA_LFS_STORAGE=$(mktemp -d "$RUNNER_TEMP/gitea-lfs-verification.XXXXXX")
+    GITEA_LFS_STORAGE_CONFIG=(-c "lfs.storage=$GITEA_LFS_STORAGE")
+    echo "Using empty temporary Git LFS storage for verification"
+fi
+
+if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
+    if [ -z "${GITEA_LFS_TOKEN:-}" ]; then
+        echo "ERROR: GITEA_LFS_TOKEN must be set when GITEA_LFS_USERNAME is set"
+        exit 1
+    fi
+elif [ -n "${GITEA_LFS_TOKEN:-}" ]; then
+    echo "ERROR: GITEA_LFS_USERNAME must be set when GITEA_LFS_TOKEN is set"
+    exit 1
+fi
+
+if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
+    GITEA_CREDENTIAL_FILE=$(mktemp "${RUNNER_TEMP:-/tmp}/gitea-lfs-credentials.XXXXXX")
+    chmod 600 "$GITEA_CREDENTIAL_FILE"
+    git credential-store --file="$GITEA_CREDENTIAL_FILE" store <<EOF
+protocol=https
+host=gitea.eagle0.net
+username=$GITEA_LFS_USERNAME
+password=$GITEA_LFS_TOKEN
+EOF
+    GITEA_CREDENTIAL_CONFIG=(
+        -c "credential.helper="
+        -c "credential.helper=store --file=$GITEA_CREDENTIAL_FILE"
+    )
+    GITEA_LFS_PULL=(
+        git
+        "${GITEA_CREDENTIAL_CONFIG[@]}"
+        -c "lfs.url=$GITEA_LFS_URL"
+        "${GITEA_LFS_STORAGE_CONFIG[@]}"
+        lfs
+        pull
+    )
+elif [ "${GITHUB_ACTIONS:-}" = "true" ]; then
+    echo "Gitea LFS credentials are unavailable; skipping directly to the temporary GitHub fallback"
+else
+    # Local callers can use their configured Git credential helper.
+    GITEA_LFS_PULL=(
+        git
+        -c "lfs.url=$GITEA_LFS_URL"
+        "${GITEA_LFS_STORAGE_CONFIG[@]}"
+        lfs
+        pull
+    )
+fi
+
 if [ -n "${GITHUB_TOKEN:-}" ]; then
-    BASIC_AUTH=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')
-    GIT_LFS_PULL=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $BASIC_AUTH" lfs pull)
+    GITHUB_BASIC_AUTH=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')
     FALLBACK_GITHUB_LFS_PULL=(
         git
-        -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $BASIC_AUTH"
+        -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $GITHUB_BASIC_AUTH"
         -c "lfs.url=https://github.com/nolen777/eagle0.git/info/lfs"
         lfs
         pull
     )
 fi
 
-for i in $(seq 1 $MAX_ATTEMPTS); do
-    if "${GIT_LFS_PULL[@]}" "$@"; then
-        echo "LFS objects after pull:"
+if [ "${#GITEA_LFS_PULL[@]}" -gt 0 ]; then
+    for i in $(seq 1 $MAX_ATTEMPTS); do
+        if "${GITEA_LFS_PULL[@]}" "$@"; then
+            echo "LFS objects after Gitea pull:"
             git lfs ls-files | wc -l
             exit 0
         fi
         if [ "$i" -lt "$MAX_ATTEMPTS" ]; then
-        echo "LFS pull attempt $i/$MAX_ATTEMPTS failed, retrying in ${RETRY_DELAY}s..."
-        sleep $RETRY_DELAY
+            echo "Gitea LFS pull attempt $i/$MAX_ATTEMPTS failed, retrying in ${RETRY_DELAY}s..."
+            sleep "$RETRY_DELAY"
         fi
-done
+    done
+fi
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    echo "Last Git LFS error log:"
+    if ! git lfs logs last; then
+        echo "No Git LFS error log was available"
+    fi
+fi
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    echo "Fresh Gitea LFS verification failed; GitHub fallback is disabled"
+    exit 1
+fi
 
 if [ "${#FALLBACK_GITHUB_LFS_PULL[@]}" -gt 0 ]; then
-    echo "LFS mirror pull failed after $MAX_ATTEMPTS attempts; trying GitHub LFS fallback"
+    echo "Trying temporary GitHub LFS fallback"
     if "${FALLBACK_GITHUB_LFS_PULL[@]}" "$@"; then
         echo "LFS objects after GitHub fallback pull:"
         git lfs ls-files | wc -l
@@ -78,5 +159,5 @@ if [ "${#FALLBACK_GITHUB_LFS_PULL[@]}" -gt 0 ]; then
     fi
 fi
 
-echo "LFS pull failed after $MAX_ATTEMPTS attempts"
+echo "LFS pull failed"
 exit 1