Route CI LFS through Gitea (#8812 )

* Route CI LFS through Gitea * Add fresh Gitea LFS verification mode * Expose fresh LFS verification failures * Avoid duplicate Gitea LFS auth headers
Update dependency rules_rust to v0.72.0 (#8811 )
2026-07-28 21:35:42 +00:00 · 2026-07-28 11:44:41 -07:00 · 2026-07-27 21:50:15 -07:00 · 2026-07-27 21:49:59 -07:00 · 2026-07-27 20:31:53 -07:00 · 2026-07-27 20:31:09 -07:00
10 changed files with 158 additions and 258 deletions
@@ -59,6 +59,11 @@ on:
        required: true
        default: 'false'
        type: boolean
+      verify_gitea_lfs:
+        description: 'Force LFS download from an empty temporary cache'
+        required: true
+        default: 'false'
+        type: boolean

 # Only allow one deployment at a time; queue new ones (never cancel a running deploy).
 # The build-all job checks if it's still the latest commit on main and skips if not,
@@ -134,6 +139,9 @@ jobs:
      - name: Fetch LFS files needed for admin server
        if: steps.check-latest.outputs.skip != 'true'
        env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
+          GITEA_LFS_VERIFY_FRESH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.verify_gitea_lfs == 'true' }}
          GITHUB_TOKEN: ${{ github.token }}
        run: ./ci/github_actions/fetch_lfs.sh --include="src/main/go/net/eagle0/admin_server/static/tiles/*"

@@ -154,6 +154,8 @@ jobs:

      - name: Fetch LFS files
        env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
          GITHUB_TOKEN: ${{ github.token }}
        run: ./ci/github_actions/fetch_lfs.sh

@@ -159,6 +159,8 @@ jobs:

      - name: Fetch LFS files
        env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
          GITHUB_TOKEN: ${{ github.token }}
        run: ./ci/github_actions/fetch_lfs.sh

@@ -148,6 +148,8 @@ jobs:

      - name: Fetch LFS files
        env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
          GITHUB_TOKEN: ${{ github.token }}
        run: ./ci/github_actions/fetch_lfs.sh
      - name: Ensure Unity version installed
@@ -265,6 +267,8 @@ jobs:

      - name: Fetch LFS files
        env:
+          GITEA_LFS_TOKEN: ${{ secrets.GITEA_LFS_TOKEN }}
+          GITEA_LFS_USERNAME: ${{ secrets.GITEA_LFS_USERNAME }}
          GITHUB_TOKEN: ${{ github.token }}
        run: ./ci/github_actions/fetch_lfs.sh
      - name: Ensure Unity version installed
@@ -0,0 +1,3 @@
+[lfs]
+	url = https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs
+	pushurl = https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs
@@ -19,7 +19,7 @@ SLF4J_VERSION = "2.0.18"

 bazel_dep(name = "bazel_skylib", version = "1.9.2")
 bazel_dep(name = "aspect_rules_esbuild", version = "0.26.0")
-bazel_dep(name = "aspect_rules_js", version = "3.2.3")
+bazel_dep(name = "aspect_rules_js", version = "3.3.0")
 bazel_dep(name = "bazel_jar_jar", version = "0.1.15", repo_name = "bazel_jar_jar")
 bazel_dep(name = "platforms", version = "1.1.0")
 bazel_dep(name = "rules_dotnet", version = "0.22.1")
@@ -33,7 +33,7 @@ multiple_version_override(
    module_name = "aspect_rules_js",
    versions = [
        "2.3.8",
-        "3.2.3",
+        "3.3.0",
    ],
 )

@@ -142,7 +142,7 @@ sysroot(
 # Language Support - Go
 #

-bazel_dep(name = "rules_go", version = "0.61.1", repo_name = "io_bazel_rules_go")
+bazel_dep(name = "rules_go", version = "0.62.0", repo_name = "io_bazel_rules_go")
 bazel_dep(name = "gazelle", version = "0.52.2", repo_name = "bazel_gazelle")

 go_sdk = use_extension("@io_bazel_rules_go//go:extensions.bzl", "go_sdk")
@@ -169,7 +169,7 @@ use_repo(
 # Language Support - Rust
 #

-bazel_dep(name = "rules_rust", version = "0.71.3")
+bazel_dep(name = "rules_rust", version = "0.72.0")

 rust = use_extension("@rules_rust//rust:extensions.bzl", "rust")
 rust.toolchain(edition = "2021")
@@ -237,9 +237,9 @@ use_repo(

 bazel_dep(name = "rules_proto", version = "7.1.0")
 bazel_dep(name = "rules_cc", version = "0.2.22")
-bazel_dep(name = "grpc", version = "1.82.1")
+bazel_dep(name = "grpc", version = "1.83.0")

-# gRPC 1.81.1's generated upb module map trips Clang's layering check in the
+# gRPC's generated upb module map trips Clang's layering check in the
 # Linux ARM64 cross-toolchain even though the normal Bazel deps are present.
 single_version_override(
    module_name = "grpc",
@@ -322,7 +322,7 @@ use_repo(oci, "alpine_linux", "alpine_linux_linux_amd64", "eclipse_temurin_25_jd
 #

 bazel_dep(name = "rules_java", version = "9.7.0")
-bazel_dep(name = "rules_jvm_external", version = "7.0")
+bazel_dep(name = "rules_jvm_external", version = "7.1")

 maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.install(
@@ -53,8 +53,8 @@
    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/MODULE.bazel": "74bf20a7a6bd5f2be09607fdb4196cfd6f203422ea271752ec2b1afe95426101",
    "https://bcr.bazel.build/modules/aspect_rules_js/2.3.8/source.json": "411ec9d79d6f5fe8a083359588c21d01a5b48d88a2cbd334a4c90365015b7836",
    "https://bcr.bazel.build/modules/aspect_rules_js/3.0.3/MODULE.bazel": "28a30e8fc33bf64a67835d64d124f6e05a7d59648dcb27b110fb3502f761e503",
-    "https://bcr.bazel.build/modules/aspect_rules_js/3.2.3/MODULE.bazel": "3a0363a5b8ec4931488dc327c577a78c1f5a725293ebffaa5d2613283701aa8a",
-    "https://bcr.bazel.build/modules/aspect_rules_js/3.2.3/source.json": "fa3187962f5fdeee0c6226792904aaafb2cf585717a264fa4393a767bffb99fe",
+    "https://bcr.bazel.build/modules/aspect_rules_js/3.3.0/MODULE.bazel": "42ef593509e813482063e09f05be1f8690722dc8bc39f1f4ae4c0944aa7e33da",
+    "https://bcr.bazel.build/modules/aspect_rules_js/3.3.0/source.json": "7503ad32423dc3d293f8563e2faa026cb850ca9f45b368b6959ee2fdf359ac28",
    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/MODULE.bazel": "d0045b5eabb012be550a609589b3e5e47eba682344b19cfd9365d4d896ed07df",
    "https://bcr.bazel.build/modules/aspect_rules_ts/3.6.0/source.json": "5593e3f1cd0dd5147f7748e163307fd5c2e1077913d6945b58739ad8d770a290",
    "https://bcr.bazel.build/modules/aspect_tools_telemetry/0.3.3/MODULE.bazel": "37c764292861c2f70314efa9846bb6dbb44fc0308903b3285da6528305450183",
@@ -97,7 +97,8 @@
    "https://bcr.bazel.build/modules/bazel_lib/3.0.0/MODULE.bazel": "22b70b80ac89ad3f3772526cd9feee2fa412c2b01933fea7ed13238a448d370d",
    "https://bcr.bazel.build/modules/bazel_lib/3.1.0/MODULE.bazel": "6809765c14e3c766a9b9286c7b0ec56ed87a73326e48fe01749f0c0fdcfe3287",
    "https://bcr.bazel.build/modules/bazel_lib/3.2.2/MODULE.bazel": "e2c890c8a515d6bca9c66d47718aa9e44b458fde64ec7204b8030bf2d349058c",
-    "https://bcr.bazel.build/modules/bazel_lib/3.2.2/source.json": "9e84e115c20e14652c5c21401ae85ff4daa8702e265b5c0b3bf89353f17aa212",
+    "https://bcr.bazel.build/modules/bazel_lib/3.5.0/MODULE.bazel": "1eba0ba67d418d99fb682c36147a9e1725abbc8fc25544be64702e32eda2be29",
+    "https://bcr.bazel.build/modules/bazel_lib/3.5.0/source.json": "98d49ec7e2b15298c990f09ec8cdea8d4788c2885497aa9cbb0a74e36e994df8",
    "https://bcr.bazel.build/modules/bazel_skylib/1.0.3/MODULE.bazel": "bcb0fd896384802d1ad283b4e4eb4d718eebd8cb820b0a2c3a347fb971afd9d8",
    "https://bcr.bazel.build/modules/bazel_skylib/1.1.1/MODULE.bazel": "1add3e7d93ff2e6998f9e118022c84d163917d912f5afafb3058e3d2f1545b5e",
    "https://bcr.bazel.build/modules/bazel_skylib/1.2.0/MODULE.bazel": "44fe84260e454ed94ad326352a698422dbe372b21a1ac9f3eab76eb531223686",
@@ -223,8 +224,8 @@
    "https://bcr.bazel.build/modules/grpc/1.71.0/MODULE.bazel": "7fcab2c05530373f1a442c362b17740dd0c75b6a2a975eec8f5bf4c70a37928a",
    "https://bcr.bazel.build/modules/grpc/1.74.1/MODULE.bazel": "09523be10ba2bfd999683671d0f8f22fb5b20ec77ad89b05ef58ff19a1b65c82",
    "https://bcr.bazel.build/modules/grpc/1.76.0.bcr.1/MODULE.bazel": "09b252536112acccdc7547cdfe16526a46408f570263f71491c813315f2efc45",
-    "https://bcr.bazel.build/modules/grpc/1.82.1/MODULE.bazel": "a176fc32c89f12f0a8dfd7a28c3b4475395c365826ab8483da437feb8eec66d6",
-    "https://bcr.bazel.build/modules/grpc/1.82.1/source.json": "fc93607f134584e008d59f9f1d7dd581afb9a8946ef4a07b7ca149bf4549bc56",
+    "https://bcr.bazel.build/modules/grpc/1.83.0/MODULE.bazel": "45e5a9f3330c510719d4ff168f1acebe1e74a304b32d4e25771b01735b672420",
+    "https://bcr.bazel.build/modules/grpc/1.83.0/source.json": "3bd4c62372667c55dbfeb7c26f7bacbd9c182f1a9fa01172b0d742d07a712703",
    "https://bcr.bazel.build/modules/helly25_bzl/0.4.3/MODULE.bazel": "9c20052fd3f1fb767c48b78c1bbc46f501a4ca69d14558429d1234e68e449f68",
    "https://bcr.bazel.build/modules/helly25_bzl/0.4.3/source.json": "e8c54d81e72633fb6f1d23c7e2d44e0b39b1caef2a256141136a2f63e6204b78",
    "https://bcr.bazel.build/modules/jq.bzl/0.1.0/MODULE.bazel": "2ce69b1af49952cd4121a9c3055faa679e748ce774c7f1fda9657f936cae902f",
@@ -366,8 +367,8 @@
    "https://bcr.bazel.build/modules/rules_go/0.53.0/MODULE.bazel": "a4ed760d3ac0dbc0d7b967631a9a3fd9100d28f7d9fcf214b4df87d4bfff5f9a",
    "https://bcr.bazel.build/modules/rules_go/0.58.3/MODULE.bazel": "5582119a4a39558d8d1b1634bcae46043d4f43a31415e861c3551b2860040b5e",
    "https://bcr.bazel.build/modules/rules_go/0.59.0/MODULE.bazel": "b7e43e7414a3139a7547d1b4909b29085fbe5182b6c58cbe1ed4c6272815aeae",
-    "https://bcr.bazel.build/modules/rules_go/0.61.1/MODULE.bazel": "b599cc67f98e8dbe040631129fbd23f190a557f7be506d4781619d0fd4dbbbec",
-    "https://bcr.bazel.build/modules/rules_go/0.61.1/source.json": "ff52d46fca8e2ac87c610c11f05c3a9f0fa08dc4294664c6a31449092409c5aa",
+    "https://bcr.bazel.build/modules/rules_go/0.62.0/MODULE.bazel": "8ee616065c3d2b2f7ac0880108316ce8d0c332b3a30aad24e95c0bc124ec853e",
+    "https://bcr.bazel.build/modules/rules_go/0.62.0/source.json": "36d781c558eb7d3bd49dc5e190455714f174232372f15207ab200b4348bda3e6",
    "https://bcr.bazel.build/modules/rules_java/4.0.0/MODULE.bazel": "5a78a7ae82cd1a33cef56dc578c7d2a46ed0dca12643ee45edbb8417899e6f74",
    "https://bcr.bazel.build/modules/rules_java/5.1.0/MODULE.bazel": "324b6478b0343a3ce7a9add8586ad75d24076d6d43d2f622990b9c1cfd8a1b15",
    "https://bcr.bazel.build/modules/rules_java/5.3.5/MODULE.bazel": "a4ec4f2db570171e3e5eb753276ee4b389bae16b96207e9d3230895c99644b86",
@@ -408,8 +409,8 @@
    "https://bcr.bazel.build/modules/rules_jvm_external/6.7/MODULE.bazel": "e717beabc4d091ecb2c803c2d341b88590e9116b8bf7947915eeb33aab4f96dd",
    "https://bcr.bazel.build/modules/rules_jvm_external/6.8/MODULE.bazel": "b5afe861e867e4c8e5b88e401cb7955bd35924258f97b1862cc966cbcf4f1a62",
    "https://bcr.bazel.build/modules/rules_jvm_external/6.9/MODULE.bazel": "07c5db05527db7744a54fcffd653e1550d40e0540207a7f7e6d0a4de5bef8274",
-    "https://bcr.bazel.build/modules/rules_jvm_external/7.0/MODULE.bazel": "421482bdbcf05709f933c96b867a599deb517f2804ceb3e74511880610cfbf71",
-    "https://bcr.bazel.build/modules/rules_jvm_external/7.0/source.json": "714cd003eadf5be5c83268311fe8e951db39f802babeaddc536b3560dc8f6faf",
+    "https://bcr.bazel.build/modules/rules_jvm_external/7.1/MODULE.bazel": "e151b1beaa45bfc9e5de4df637d980e27039eb2b1092a95972bf2adbf99ac1a0",
+    "https://bcr.bazel.build/modules/rules_jvm_external/7.1/source.json": "8cb571a9631c39bf29c1842958542f14bba1c704fe2bcde4fa54679b2a6b3d6f",
    "https://bcr.bazel.build/modules/rules_kotlin/1.9.0/MODULE.bazel": "ef85697305025e5a61f395d4eaede272a5393cee479ace6686dba707de804d59",
    "https://bcr.bazel.build/modules/rules_kotlin/1.9.5/MODULE.bazel": "043a16a572f610558ec2030db3ff0c9938574e7dd9f58bded1bb07c0192ef025",
    "https://bcr.bazel.build/modules/rules_kotlin/1.9.6/MODULE.bazel": "d269a01a18ee74d0335450b10f62c9ed81f2321d7958a2934e44272fe82dcef3",
@@ -470,13 +471,14 @@
    "https://bcr.bazel.build/modules/rules_python/1.6.0/MODULE.bazel": "7e04ad8f8d5bea40451cf80b1bd8262552aa73f841415d20db96b7241bd027d8",
    "https://bcr.bazel.build/modules/rules_python/1.6.3/MODULE.bazel": "a7b80c42cb3de5ee2a5fa1abc119684593704fcd2fec83165ebe615dec76574f",
    "https://bcr.bazel.build/modules/rules_python/1.7.0/MODULE.bazel": "d01f995ecd137abf30238ad9ce97f8fc3ac57289c8b24bd0bf53324d937a14f8",
-    "https://bcr.bazel.build/modules/rules_python/1.7.0/source.json": "028a084b65dcf8f4dc4f82f8778dbe65df133f234b316828a82e060d81bdce32",
+    "https://bcr.bazel.build/modules/rules_python/2.0.2/MODULE.bazel": "9d26ecb43f248c2663fb29f3c9b833aa86c31e736096e58c7077f80038f8d32f",
+    "https://bcr.bazel.build/modules/rules_python/2.0.2/source.json": "36a74dedc1498bfbf72855568a24e6aa30c70b5ac7e114bc244c62b3a58b47fc",
    "https://bcr.bazel.build/modules/rules_robolectric/4.14.1.2/MODULE.bazel": "d44fec647d0aeb67b9f3b980cf68ba634976f3ae7ccd6c07d790b59b87a4f251",
    "https://bcr.bazel.build/modules/rules_robolectric/4.14.1.2/source.json": "37c10335f2361c337c5c1f34ed36d2da70534c23088062b33a8bdaab68aa9dea",
    "https://bcr.bazel.build/modules/rules_rust/0.66.0/MODULE.bazel": "86ef763a582f4739a27029bdcc6c562258ed0ea6f8d58294b049e215ceb251b3",
    "https://bcr.bazel.build/modules/rules_rust/0.69.0/MODULE.bazel": "4326fec48f2fef0d514de46346f7f77e200c82936dd08b91c9ef039fbdad5c10",
-    "https://bcr.bazel.build/modules/rules_rust/0.71.3/MODULE.bazel": "e2390c96f77d65f00c769bf665678c5424188e9c777239cfaae2a8d2dde7b981",
-    "https://bcr.bazel.build/modules/rules_rust/0.71.3/source.json": "5eb5d8068571725bc893045f8137ed7937988f23d73c53ea443470e8047598ad",
+    "https://bcr.bazel.build/modules/rules_rust/0.72.0/MODULE.bazel": "e49a6d6525cf5a28d52afe17e4b12e62498652b40ab30cec26be39eb4f0303c7",
+    "https://bcr.bazel.build/modules/rules_rust/0.72.0/source.json": "a3871759cac97efb50ea066bcf6487ed639c181e71aa22d26aaa658890703bc2",
    "https://bcr.bazel.build/modules/rules_scala/7.2.6/MODULE.bazel": "027a152217e87140ccbea1e73528b35907c59806390603b80704125243d40007",
    "https://bcr.bazel.build/modules/rules_scala/7.2.6/source.json": "935f098a206b79c503bc160cb5ab06d9cfd6a73543351f975aa886d6aa8c7228",
    "https://bcr.bazel.build/modules/rules_shell/0.1.2/MODULE.bazel": "66e4ca3ce084b04af0b9ff05ff14cab4e5df7503973818bb91cbc6cda08d32fc",
@@ -546,20 +548,20 @@
  "moduleExtensions": {
    "@@aspect_rules_esbuild+//esbuild:extensions.bzl%esbuild": {
      "general": {
-        "bzlTransitiveDigest": "IzHcF+XgKB6e9Qox5GLLztTAjL/Ir3Jb/MceJxteoa4=",
+        "bzlTransitiveDigest": "2TgYqOVPOdEP28Y0P/m1fsmCztTsmsVJHCnTQzAsgZA=",
        "usagesDigest": "LSQ+zZp7JNgnBONTxxXnwGr4NTh2qtQYk7qwXXz5qWo=",
        "recordedInputs": [
-          "REPO_MAPPING:aspect_rules_esbuild+,aspect_rules_js aspect_rules_js+3.2.3",
+          "REPO_MAPPING:aspect_rules_esbuild+,aspect_rules_js aspect_rules_js+3.3.0",
          "REPO_MAPPING:aspect_rules_esbuild+,aspect_tools_telemetry_report aspect_tools_telemetry++telemetry+aspect_tools_telemetry_report",
          "REPO_MAPPING:aspect_rules_esbuild+,bazel_skylib bazel_skylib+",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,aspect_rules_js aspect_rules_js+3.2.3",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,aspect_tools_telemetry_report aspect_tools_telemetry++telemetry+aspect_tools_telemetry_report",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,bazel_features bazel_features+",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,bazel_lib bazel_lib+",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,bazel_skylib bazel_skylib+",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,bazel_tools bazel_tools",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,protobuf protobuf+",
-          "REPO_MAPPING:aspect_rules_js+3.2.3,tar.bzl tar.bzl+",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,aspect_rules_js aspect_rules_js+3.3.0",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,aspect_tools_telemetry_report aspect_tools_telemetry++telemetry+aspect_tools_telemetry_report",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,bazel_features bazel_features+",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,bazel_lib bazel_lib+",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,bazel_skylib bazel_skylib+",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,bazel_tools bazel_tools",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,protobuf protobuf+",
+          "REPO_MAPPING:aspect_rules_js+3.3.0,tar.bzl tar.bzl+",
          "REPO_MAPPING:bazel_features+,bazel_features_globals bazel_features++version_extension+bazel_features_globals",
          "REPO_MAPPING:bazel_features+,bazel_features_version bazel_features++version_extension+bazel_features_version",
          "REPO_MAPPING:bazel_lib+,bazel_lib bazel_lib+",
@@ -615,7 +617,7 @@
            }
          },
          "npm__esbuild_0.19.9": {
-            "repoRuleId": "@@aspect_rules_js+3.2.3//npm/private:npm_import.bzl%npm_import_rule",
+            "repoRuleId": "@@aspect_rules_js+3.3.0//npm/private:npm_import.bzl%npm_import_rule",
            "attributes": {
              "key": "npm__esbuild_0.19.9",
              "package": "esbuild",
@@ -627,7 +629,7 @@
            }
          },
          "npm__esbuild_0.19.9__links": {
-            "repoRuleId": "@@aspect_rules_js+3.2.3//npm/private:npm_import.bzl%npm_import_links_rule",
+            "repoRuleId": "@@aspect_rules_js+3.3.0//npm/private:npm_import.bzl%npm_import_links_rule",
            "attributes": {
              "key": "npm__esbuild_0.19.9",
              "package": "esbuild",
@@ -646,7 +648,7 @@
    "@@aspect_tools_telemetry+//:extension.bzl%telemetry": {
      "general": {
        "bzlTransitiveDigest": "4w9RM0xjdKo1crk5zL20a/TuhqO0P1z1LsuXDneBXD4=",
-        "usagesDigest": "09Nc9ADJk0DyXum1xjtlu6a7nOGYAAC01rRABwtwl0M=",
+        "usagesDigest": "wB+5bTQ6JfbGKqgpIdzeavsJXRudtVh397OCTHT6UoU=",
        "recordedInputs": [
          "REPO_MAPPING:aspect_tools_telemetry+,bazel_lib bazel_lib+",
          "REPO_MAPPING:aspect_tools_telemetry+,bazel_skylib bazel_skylib+",
@@ -658,7 +660,7 @@
            "attributes": {
              "deps": {
                "aspect_rules_esbuild": "0.26.0",
-                "aspect_rules_js": "3.2.3",
+                "aspect_rules_js": "3.3.0",
                "aspect_tools_telemetry": "0.4.2"
              },
              "last_notice": 1
@@ -1065,178 +1067,10 @@
        }
      }
    },
-    "@@rules_python+//python/extensions:config.bzl%config": {
-      "general": {
-        "bzlTransitiveDigest": "dzD8Q2YmrP3fz8saWLHPmlwPLO91ImtTmP/c9JKTStM=",
-        "usagesDigest": "ZVSXMAGpD+xzVNPuvF1IoLBkty7TROO0+akMapt1pAg=",
-        "recordedInputs": [
-          "REPO_MAPPING:rules_python+,bazel_tools bazel_tools",
-          "REPO_MAPPING:rules_python+,pypi__build rules_python++config+pypi__build",
-          "REPO_MAPPING:rules_python+,pypi__click rules_python++config+pypi__click",
-          "REPO_MAPPING:rules_python+,pypi__colorama rules_python++config+pypi__colorama",
-          "REPO_MAPPING:rules_python+,pypi__importlib_metadata rules_python++config+pypi__importlib_metadata",
-          "REPO_MAPPING:rules_python+,pypi__installer rules_python++config+pypi__installer",
-          "REPO_MAPPING:rules_python+,pypi__more_itertools rules_python++config+pypi__more_itertools",
-          "REPO_MAPPING:rules_python+,pypi__packaging rules_python++config+pypi__packaging",
-          "REPO_MAPPING:rules_python+,pypi__pep517 rules_python++config+pypi__pep517",
-          "REPO_MAPPING:rules_python+,pypi__pip rules_python++config+pypi__pip",
-          "REPO_MAPPING:rules_python+,pypi__pip_tools rules_python++config+pypi__pip_tools",
-          "REPO_MAPPING:rules_python+,pypi__pyproject_hooks rules_python++config+pypi__pyproject_hooks",
-          "REPO_MAPPING:rules_python+,pypi__setuptools rules_python++config+pypi__setuptools",
-          "REPO_MAPPING:rules_python+,pypi__tomli rules_python++config+pypi__tomli",
-          "REPO_MAPPING:rules_python+,pypi__wheel rules_python++config+pypi__wheel",
-          "REPO_MAPPING:rules_python+,pypi__zipp rules_python++config+pypi__zipp"
-        ],
-        "generatedRepoSpecs": {
-          "rules_python_internal": {
-            "repoRuleId": "@@rules_python+//python/private:internal_config_repo.bzl%internal_config_repo",
-            "attributes": {
-              "transition_setting_generators": {},
-              "transition_settings": []
-            }
-          },
-          "pypi__build": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/e2/03/f3c8ba0a6b6e30d7d18c40faab90807c9bb5e9a1e3b2fe2008af624a9c97/build-1.2.1-py3-none-any.whl",
-              "sha256": "75e10f767a433d9a86e50d83f418e83efc18ede923ee5ff7df93b6cb0306c5d4",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__click": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/00/2e/d53fa4befbf2cfa713304affc7ca780ce4fc1fd8710527771b58311a3229/click-8.1.7-py3-none-any.whl",
-              "sha256": "ae74fb96c20a0277a1d615f1e4d73c8414f5a98db8b799a7931d1582f3390c28",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__colorama": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl",
-              "sha256": "4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__importlib_metadata": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/2d/0a/679461c511447ffaf176567d5c496d1de27cbe34a87df6677d7171b2fbd4/importlib_metadata-7.1.0-py3-none-any.whl",
-              "sha256": "30962b96c0c223483ed6cc7280e7f0199feb01a0e40cfae4d4450fc6fab1f570",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__installer": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/e5/ca/1172b6638d52f2d6caa2dd262ec4c811ba59eee96d54a7701930726bce18/installer-0.7.0-py3-none-any.whl",
-              "sha256": "05d1933f0a5ba7d8d6296bb6d5018e7c94fa473ceb10cf198a92ccea19c27b53",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__more_itertools": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/50/e2/8e10e465ee3987bb7c9ab69efb91d867d93959095f4807db102d07995d94/more_itertools-10.2.0-py3-none-any.whl",
-              "sha256": "686b06abe565edfab151cb8fd385a05651e1fdf8f0a14191e4439283421f8684",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__packaging": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/49/df/1fceb2f8900f8639e278b056416d49134fb8d84c5942ffaa01ad34782422/packaging-24.0-py3-none-any.whl",
-              "sha256": "2ddfb553fdf02fb784c234c7ba6ccc288296ceabec964ad2eae3777778130bc5",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pep517": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/25/6e/ca4a5434eb0e502210f591b97537d322546e4833dcb4d470a48c375c5540/pep517-0.13.1-py3-none-any.whl",
-              "sha256": "31b206f67165b3536dd577c5c3f1518e8fbaf38cbc57efff8369a392feff1721",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pip": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/8a/6a/19e9fe04fca059ccf770861c7d5721ab4c2aebc539889e97c7977528a53b/pip-24.0-py3-none-any.whl",
-              "sha256": "ba0d021a166865d2265246961bec0152ff124de910c5cc39f1156ce3fa7c69dc",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pip_tools": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/0d/dc/38f4ce065e92c66f058ea7a368a9c5de4e702272b479c0992059f7693941/pip_tools-7.4.1-py3-none-any.whl",
-              "sha256": "4c690e5fbae2f21e87843e89c26191f0d9454f362d8acdbd695716493ec8b3a9",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__pyproject_hooks": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/ae/f3/431b9d5fe7d14af7a32340792ef43b8a714e7726f1d7b69cc4e8e7a3f1d7/pyproject_hooks-1.1.0-py3-none-any.whl",
-              "sha256": "7ceeefe9aec63a1064c18d939bdc3adf2d8aa1988a510afec15151578b232aa2",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__setuptools": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/90/99/158ad0609729111163fc1f674a5a42f2605371a4cf036d0441070e2f7455/setuptools-78.1.1-py3-none-any.whl",
-              "sha256": "c3a9c4211ff4c309edb8b8c4f1cbfa7ae324c4ba9f91ff254e3d305b9fd54561",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__tomli": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/97/75/10a9ebee3fd790d20926a90a2547f0bf78f371b2f13aa822c759680ca7b9/tomli-2.0.1-py3-none-any.whl",
-              "sha256": "939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__wheel": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/7d/cd/d7460c9a869b16c3dd4e1e403cce337df165368c71d6af229a74699622ce/wheel-0.43.0-py3-none-any.whl",
-              "sha256": "55c570405f142630c6b9f72fe09d9b67cf1477fcf543ae5b8dcb1f5b7377da81",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          },
-          "pypi__zipp": {
-            "repoRuleId": "@@bazel_tools//tools/build_defs/repo:http.bzl%http_archive",
-            "attributes": {
-              "url": "https://files.pythonhosted.org/packages/da/55/a03fd7240714916507e1fcf7ae355bd9d9ed2e6db492595f1a67f61681be/zipp-3.18.2-py3-none-any.whl",
-              "sha256": "dce197b859eb796242b0622af1b8beb0a722d52aa2f57133ead08edd5bf5374e",
-              "type": "zip",
-              "build_file_content": "package(default_visibility = [\"//visibility:public\"])\n\nload(\"@rules_python//python:py_library.bzl\", \"py_library\")\n\npy_library(\n    name = \"lib\",\n    srcs = glob([\"**/*.py\"]),\n    data = glob([\"**/*\"], exclude=[\n        # These entries include those put into user-installed dependencies by\n        # data_exclude to avoid non-determinism.\n        \"**/*.py\",\n        \"**/*.pyc\",\n        \"**/*.pyc.*\",  # During pyc creation, temp files named *.pyc.NNN are created\n        \"**/*.dist-info/RECORD\",\n        \"BUILD\",\n        \"WORKSPACE\",\n    ]),\n    # This makes this directory a top-level in the python import\n    # search path for anything that depends on this.\n    imports = [\".\"],\n)\n"
-            }
-          }
-        }
-      }
-    },
    "@@rules_python+//python/uv:uv.bzl%uv": {
      "general": {
-        "bzlTransitiveDigest": "ijW9KS7qsIY+yBVvJ+Nr1mzwQox09j13DnE3iIwaeTM=",
-        "usagesDigest": "H8dQoNZcoqP+Mu0tHZTi4KHATzvNkM5ePuEqoQdklIU=",
+        "bzlTransitiveDigest": "I8FPZMevE2oI/peSpMBRVIN++WOtfjtJVjbPsBZQ87A=",
+        "usagesDigest": "R0pij/Kri0Z/7GcM2UBot6XmOqgduje0j8y9wNMWjLA=",
        "recordedInputs": [
          "REPO_MAPPING:rules_python+,bazel_tools bazel_tools",
          "REPO_MAPPING:rules_python+,platforms platforms"
@@ -1286,7 +1120,7 @@
    "@@yq.bzl+//yq:extensions.bzl%yq": {
      "general": {
        "bzlTransitiveDigest": "tDqk+ntWTdxNAWPDjRY1uITgHbti2jcXR5ZdinltBs0=",
-        "usagesDigest": "de8DmMJnhVNDdfZqMv6ek9zXwHTEfLDqMkO3dNYalfc=",
+        "usagesDigest": "J2+fvKYoYDe7ZNdlF7t4fyZ6nEbQ3oyoUn15ElkxCMI=",
        "recordedInputs": [],
        "generatedRepoSpecs": {
          "yq_darwin_amd64": {
@@ -1,9 +1,9 @@
 #!/bin/bash
-# Fetch LFS files from Gitea mirror with retry.
+# Fetch LFS files from the private Gitea LFS repository with retry.
 #
-# Gitea's mirror-sync API is async — the webhook fires on push but the
-# actual sync may still be in progress when CI starts. Retry with backoff
-# to bridge the gap.
+# The primary endpoint is committed in .lfsconfig. CI supplies Gitea
+# credentials through GITEA_LFS_USERNAME and GITEA_LFS_TOKEN. GitHub LFS
+# remains a temporary fallback while the Gitea migration is verified.
 #
 # Usage:
 #   ./ci/github_actions/fetch_lfs.sh                          # full pull
@@ -16,6 +16,15 @@ export PATH="${COMMON_PATHS}:${PATH}"

 MAX_ATTEMPTS=5
 RETRY_DELAY=15
+GITEA_LFS_URL="https://gitea.eagle0.net/admin/eagle0-lfs.git/info/lfs"
+GITEA_CREDENTIAL_FILE=""
+
+cleanup() {
+    if [ -n "$GITEA_CREDENTIAL_FILE" ]; then
+        rm -f -- "$GITEA_CREDENTIAL_FILE"
+    fi
+}
+trap cleanup EXIT

 if [ -n "${GITHUB_PATH:-}" ]; then
    for path in /opt/homebrew/bin /usr/local/bin; do
@@ -43,34 +52,106 @@ git lfs install --local --force
 echo "LFS objects before pull:"
 git lfs ls-files | wc -l

-GIT_LFS_PULL=(git lfs pull)
+GITEA_LFS_PULL=()
 FALLBACK_GITHUB_LFS_PULL=()
+GITEA_CREDENTIAL_CONFIG=()
+GITEA_LFS_STORAGE_CONFIG=()
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    if [ -z "${RUNNER_TEMP:-}" ]; then
+        echo "ERROR: RUNNER_TEMP must be set for fresh Gitea LFS verification"
+        exit 1
+    fi
+
+    MAX_ATTEMPTS=1
+    GITEA_LFS_STORAGE=$(mktemp -d "$RUNNER_TEMP/gitea-lfs-verification.XXXXXX")
+    GITEA_LFS_STORAGE_CONFIG=(-c "lfs.storage=$GITEA_LFS_STORAGE")
+    echo "Using empty temporary Git LFS storage for verification"
+fi
+
+if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
+    if [ -z "${GITEA_LFS_TOKEN:-}" ]; then
+        echo "ERROR: GITEA_LFS_TOKEN must be set when GITEA_LFS_USERNAME is set"
+        exit 1
+    fi
+elif [ -n "${GITEA_LFS_TOKEN:-}" ]; then
+    echo "ERROR: GITEA_LFS_USERNAME must be set when GITEA_LFS_TOKEN is set"
+    exit 1
+fi
+
+if [ -n "${GITEA_LFS_USERNAME:-}" ]; then
+    GITEA_CREDENTIAL_FILE=$(mktemp "${RUNNER_TEMP:-/tmp}/gitea-lfs-credentials.XXXXXX")
+    chmod 600 "$GITEA_CREDENTIAL_FILE"
+    git credential-store --file="$GITEA_CREDENTIAL_FILE" store <<EOF
+protocol=https
+host=gitea.eagle0.net
+username=$GITEA_LFS_USERNAME
+password=$GITEA_LFS_TOKEN
+EOF
+    GITEA_CREDENTIAL_CONFIG=(
+        -c "credential.helper="
+        -c "credential.helper=store --file=$GITEA_CREDENTIAL_FILE"
+    )
+    GITEA_LFS_PULL=(
+        git
+        "${GITEA_CREDENTIAL_CONFIG[@]}"
+        -c "lfs.url=$GITEA_LFS_URL"
+        "${GITEA_LFS_STORAGE_CONFIG[@]}"
+        lfs
+        pull
+    )
+elif [ "${GITHUB_ACTIONS:-}" = "true" ]; then
+    echo "Gitea LFS credentials are unavailable; skipping directly to the temporary GitHub fallback"
+else
+    # Local callers can use their configured Git credential helper.
+    GITEA_LFS_PULL=(
+        git
+        -c "lfs.url=$GITEA_LFS_URL"
+        "${GITEA_LFS_STORAGE_CONFIG[@]}"
+        lfs
+        pull
+    )
+fi
+
 if [ -n "${GITHUB_TOKEN:-}" ]; then
-    BASIC_AUTH=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')
-    GIT_LFS_PULL=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $BASIC_AUTH" lfs pull)
+    GITHUB_BASIC_AUTH=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')
    FALLBACK_GITHUB_LFS_PULL=(
        git
-        -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $BASIC_AUTH"
+        -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $GITHUB_BASIC_AUTH"
        -c "lfs.url=https://github.com/nolen777/eagle0.git/info/lfs"
        lfs
        pull
    )
 fi

-for i in $(seq 1 $MAX_ATTEMPTS); do
-    if "${GIT_LFS_PULL[@]}" "$@"; then
-        echo "LFS objects after pull:"
-        git lfs ls-files | wc -l
-        exit 0
+if [ "${#GITEA_LFS_PULL[@]}" -gt 0 ]; then
+    for i in $(seq 1 $MAX_ATTEMPTS); do
+        if "${GITEA_LFS_PULL[@]}" "$@"; then
+            echo "LFS objects after Gitea pull:"
+            git lfs ls-files | wc -l
+            exit 0
+        fi
+        if [ "$i" -lt "$MAX_ATTEMPTS" ]; then
+            echo "Gitea LFS pull attempt $i/$MAX_ATTEMPTS failed, retrying in ${RETRY_DELAY}s..."
+            sleep "$RETRY_DELAY"
+        fi
+    done
+fi
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    echo "Last Git LFS error log:"
+    if ! git lfs logs last; then
+        echo "No Git LFS error log was available"
    fi
-    if [ "$i" -lt "$MAX_ATTEMPTS" ]; then
-        echo "LFS pull attempt $i/$MAX_ATTEMPTS failed, retrying in ${RETRY_DELAY}s..."
-        sleep $RETRY_DELAY
-    fi
-done
+fi
+
+if [ "${GITEA_LFS_VERIFY_FRESH:-}" = "true" ]; then
+    echo "Fresh Gitea LFS verification failed; GitHub fallback is disabled"
+    exit 1
+fi

 if [ "${#FALLBACK_GITHUB_LFS_PULL[@]}" -gt 0 ]; then
-    echo "LFS mirror pull failed after $MAX_ATTEMPTS attempts; trying GitHub LFS fallback"
+    echo "Trying temporary GitHub LFS fallback"
    if "${FALLBACK_GITHUB_LFS_PULL[@]}" "$@"; then
        echo "LFS objects after GitHub fallback pull:"
        git lfs ls-files | wc -l
@@ -78,5 +159,5 @@ if [ "${#FALLBACK_GITHUB_LFS_PULL[@]}" -gt 0 ]; then
    fi
 fi

-echo "LFS pull failed after $MAX_ATTEMPTS attempts"
+echo "LFS pull failed"
 exit 1
@@ -2358,20 +2358,12 @@
      "autovalue.shaded.com.google.auto.service",
      "autovalue.shaded.com.google.common.annotations",
      "autovalue.shaded.com.google.common.base",
-      "autovalue.shaded.com.google.common.cache",
      "autovalue.shaded.com.google.common.collect",
-      "autovalue.shaded.com.google.common.escape",
-      "autovalue.shaded.com.google.common.eventbus",
-      "autovalue.shaded.com.google.common.graph",
      "autovalue.shaded.com.google.common.hash",
-      "autovalue.shaded.com.google.common.html",
      "autovalue.shaded.com.google.common.io",
      "autovalue.shaded.com.google.common.math",
-      "autovalue.shaded.com.google.common.net",
      "autovalue.shaded.com.google.common.primitives",
      "autovalue.shaded.com.google.common.reflect",
-      "autovalue.shaded.com.google.common.util.concurrent",
-      "autovalue.shaded.com.google.common.xml",
      "autovalue.shaded.com.google.errorprone.annotations",
      "autovalue.shaded.com.google.errorprone.annotations.concurrent",
      "autovalue.shaded.com.google.escapevelocity",
@@ -2792,8 +2784,6 @@
      "io.netty.util.concurrent",
      "io.netty.util.internal",
      "io.netty.util.internal.logging",
-      "io.netty.util.internal.shaded.org.jctools.counters",
-      "io.netty.util.internal.shaded.org.jctools.maps",
      "io.netty.util.internal.shaded.org.jctools.queues",
      "io.netty.util.internal.shaded.org.jctools.queues.atomic",
      "io.netty.util.internal.shaded.org.jctools.queues.atomic.unpadded",
@@ -3059,7 +3049,6 @@
      "org.apache.commons.compress.compressors.xz",
      "org.apache.commons.compress.compressors.z",
      "org.apache.commons.compress.compressors.zstandard",
-      "org.apache.commons.compress.harmony",
      "org.apache.commons.compress.harmony.archive.internal.nls",
      "org.apache.commons.compress.harmony.pack200",
      "org.apache.commons.compress.harmony.unpack200",
@@ -4200,8 +4189,6 @@
      "software.amazon.awssdk.thirdparty.jackson.core.filter",
      "software.amazon.awssdk.thirdparty.jackson.core.format",
      "software.amazon.awssdk.thirdparty.jackson.core.internal.shaded.fdp.v2_21_3",
-      "software.amazon.awssdk.thirdparty.jackson.core.internal.shaded.fdp.v2_21_3.bte",
-      "software.amazon.awssdk.thirdparty.jackson.core.internal.shaded.fdp.v2_21_3.chr",
      "software.amazon.awssdk.thirdparty.jackson.core.io",
      "software.amazon.awssdk.thirdparty.jackson.core.io.schubfach",
      "software.amazon.awssdk.thirdparty.jackson.core.json",
@@ -50,24 +50,3 @@ index 75bb909586..1a4bed511e 100644
     deps = [
         "call_tracer",
         "channel_arg_names",
-diff --git a/third_party/address_sorting/address_sorting.bzl b/third_party/address_sorting/address_sorting.bzl
-index 872b10e2ef..fe7d8eb751 100644
--- a/third_party/address_sorting/address_sorting.bzl
-+++ b/third_party/address_sorting/address_sorting.bzl
-@@ -31,5 +31,6 @@
-+load("@rules_cc//cc:defs.bzl", "cc_library")
- def address_sorting_cc_library(name, srcs, hdrs, copts, includes, linkopts=[]):
-    native.cc_library(
-+    cc_library(
-         name = name,
-         srcs = srcs,
-         hdrs = hdrs,
-diff --git a/third_party/xxhash/BUILD b/third_party/xxhash/BUILD
--- a/third_party/xxhash/BUILD
-+++ b/third_party/xxhash/BUILD
-@@ -1,4 +1,5 @@
- # TODO(donnadionne): describe this package.
-+load("@rules_cc//cc:defs.bzl", "cc_library")
- cc_library(
-     name = "xxhash",
-     hdrs = [
Author	SHA1	Message	Date
adminandGitHub	c092002677	Route CI LFS through Gitea (#8812 ) * Route CI LFS through Gitea * Add fresh Gitea LFS verification mode * Expose fresh LFS verification failures * Avoid duplicate Gitea LFS auth headers	2026-07-28 11:44:41 -07:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	4162635431	Update dependency rules_rust to v0.72.0 (#8811 ) * Update dependency rules_rust to v0.72.0 * Update generated dependency lockfiles --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-27 21:50:15 -07:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>admin	d8e2e887c0	Update dependency aspect_rules_js to v3.3.0 (#8808 ) * Update dependency aspect_rules_js to v3.3.0 * Update aspect_rules_js override and lockfile --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: Dan Crosby <dan@danielcrosby.net>	2026-07-27 21:49:59 -07:00
renovate[bot]andGitHub	c6336979c8	Update dependency rules_jvm_external to v7.1 (#8810 )	2026-07-27 20:31:53 -07:00
renovate[bot]andGitHub	a7f630d89c	Update dependency grpc to v1.83.0 (#8805 )	2026-07-27 20:31:09 -07:00
renovate[bot]GitHubrenovate[bot] <29139614+renovate[bot]@users.noreply.github.com>github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	fe18ffe9a3	Update dependency rules_go to v0.62.0 (#8809 ) * Update dependency rules_go to v0.62.0 * Update generated dependency lockfiles --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-07-27 18:27:55 -07:00