From 2356383da106f059a1cf5a84dcc8cb7ae9598819 Mon Sep 17 00:00:00 2001
From: Gabriel Brown <gbrown@ksensetech.com>
Date: Fri, 2 Oct 2026 04:36:50 -0400
Subject: [PATCH] CI: run on the VPS runner (plain shell instead of
 checkout/setup-bun actions)

Rootless podman on cirunner-vps cannot copy cached actions into job
containers (symlinks: "path escapes from parent"), so any job that
landed there failed. Checkout is now plain git and Bun comes from its
install script; both are verified on cirunner-vps.
---
 .gitea/workflows/build-next.yml | 31 ++++++++++++++++++++++++++-----
 1 file changed, 26 insertions(+), 5 deletions(-)

diff --git a/.gitea/workflows/build-next.yml b/.gitea/workflows/build-next.yml
index 381a5d2..8b26231 100644
--- a/.gitea/workflows/build-next.yml
+++ b/.gitea/workflows/build-next.yml
@@ -34,12 +34,23 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
+        # rejects symlinks inside cached actions ("path escapes from parent").
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $auth" \
+            fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
 
       - name: Set up Bun
-        uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: 1.3.14
+        # Install script instead of oven-sh/setup-bun (same podman symlink issue).
+        run: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v1.3.14" >/dev/null
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
 
       - name: Install dependencies
         run: ./scripts/ci-install
@@ -60,7 +71,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        # Plain git instead of actions/checkout: rootless podman on cirunner-vps
+        # rejects symlinks inside cached actions ("path escapes from parent").
+        env:
+          GITEA_TOKEN: ${{ gitea.token }}
+        run: |
+          git init -q .
+          git remote add origin "${{ gitea.server_url }}/${{ gitea.repository }}.git"
+          auth="$(printf 'x-access-token:%s' "$GITEA_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $auth" \
+            fetch -q --depth 1 origin "${{ gitea.sha }}"
+          git checkout -q FETCH_HEAD
 
       - name: Log in to container registry
         run: |