esh-pfi-infrastructure/persistent-memory.d/2026-08-05-ci-flip-parked.md

- `[2026-08-05]` **Fleet CI resilience — DEFAULT_ACTIONS_URL=self flip ATTEMPTED end-to-end, PARKED on a runner-auth blocker. Infra-ops to research the runner action-fetch auth, later (operator-directed 2026-08-05, deferred — not now; untracked, no issue).**

**Goal (worldtree-dev's operator-directed filing, run-9189 evidence):** every Gitea Actions job hard-depends on **github.com** at step zero — `act_runner` resolves bare `uses:` refs (checkout/cache/setup-uv/etc.) against github at job start. A GitHub blip froze a real deploy (run 9189, `connection reset` cloning `actions/checkout`). Fix = mirror the action repos into Gitea + point `DEFAULT_ACTIONS_URL` at self, so github can be down and fleet CI doesn't care.

**What's DONE + staged (all reversible, still in place):**
- **Fleet `uses:` audit** (scripts in `/tmp/claude-1000/gitea_uses_audit.py`, run via ana-docker localhost API): 71 repos, 23 with workflows, but the raw ~42 action count is **almost all dormant vendored-OSS mirrors** (0 Action runs). The **actually-running CI repos** (Worldtree/arbo/althing/skaldsong/asset-engine/vor/task-board/nevermore/mead-hall/soong-lab) use just **7 action repos**.
- **7 mirrors created + populated + public** under gitea orgs **`actions`** + **`astral-sh`**: checkout, cache, upload-artifact, download-artifact, setup-node, setup-python, astral-sh/setup-uv. All in-use tags verified present (checkout@v4/v6, cache@v4, up/download-artifact@v3, setup-node@v4, setup-python@v5, setup-uv@v3/v5/v7). **Actions DISABLED on all 7** (they're source mirrors; don't want their own CI). Repos are PUBLIC.
- **Gitea = 1.26.1, container `gitea` on ana-docker; runner = `gitea-runner` (act_runner v0.6.0), label `pfi-fleet`, jobs run in a `container:`.**

**Mirror-creation FOOT-GUN (paid for):** gitea's **migrate-from-github is flaky** — migrations ran 227–531s then 422'd, leaving broken empty repos (only cache synced). And **github throttles ana-docker's colo IP** after a clone burst (same pattern as the original github dependency). **The reliable method: plain `git clone --mirror` on nh3-dev (residential egress) + push to gitea via git-SSH `ssh://git@10.250.50.70:222` (auths as vh from nh3-dev).** That populated the last 3 cleanly. Use that, not the gitea migrate API, to (re)build mirrors.

**THE BLOCKER (why it's parked):** with `DEFAULT_ACTIONS_URL=self`, the runner correctly resolves `uses: actions/checkout@v4` → `https://gitea.phasefinal.com/actions/checkout` (confirmed in the runner log + the decompressed job log at `/data/gitea/actions_log/vh/<repo>/*.log.zst` — **zstd, decompress on the ana-docker HOST, not in the gitea container which lacks zstd**). But the fetch **fails on auth**: `authentication required: Invalid username or token. Password authentication is not supported for Git operations.` The runner is **NOT** fetching anonymously — it **sends a credential gitea rejects**. So `REQUIRE_SIGNIN_VIEW=false` did NOT fix it (that would only help an anonymous fetch; anon clone of the public mirror does work now). The real issue is **how act_runner v0.6.0 authenticates its action-fetch to a gitea 1.26 instance** — that's the research task.

**Current CONFIG STATE (post-revert):** `DEFAULT_ACTIONS_URL` is **REMOVED** from gitea app.ini → **back to github default (CI works normally)**. **`REQUIRE_SIGNIN_VIEW = false` was SET and KEPT** (operator: "require_signin_view false on internal wg net") — now a **standing change** on the internal WG net (anon view of PUBLIC repos only; private repos stay auth-gated). app.ini backups on the box: `/data/gitea/conf/app.ini.bak-*` (signinflip / revert / actions).

**Smoke method (for when re-attempting):** create a throwaway `vh/actions-smoke` repo with a minimal `runs-on: pfi-fleet` + `container: python:3.11.10-slim-bookworm` + `uses: actions/checkout@v4` + `echo` workflow (adding the workflow file triggers `on: push`); poll `/repos/vh/actions-smoke/actions/tasks`. `ci.yml` has NO `workflow_dispatch` and the run **rerun API 404s** on 1.26 — pushing a commit is the trigger. SUCCESS = the checkout step resolves from the local mirror.

**NEXT STEP (my deferred task):** research act_runner's action-fetch auth on gitea 1.26 (how it should authenticate; a runner config token, a gitea setting, or a version constraint). worldtree-dev (filer, runs gitea CI daily) offered as an alternative but operator directed **infra-ops** to do it. Everything's staged for a clean re-attempt once the auth path is understood; if dropped, tear down the `actions`/`astral-sh` orgs + 7 mirrors. Related: `[[2026-08-03-worldtree-b168-384-385-arc]]` (the gitea-CI stack context).