ci: switch runner git clones from HTTPS+CF Access to SSH deploy key

servers/legion/k8s/gitea-runner/external-secrets.yaml

@@ -1,20 +1,19 @@
 ---
 # gitea-runner-secret — neural-platform org runner token
 #
-# GITEA_INSTANCE_URL stays as the in-cluster URL — the act_runner daemon
-# polls it constantly and we don't want every poll to hit Cloudflare Access.
-# Build containers, however, need the public URL because they run with
-# network: host and can't resolve gitea.git.svc.cluster.local. The
-# git-cf-access-init.sh entrypoint in the ci-base image rewrites the
-# in-cluster URL to https://git.neuralplatform.ai with the CF Access
-# headers from CF_ACCESS_CLIENT_ID / CF_ACCESS_CLIENT_SECRET below.
+# GITEA_INSTANCE_URL: act_runner daemon polls git.neuralplatform.ai via HTTPS.
+# GITEA_SSH_PRIVATE_KEY: ED25519 deploy key for SSH-based git clones inside
+#   build containers. git-ssh-init.sh (sourced via BASH_ENV) writes this key
+#   to ~/.ssh/gitea_key and rewrites HTTPS Gitea URLs to SSH so that
+#   actions/checkout and plain `git clone` both use SSH auth without any
+#   HTTPS credential or CF Access token.
 apiVersion: external-secrets.io/v1beta1
 kind: ExternalSecret
 metadata:
   name: gitea-runner-secret
   namespace: ci
   annotations:
-    force-sync: "2026-05-05-gke-gitea-url"
+    force-sync: "2026-05-05-ssh-clone"
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -27,21 +26,16 @@ spec:
       data:
         GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
-        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
-        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
+        GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
   data:
     - secretKey: runner_token
       remoteRef:
         key: secret/data/gitea
         property: runner_token
-    - secretKey: cf_access_client_id
+    - secretKey: ci_ssh_private_key
       remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_id
-    - secretKey: cf_access_client_secret
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_secret
+        key: secret/data/gitea
+        property: ci_ssh_private_key
 ---
 # neuron-technologies-runner-secret — neuron-technologies org runner token
 apiVersion: external-secrets.io/v1beta1
@@ -50,7 +44,7 @@ metadata:
   name: neuron-technologies-runner-secret
   namespace: ci
   annotations:
-    force-sync: "2026-05-05-gke-gitea-url"
+    force-sync: "2026-05-05-ssh-clone"
 spec:
   refreshInterval: 1h
   secretStoreRef:
@@ -63,18 +57,13 @@ spec:
       data:
         GITEA_INSTANCE_URL: "https://git.neuralplatform.ai"
         GITEA_RUNNER_REGISTRATION_TOKEN: "{{ .runner_token }}"
-        CF_ACCESS_CLIENT_ID: "{{ .cf_access_client_id }}"
-        CF_ACCESS_CLIENT_SECRET: "{{ .cf_access_client_secret }}"
+        GITEA_SSH_PRIVATE_KEY: "{{ .ci_ssh_private_key }}"
   data:
     - secretKey: runner_token
       remoteRef:
         key: secret/data/gitea
         property: neuron_technologies_runner_token
-    - secretKey: cf_access_client_id
+    - secretKey: ci_ssh_private_key
       remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_id
-    - secretKey: cf_access_client_secret
-      remoteRef:
-        key: secret/data/gitea-runner-cf-access
-        property: client_secret
+        key: secret/data/gitea
+        property: ci_ssh_private_key