ci: switch runner git clones from HTTPS+CF Access to SSH deploy key

servers/legion/k8s/gitea-runner/git-ssh-init.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+# git-ssh-init.sh
+#
+# Sets up SSH authentication for git operations inside CI build containers.
+#
+# How this gets invoked:
+#   act_runner runs each step via a non-interactive bash invocation.
+#   Setting BASH_ENV=/usr/local/bin/git-ssh-init.sh in act_runner's
+#   container.env causes bash to source this before any step's commands.
+#   (See servers/legion/k8s/gitea-runner/deployment.yaml.)
+#
+# What it does:
+#   1. Writes GITEA_SSH_PRIVATE_KEY (from the runner secret) to ~/.ssh/gitea_key
+#   2. Creates an ~/.ssh/config entry so git uses that key for git.neuralplatform.ai
+#   3. Sets a git insteadOf rule to rewrite HTTPS Gitea URLs to SSH,
+#      so `actions/checkout` and any direct `git clone https://...` also use SSH
+#
+# Idempotent — safe to re-run on every step.
+
+if [ -n "${GITEA_SSH_PRIVATE_KEY:-}" ]; then
+    mkdir -p ~/.ssh
+    chmod 700 ~/.ssh
+
+    # Write the private key
+    printf '%s\n' "${GITEA_SSH_PRIVATE_KEY}" > ~/.ssh/gitea_key
+    chmod 600 ~/.ssh/gitea_key
+
+    # SSH config — use this key for git.neuralplatform.ai, skip host key checking
+    # (build containers are ephemeral; we don't persist a known_hosts file)
+    cat > ~/.ssh/gitea_config << 'EOF'
+Host git.neuralplatform.ai
+  HostName git.neuralplatform.ai
+  User git
+  IdentityFile ~/.ssh/gitea_key
+  StrictHostKeyChecking no
+  UserKnownHostsFile /dev/null
+EOF
+    chmod 600 ~/.ssh/gitea_config
+
+    # Point SSH at our per-job config (merge with any existing config if present)
+    export GIT_SSH_COMMAND="ssh -F ~/.ssh/gitea_config"
+
+    # Rewrite HTTPS Gitea URLs → SSH so `actions/checkout` and plain `git clone`
+    # both go through SSH without any HTTPS credential or CF Access token needed
+    git config --global \
+        url."git@git.neuralplatform.ai:".insteadOf \
+        "https://git.neuralplatform.ai/" 2>/dev/null || true
+fi