From 00f5b896807fac7d7b9460012b7a72b574b3252f Mon Sep 17 00:00:00 2001
From: Jon Kazama <kontakt@hellion-media.de>
Date: Sat, 15 Aug 2026 19:09:23 +0200
Subject: [PATCH] fix(ci): checkout via source archive instead of git fetch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

git fetch over HTTPS is broken on this Gitea instance since 2026-08-12:
`git upload-pack --stateless-rpc` aborts with
BUG("packfile_uris requires sideband-all") in upload-pack.c and dumps
core on every fetch. Every checkout therefore failed before the scan
started, which is why all security runs have been red since then.

Reproduced against every repo, from multiple clients, on git 2.52 and
2.55, and on Gitea 1.26.1 as well as 1.26.4. SSH, the web UI and the
API are unaffected — only the smart-HTTP pack transfer dies.

Semgrep and Trivy operate on the working tree and do not need history,
so the sources are pulled as a tar archive over plain HTTP. This sidesteps
upload-pack entirely. Revert to actions/checkout once the fetch path is
fixed upstream.
---
 .gitea/workflows/security-scan.yml | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/.gitea/workflows/security-scan.yml b/.gitea/workflows/security-scan.yml
index 7fe5625..4c7bc27 100644
--- a/.gitea/workflows/security-scan.yml
+++ b/.gitea/workflows/security-scan.yml
@@ -33,8 +33,32 @@ jobs:
     name: Security Scan
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
+      - name: Checkout sources
+        # Deliberately NOT actions/checkout: git fetch over HTTPS is broken on
+        # this Gitea instance since 2026-08-12. `git upload-pack --stateless-rpc`
+        # aborts with BUG("packfile_uris requires sideband-all") in upload-pack.c
+        # and dumps core on every fetch, so any git-based checkout fails before
+        # the scan even starts. Reproducible on every repo, every client, and on
+        # git 2.52 as well as 2.55 — SSH and the web UI are unaffected.
+        #
+        # Semgrep and Trivy only need the working tree, not history, so we pull
+        # the source archive over plain HTTP instead. Swap this back to
+        # actions/checkout once the upstream fetch path works again.
+        env:
+          TOKEN: ${{ github.token }}
+          # On pull_request the merge SHA may not be archivable, use the head.
+          REF: ${{ github.event.pull_request.head.sha || github.sha }}
+          SERVER: ${{ github.server_url }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -eu
+          echo "Fetching archive for $REPO @ $REF"
+          curl -sfL --retry 3 --retry-delay 5 \
+            -H "Authorization: token $TOKEN" \
+            "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz
+          tar xzf /tmp/source.tar.gz --strip-components=1
+          rm -f /tmp/source.tar.gz
+          echo "Extracted $(find . -type f | wc -l) files"
 
       - name: Set up Python
         uses: actions/setup-python@v6