From 72c296d354dadfbe063eda7719c31bb6b8f2171c Mon Sep 17 00:00:00 2001
From: Jon Kazama <kontakt@hellion-media.de>
Date: Sat, 15 Aug 2026 23:16:59 +0200
Subject: [PATCH] revert(ci): checkout wieder ueber actions/checkout

Rueckbau des Workarounds von 00f5b89. Der Archiv-Download war noetig,
weil git fetch gegen die Forge crashte. Ursache war kein git-Bug, sondern
eine Kompromittierung ueber CVE-2026-59774: ein injizierter
packObjectsHook ersetzte git pack-objects durch einen Malware-Dropper,
dessen Ausgabe upload-pack an einer Assertion sterben liess.

Gitea laeuft jetzt auf 1.27.2, der Hook ist entfernt, fetch funktioniert
wieder. Details: Obsidian "Projekte/Hellion Forge/Forge Security-Incident
2026-08-15.md".
---
 .gitea/workflows/security-scan.yml | 28 ++--------------------------
 1 file changed, 2 insertions(+), 26 deletions(-)

diff --git a/.gitea/workflows/security-scan.yml b/.gitea/workflows/security-scan.yml
index 4c7bc27..7fe5625 100644
--- a/.gitea/workflows/security-scan.yml
+++ b/.gitea/workflows/security-scan.yml
@@ -33,32 +33,8 @@ jobs:
     name: Security Scan
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout sources
-        # Deliberately NOT actions/checkout: git fetch over HTTPS is broken on
-        # this Gitea instance since 2026-08-12. `git upload-pack --stateless-rpc`
-        # aborts with BUG("packfile_uris requires sideband-all") in upload-pack.c
-        # and dumps core on every fetch, so any git-based checkout fails before
-        # the scan even starts. Reproducible on every repo, every client, and on
-        # git 2.52 as well as 2.55 — SSH and the web UI are unaffected.
-        #
-        # Semgrep and Trivy only need the working tree, not history, so we pull
-        # the source archive over plain HTTP instead. Swap this back to
-        # actions/checkout once the upstream fetch path works again.
-        env:
-          TOKEN: ${{ github.token }}
-          # On pull_request the merge SHA may not be archivable, use the head.
-          REF: ${{ github.event.pull_request.head.sha || github.sha }}
-          SERVER: ${{ github.server_url }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -eu
-          echo "Fetching archive for $REPO @ $REF"
-          curl -sfL --retry 3 --retry-delay 5 \
-            -H "Authorization: token $TOKEN" \
-            "$SERVER/$REPO/archive/$REF.tar.gz" -o /tmp/source.tar.gz
-          tar xzf /tmp/source.tar.gz --strip-components=1
-          rm -f /tmp/source.tar.gz
-          echo "Extracted $(find . -type f | wc -l) files"
+      - name: Checkout
+        uses: actions/checkout@v6
 
       - name: Set up Python
         uses: actions/setup-python@v6