From 4ff007e4036b336e997f12685c34372268637444 Mon Sep 17 00:00:00 2001
From: Bendik Aagaard Lynghaug <bendik.lynghaug@gmail.com>
Date: Mon, 28 Sep 2026 13:36:50 +0200
Subject: [PATCH] ci: v4 builtin:checkout in ci + release (no Node, no
 token-in-URL)

builtin:checkout is native Go, so the rust:1 container needs no Node and the
job token no longer rides in the fetch URL (was visible in process args).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .gitea/workflows/ci.yml      | 13 +++----------
 .gitea/workflows/release.yml | 13 +++----------
 2 files changed, 6 insertions(+), 20 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 4f60259..bd43524 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -12,17 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     container: rust:1
     steps:
-      # Not the checkout action: it runs on node, which the rust:1 job
-      # container doesn't have and this runner doesn't inject (the v5
-      # run died with 'exec: "node": not found'). Plain git needs
-      # neither, and the token URL works against the private repo.
+      # v4 built-in checkout: native Go, needs no Node (rust:1 has none) and
+      # keeps the token out of a fetch URL. Uses the job token for the private repo.
       - name: checkout
-        run: |
-          git init -q .
-          git fetch --depth 1 \
-            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            "$GITHUB_SHA"
-          git checkout -q FETCH_HEAD
+        uses: builtin:checkout
       - name: rustfmt
         run: |
           rustup component add rustfmt
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
index 6ae8e08..b215dca 100644
--- a/.gitea/workflows/release.yml
+++ b/.gitea/workflows/release.yml
@@ -19,17 +19,10 @@ jobs:
       matrix:
         target: [x86_64-unknown-linux-gnu, aarch64-unknown-linux-gnu]
     steps:
-      # Not the checkout action: it runs on node, which the rust:1 job
-      # container doesn't have and this runner doesn't inject (the v5
-      # run died with 'exec: "node": not found'). Plain git needs
-      # neither, and the token URL works against the private repo.
+      # v4 built-in checkout: native Go, needs no Node (rust:1 has none) and
+      # keeps the token out of a fetch URL. Uses the job token for the private repo.
       - name: checkout
-        run: |
-          git init -q .
-          git fetch --depth 1 \
-            "https://gitea:${{ secrets.GITHUB_TOKEN }}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git" \
-            "$GITHUB_SHA"
-          git checkout -q FETCH_HEAD
+        uses: builtin:checkout
 
       - name: install tooling
         run: |