From 0a53f6bc2036f82d6983e2c14c22b2e0cfc32990 Mon Sep 17 00:00:00 2001
From: juvdiaz <juvenal.diaz@oracle.com>
Date: Wed, 27 May 2026 14:39:58 -0600
Subject: [PATCH] Remove Actions deploy SSH fetch

---
 .gitea/workflows/homelab-main.yml | 36 ++++++++++++++++++++-----------
 README.md                         |  8 ++++---
 2 files changed, 28 insertions(+), 16 deletions(-)

diff --git a/.gitea/workflows/homelab-main.yml b/.gitea/workflows/homelab-main.yml
index 463eb57..9b2e016 100644
--- a/.gitea/workflows/homelab-main.yml
+++ b/.gitea/workflows/homelab-main.yml
@@ -123,26 +123,36 @@ jobs:
         run: |
           set -euo pipefail
 
-          gitea_ssh_url="${GITEA_SSH_URL:-ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git}"
-          gitea_ssh_command="${GITEA_SSH_COMMAND:-ssh -i /home/jv/.ssh/id_ed25519 -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new}"
-          deploy_dir="${HOMELAB_DEPLOY_DIR:-/home/jv/my-homelab-configs}"
-
-          if [[ ! -d "${deploy_dir}/.git" ]]; then
-            echo "Persistent deploy checkout ${deploy_dir} was not found; using Actions workspace ${PWD}."
-            deploy_dir="${PWD}"
+          workspace_dir="${PWD}"
+          deploy_dir="${HOMELAB_DEPLOY_DIR:-}"
+          if [[ -z "${deploy_dir}" ]]; then
+            for candidate in /home/jv/my-homelab-configs /home/jv/repos/my-homelab-configs "${workspace_dir}"; do
+              if [[ -d "${candidate}/.git" ]]; then
+                deploy_dir="${candidate}"
+                break
+              fi
+            done
           fi
           if [[ ! -d "${deploy_dir}/.git" ]]; then
             echo "Deploy checkout ${deploy_dir} is not a Git repository." >&2
             exit 1
           fi
-          echo "Deploy checkout: ${deploy_dir}"
+          if [[ "${deploy_dir}" != "${workspace_dir}" ]]; then
+            echo "Persistent deploy checkout: ${deploy_dir}"
+            git -C "${deploy_dir}" fetch "${workspace_dir}" HEAD
+            git -C "${deploy_dir}" checkout -B main FETCH_HEAD
+            git -C "${deploy_dir}" reset --hard FETCH_HEAD
+          else
+            echo "Deploy checkout: ${deploy_dir}"
+            git -C "${deploy_dir}" checkout -B main HEAD
+            git -C "${deploy_dir}" reset --hard HEAD
+          fi
 
-          git -C "${deploy_dir}" remote set-url gitea "${gitea_ssh_url}" || \
-            git -C "${deploy_dir}" remote add gitea "${gitea_ssh_url}"
-          GIT_SSH_COMMAND="${gitea_ssh_command}" git -C "${deploy_dir}" fetch gitea main
-          git -C "${deploy_dir}" checkout -B main "${{ gitea.sha }}"
-          git -C "${deploy_dir}" remote set-url local-bootstrap /home/jv/git-server/my-homelab-configs.git || \
+          if git -C "${deploy_dir}" remote get-url local-bootstrap >/dev/null 2>&1; then
+            git -C "${deploy_dir}" remote set-url local-bootstrap /home/jv/git-server/my-homelab-configs.git
+          else
             git -C "${deploy_dir}" remote add local-bootstrap /home/jv/git-server/my-homelab-configs.git
+          fi
           git -C "${deploy_dir}" push local-bootstrap HEAD:main
 
           "${deploy_dir}/lab.sh" apps
diff --git a/README.md b/README.md
index 4ae9aad..abb7a4c 100644
--- a/README.md
+++ b/README.md
@@ -431,9 +431,11 @@ with the Gitea repository and switches the Debian working copy's `gitea` remote
 to `ssh://git@192.168.100.89:32222/jv/my-homelab-configs.git`. The default key
 is `/home/jv/.ssh/id_ed25519.pub`; set `LAB_GITEA_REPO_SSH_KEY_PATH` to use a
 different Debian-host key, or `LAB_GITEA_REPO_SSH_BOOTSTRAP=false` to leave SSH
-access unchanged. The Actions deploy job fetches the persistent Debian checkout
-through that SSH endpoint when `HOMELAB_DEPLOY_DIR` exists, and otherwise falls
-back to the checked-out Actions workspace.
+access unchanged. The Actions deploy job uses the checked-out Actions workspace
+as the source commit, updates the first available persistent checkout from
+`HOMELAB_DEPLOY_DIR`, `/home/jv/my-homelab-configs`, or
+`/home/jv/repos/my-homelab-configs`, and otherwise deploys directly from the
+Actions workspace. It does not need SSH read access back to Gitea.
 
 Enable Actions for the repository in Gitea, then create a repository-level runner
 token from: