refactor: make Gitea the sole CI authority

.tekton/platform-infra-temporal-nc01-pac.yaml

@@ -14,7 +14,7 @@ spec:
   timeouts:
     pipeline: 600s
   taskRunTemplate:
-    serviceAccountName: default
+    serviceAccountName: platform-infra-temporal-nc01-tekton-runner
     podTemplate:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -28,6 +28,12 @@ spec:
             - name: workspace
               emptyDir:
                 sizeLimit: 1Gi
+            - name: gitea-auth
+              secret:
+                secretName: pac-gitea-sentinel-nc01-v03
+                items:
+                  - key: token
+                    path: token
           steps:
             - name: publish-gitops
               image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
@@ -41,6 +47,18 @@ spec:
               script: |
                 #!/bin/sh
                 set -eu
+                askpass=/workspace/gitea-askpass.sh
+                trap 'rm -f "$askpass"' EXIT
+                cat >"$askpass" <<'ASKPASS'
+                #!/bin/sh
+                case "$1" in
+                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
+                  *Password*) cat /workspace/gitea-auth/token ;;
+                  *) exit 1 ;;
+                esac
+                ASKPASS
+                chmod 700 "$askpass"
+                export GITEA_USERNAME=unidesk-admin GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                 git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source
                 cd source
                 git fetch --depth=1 --filter=blob:none origin "+$SOURCE_SNAPSHOT_PREFIX/$SOURCE_COMMIT:refs/remotes/origin/unidesk-source-snapshot"
@@ -53,3 +71,6 @@ spec:
               volumeMounts:
                 - name: workspace
                   mountPath: /workspace
+                - name: gitea-auth
+                  mountPath: /workspace/gitea-auth
+                  readOnly: true

.tekton/unidesk-host-pac.yaml

@@ -14,7 +14,7 @@ spec:
   timeouts:
     pipeline: 3600s
   taskRunTemplate:
-    serviceAccountName: default
+    serviceAccountName: unidesk-host-tekton-runner
     podTemplate:
       hostNetwork: true
       dnsPolicy: ClusterFirstWithHostNet
@@ -28,6 +28,12 @@ spec:
             - name: workspace
               emptyDir:
                 sizeLimit: 4Gi
+            - name: gitea-auth
+              secret:
+                secretName: pac-gitea-sentinel-nc01-v03
+                items:
+                  - key: token
+                    path: token
             - name: buildkit-state
               emptyDir:
                 sizeLimit: 4Gi
@@ -46,6 +52,18 @@ spec:
               script: |
                 #!/bin/sh
                 set -eu
+                askpass=/workspace/gitea-askpass.sh
+                trap 'rm -f "$askpass"' EXIT
+                cat >"$askpass" <<'ASKPASS'
+                #!/bin/sh
+                case "$1" in
+                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
+                  *Password*) cat /workspace/gitea-auth/token ;;
+                  *) exit 1 ;;
+                esac
+                ASKPASS
+                chmod 700 "$askpass"
+                export GITEA_USERNAME=unidesk-admin GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                 rm -rf source release
                 git clone --filter=blob:none --no-checkout http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source
                 cd source
@@ -61,6 +79,9 @@ spec:
               volumeMounts:
                 - name: workspace
                   mountPath: /workspace
+                - name: gitea-auth
+                  mountPath: /workspace/gitea-auth
+                  readOnly: true
             - name: prepare-buildkit-state
               image: 127.0.0.1:5000/hwlab/hwlab-ci-node-tools:node22-alpine-bun-v1
               imagePullPolicy: IfNotPresent
@@ -107,6 +128,19 @@ spec:
                   value: "{{revision}}"
               script: |
                 #!/bin/sh
+                set -eu
+                askpass=/workspace/gitea-askpass.sh
+                trap 'rm -f "$askpass"' EXIT
+                cat >"$askpass" <<'ASKPASS'
+                #!/bin/sh
+                case "$1" in
+                  *Username*) printf '%s\n' "${GITEA_USERNAME:?}" ;;
+                  *Password*) cat /workspace/gitea-auth/token ;;
+                  *) exit 1 ;;
+                esac
+                ASKPASS
+                chmod 700 "$askpass"
+                export GITEA_USERNAME=unidesk-admin GIT_ASKPASS="$askpass" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0
                 exec bun /workspace/source/scripts/native/cicd/publish-unidesk-host-gitops.mjs \
                   --config /workspace/source/config/unidesk-host-k8s.yaml \
                   --source-root /workspace/source \
@@ -117,3 +151,6 @@ spec:
               volumeMounts:
                 - name: workspace
                   mountPath: /workspace
+                - name: gitea-auth
+                  mountPath: /workspace/gitea-auth
+                  readOnly: true