fix: remove legacy PaC delivery blockers

scripts/src/hwlab-node-web-sentinel-cicd-jobs.ts

@@ -802,8 +802,9 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
     `job_name=${shellQuote(jobName)}`,
     `image_ref=${shellQuote(state.image.ref)}`,
     `image_repository=${shellQuote(state.image.repository)}`,
-    `gitops_repository=${shellQuote(stringAt(state.controlPlaneTarget, "source.repository"))}`,
     `gitops_branch=${shellQuote(stringAt(state.cicd, "argo.targetRevision"))}`,
+    "gitops_read_url=${GITOPS_READ_URL:?GITOPS_READ_URL is required}",
+    "gitops_username=${GITOPS_USERNAME:?GITOPS_USERNAME is required}",
     `files_b64=${shellQuote(filesB64)}`,
     "meta_dir=/workspace/meta",
     "event_log=/workspace/publish-events.log",
@@ -814,10 +815,17 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
     "emit_failed() { code=$?; if [ \"$code\" -ne 0 ]; then trace_id=$(printf '%s' \"${TRACEPARENT:-}\" | cut -d- -f2); printf '{\"ok\":false,\"status\":\"failed\",\"traceId\":\"%s\",\"firstBreak\":{\"code\":\"child-process-exit-nonzero\",\"phase\":\"%s\",\"reason\":\"GitOps publish command exited non-zero\",\"valuesRedacted\":true},\"error\":{\"type\":\"ChildProcessError\",\"code\":\"EXIT_NONZERO\",\"phase\":\"%s\",\"exitCode\":%s,\"stderrSummary\":\"bounded step logs contain the command failure\",\"valuesRedacted\":true},\"exitCode\":%s,\"jobName\":\"%s\",\"valuesRedacted\":true}\\n' \"$trace_id\" \"${current_phase:-gitops-publish}\" \"${current_phase:-gitops-publish}\" \"$code\" \"$code\" \"$job_name\"; fi; exit \"$code\"; }",
     "trap emit_failed EXIT",
     "if [ -f \"$event_log\" ]; then cat \"$event_log\"; fi",
-    "mkdir -p /root/.ssh",
-    "cp /git-ssh/ssh-privatekey /root/.ssh/id_rsa",
-    "chmod 0400 /root/.ssh/id_rsa",
-    "export GIT_SSH_COMMAND='ssh -i /root/.ssh/id_rsa -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.ssh/known_hosts -o ConnectTimeout=15 -o ServerAliveInterval=5 -o ServerAliveCountMax=1'",
+    "askpass=/workspace/gitea-askpass.sh",
+    "cat >\"$askpass\" <<'ASKPASS'",
+    "#!/bin/sh",
+    "case \"$1\" in",
+    "  *Username*) printf '%s\\n' \"${GITEA_USERNAME:?}\" ;;",
+    "  *Password*) cat /workspace/gitea-auth/token ;;",
+    "  *) exit 1 ;;",
+    "esac",
+    "ASKPASS",
+    "chmod 700 \"$askpass\"",
+    "export GITEA_USERNAME=\"$gitops_username\" GIT_ASKPASS=\"$askpass\" GIT_ASKPASS_REQUIRE=force GIT_TERMINAL_PROMPT=0",
     "started_ms=$(read_meta started_ms)",
     "source_commit=$(read_meta source_commit)",
     "source_stage_ref=$(read_meta source_stage_ref)",
@@ -852,9 +860,8 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
     "gitops_started_ms=$(now_ms)",
     "if [ \"$files_b64\" != \"W10=\" ]; then",
     "  emit_stage gitops running \"$gitops_started_ms\"",
-    "  gitops_cache=\"/cache/${gitops_repository}.git\"",
     "  gitops_worktree=\"/tmp/$job_name/gitops\"",
-    "  git clone --no-checkout \"$gitops_cache\" \"$gitops_worktree\"",
+    "  git clone --no-checkout \"$gitops_read_url\" \"$gitops_worktree\"",
     "  cd \"$gitops_worktree\"",
     "  git fetch origin \"$gitops_branch\" || true",
     "  if git rev-parse --verify \"refs/remotes/origin/$gitops_branch^{commit}\" >/dev/null 2>&1; then git checkout -B \"$gitops_branch\" \"refs/remotes/origin/$gitops_branch\"; else git checkout --orphan \"$gitops_branch\"; git rm -rf . >/dev/null 2>&1 || true; fi",