From 0355c7b45f7808f989d9602268a58b975a15015c Mon Sep 17 00:00:00 2001
From: Tracewebstudio Dev <dev@tracewebstudio.com>
Date: Thu, 30 Apr 2026 20:56:11 +0200
Subject: [PATCH] fix(ci): use basic auth header with token-owner login

---
 .github/workflows/sync-to-gitea.yml | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/sync-to-gitea.yml b/.github/workflows/sync-to-gitea.yml
index 7b71a3e..bd2fb49 100644
--- a/.github/workflows/sync-to-gitea.yml
+++ b/.github/workflows/sync-to-gitea.yml
@@ -18,27 +18,23 @@ jobs:
 
       - name: Sync to Gitea
         env:
-          GITEA_TOKEN_PRIMARY: ${{ secrets.GITEA_TOKEN }}
-          GITEA_TOKEN_FALLBACK: ${{ secrets.GITEA_SECRET }}
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           REPO: ${{ github.event.repository.name }}
           BRANCH: ${{ github.ref_name }}
         run: |
           set -euo pipefail
-          GITEA_TOKEN="${GITEA_TOKEN_PRIMARY:-${GITEA_TOKEN_FALLBACK:-}}"
-          if [ -z "${GITEA_TOKEN}" ]; then
-            echo "Missing GITEA token secret. Set GITEA_TOKEN (preferred) or GITEA_SECRET."
-            exit 1
-          fi
+
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
 
-          GITEA_URL="https://Admin:${GITEA_TOKEN}@ci.nxtgauge.com/Admin/${REPO}.git"
-          echo "Sync target: Admin/${REPO}.git on branch ${BRANCH}"
+          GITEA_USER="$(curl -fsS -H "Authorization: token ${GITEA_TOKEN}" https://ci.nxtgauge.com/api/v1/user | jq -r '.login')"
+          TARGET="https://ci.nxtgauge.com/Admin/${REPO}.git"
+          AUTH="$(printf '%s' "${GITEA_USER}:${GITEA_TOKEN}" | base64 | tr -d '\n')"
+
+          curl -fsS -H "Authorization: Basic ${AUTH}" "${TARGET}/info/refs?service=git-receive-pack" >/dev/null
 
           git remote remove gitea 2>/dev/null || true
-          git remote add gitea "${GITEA_URL}"
+          git remote add gitea "${TARGET}"
 
-          git ls-remote "${GITEA_URL}" >/dev/null
-
-          git push "${GITEA_URL}" "HEAD:${BRANCH}" --force
-          git push "${GITEA_URL}" --tags --force
+          git -c http.extraheader="Authorization: Basic ${AUTH}" push gitea "HEAD:${BRANCH}" --force
+          git -c http.extraheader="Authorization: Basic ${AUTH}" push gitea --tags --force