From 2820851aa7bd4ab2d7450673b4c279aa144f7630 Mon Sep 17 00:00:00 2001
From: Tracewebstudio Dev <dev@tracewebstudio.com>
Date: Thu, 30 Apr 2026 20:38:18 +0200
Subject: [PATCH] fix(ci): use basic auth header for gitea git operations

---
 .github/workflows/sync-to-gitea.yml | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/sync-to-gitea.yml b/.github/workflows/sync-to-gitea.yml
index d2d998d..be0c30e 100644
--- a/.github/workflows/sync-to-gitea.yml
+++ b/.github/workflows/sync-to-gitea.yml
@@ -72,11 +72,14 @@ jobs:
             exit 1
           fi
 
+          TARGET_REMOTE_URL="https://${GITEA_HOST}/${TARGET_FULL_NAME}.git"
+
           for auth_user in "$TOKEN_OWNER_USER" "$GITEA_USERNAME" "oauth2"; do
             [ -n "$auth_user" ] || continue
-            auth_url="https://${auth_user}:${GITEA_TOKEN}@${GITEA_HOST}/${TARGET_FULL_NAME}.git"
-            if git ls-remote "$auth_url" >/dev/null 2>&1; then
-              TARGET_URL="$auth_url"
+            AUTH_B64="$(printf '%s' "${auth_user}:${GITEA_TOKEN}" | base64 | tr -d '\n')"
+            if git -c http.extraHeader="Authorization: Basic ${AUTH_B64}" ls-remote "$TARGET_REMOTE_URL" >/dev/null 2>&1; then
+              TARGET_URL="$TARGET_REMOTE_URL"
+              TARGET_HTTP_AUTH_HEADER="Authorization: Basic ${AUTH_B64}"
               echo "Using Gitea credential mode for ${TARGET_FULL_NAME} as ${auth_user}"
               break
             fi
@@ -88,7 +91,8 @@ jobs:
             "https://${GITEA_TOKEN}@${GITEA_HOST}/${TARGET_FULL_NAME}.git" \
             "https://oauth2:${GITEA_TOKEN}@${GITEA_HOST}/${TARGET_FULL_NAME}.git"; do
               if git ls-remote "$auth_url" >/dev/null 2>&1; then
-                TARGET_URL="$auth_url"
+                TARGET_URL="$TARGET_REMOTE_URL"
+                TARGET_HTTP_AUTH_HEADER=""
                 echo "Using Gitea credential mode for ${TARGET_FULL_NAME}"
                 break
               fi
@@ -102,7 +106,12 @@ jobs:
 
           git remote add gitea "$TARGET_URL"
 
-          git fetch gitea "$BRANCH_NAME" || true
-          git push gitea "HEAD:${BRANCH_NAME}" --force-with-lease=refs/heads/"$BRANCH_NAME"
+          if [ -n "${TARGET_HTTP_AUTH_HEADER:-}" ]; then
+            git -c http.extraHeader="$TARGET_HTTP_AUTH_HEADER" fetch gitea "$BRANCH_NAME" || true
+            git -c http.extraHeader="$TARGET_HTTP_AUTH_HEADER" push gitea "HEAD:${BRANCH_NAME}" --force-with-lease=refs/heads/"$BRANCH_NAME"
+          else
+            git fetch gitea "$BRANCH_NAME" || true
+            git push gitea "HEAD:${BRANCH_NAME}" --force-with-lease=refs/heads/"$BRANCH_NAME"
+          fi
 
           echo "Sync complete!"