fix(ci): keep workflows on Gitea supply chain

apps/api/src/services/awoooi_gitea_onboarding_warning_step_template_copy_receipt.py

@@ -17,7 +17,7 @@ _SCHEMA_VERSION = "awoooi_gitea_onboarding_warning_step_template_copy_receipt_v1
 _RECEIPT_SCHEMA_VERSION = (
     "awoooi_gitea_onboarding_warning_step_template_copy_receipt_snapshot_v1"
 )
-_EXPECTED_WORKFLOW_SHA256_12 = "980ff5452f59"
+_EXPECTED_WORKFLOW_SHA256_12 = "6a6710f37fd1"
 _TEMPLATE_RELATIVE_PATH = (
     "docs/operations/templates/awoooi-gitea-onboarding-warning-step.workflow.yaml"
 )

apps/api/tests/test_p0_cicd_baseline_source_readiness_api.py

@@ -377,7 +377,7 @@ def _assert_template_copy_receipt(payload: dict):
     assert payload["status"] == "controlled_template_copy_receipt_ready"
     assert payload["active_blockers"] == []
     assert payload["readback"]["template_copy_performed"] is True
-    assert payload["readback"]["workflow_content_sha256_12"] == "980ff5452f59"
+    assert payload["readback"]["workflow_content_sha256_12"] == "6a6710f37fd1"
     assert payload["target_selector"]["active_workflow_file_created"] is True
     assert payload["rollups"]["template_file_present"] is True
     assert payload["rollups"]["receipt_snapshot_present"] is True
@@ -385,7 +385,7 @@ def _assert_template_copy_receipt(payload: dict):
     assert payload["rollups"]["workflow_matches_template"] is True
     assert payload["rollups"]["auto_branch_event_count"] == 0
     assert payload["rollups"]["generic_runner_label_count"] == 0
-    assert payload["rollups"]["expected_workflow_sha256_12"] == "980ff5452f59"
+    assert payload["rollups"]["expected_workflow_sha256_12"] == "6a6710f37fd1"
     assert payload["rollups"]["fail_closed_execution_switch_present"] is False
     assert payload["rollups"]["runtime_execution_switch_controlled"] is True
     assert payload["rollups"]["runtime_execution_switch_value"] == "1"

apps/api/tests/test_signal_worker_ansible_executor_binding.py

@@ -107,9 +107,9 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     )
     workflow = (repo_root / ".gitea/workflows/cd.yaml").read_text()
 
-    assert deployment["metadata"]["annotations"][
-        "argocd.argoproj.io/sync-options"
-    ] == "Replace=true"
+    assert "argocd.argoproj.io/sync-options" not in deployment["metadata"].get(
+        "annotations", {}
+    )
     assert "AIA-P0-011 API/executor production boundary verified" in workflow
     assert "patch deployments.apps --all-namespaces" in workflow
     assert "delete pods --all-namespaces" in workflow
@@ -117,6 +117,23 @@ def test_cd_prunes_and_verifies_api_executor_boundary_in_production() -> None:
     assert "github.com/kubernetes-sigs/kustomize" not in workflow
 
 
+def test_gitea_workflows_never_download_github_actions() -> None:
+    repo_root = Path(__file__).resolve().parents[3]
+    workflow_root = repo_root / ".gitea/workflows"
+
+    for path in sorted(workflow_root.glob("*.y*ml")):
+        source = path.read_text()
+        assert "uses: actions/" not in source, path
+        for forbidden_domain in (
+            "github.com/",
+            "api.github.com/",
+            "raw.githubusercontent.com/",
+            "codeload.github.com/",
+            "ghcr.io/",
+        ):
+            assert forbidden_domain not in source, path
+
+
 def test_api_log_does_not_claim_skipped_executor_was_scheduled() -> None:
     repo_root = Path(__file__).resolve().parents[3]
     main_source = (repo_root / "apps/api/src/main.py").read_text()