From e092c1ea6e7f7d14953ebcf13feb24f8a3aefef5 Mon Sep 17 00:00:00 2001
From: maziggy <mz@v8w.de>
Date: Mon, 29 Jun 2026 13:25:07 +0200
Subject: [PATCH] ci(repo-stats): swap actions/checkout for direct git clone on
 gh-pages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The PAT-token swap didn't fix the gh-pages fetch — same opaque "exit
code 1" from actions/checkout@v4 on both attempts of the retry loop,
with no underlying git stderr surfaced. Likely the wildcard-refspec
+ shallow fetch pattern v4 uses combined with something at the runner
side, but the action's swallowed errors make it untriagable from logs.

Replacing the gh-pages checkout with `git clone --branch gh-pages
--depth 1` using the same PAT, embedded in the URL. Direct, explicit,
and if anything goes wrong the real git error reaches the log instead
of "exit code 1". The recorded remote keeps the PAT, so the later
`git push` reuses it — no separate auth setup needed.

Identity config (user.name / user.email) moved into the clone step so
it lives on the freshly cloned repo; dropped the now-duplicate config
calls from commit-and-push.

Source checkout still uses actions/checkout@v4 since it never had a
problem (the default ref is the workflow's own commit, no wildcard
refspec required).
---
 .github/workflows/repo-stats.yml | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/repo-stats.yml b/.github/workflows/repo-stats.yml
index e7ae33159..2c7b2f420 100644
--- a/.github/workflows/repo-stats.yml
+++ b/.github/workflows/repo-stats.yml
@@ -29,17 +29,21 @@ jobs:
         with:
           path: source
 
+      # actions/checkout@v4 was hiding the underlying git stderr behind
+      # an opaque "exit code 1" even with the same PAT jgehrcke writes
+      # gh-pages with. Direct git clone surfaces the real error if
+      # anything goes wrong and avoids the wildcard-refspec dance
+      # actions/checkout does for fetch-depth=1.
       - name: checkout-gh-pages
-        uses: actions/checkout@v4
-        with:
-          ref: gh-pages
-          path: gh-pages
-          # Same PAT jgehrcke writes gh-pages with — keeps the auth
-          # chain uniform and avoids the default GITHUB_TOKEN being
-          # rejected on fetch (root cause of the earlier "exit code 1"
-          # with no surfaced git stderr).
-          token: ${{ secrets.GHRS_GITHUB_API_TOKEN }}
-          fetch-depth: 1
+        env:
+          GH_PAT: ${{ secrets.GHRS_GITHUB_API_TOKEN }}
+        run: |
+          git clone --branch gh-pages --depth 1 \
+            "https://x-access-token:${GH_PAT}@github.com/${{ github.repository }}.git" \
+            gh-pages
+          cd gh-pages
+          git config user.name  "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
       - name: inject-ghcr-pulls
         run: |
@@ -56,8 +60,6 @@ jobs:
             echo "no changes — skipping commit"
             exit 0
           fi
-          git config user.name  "github-actions[bot]"
-          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git add maziggy/bambuddy/latest-report/report.html \
                   maziggy/bambuddy/ghcr-pulls.csv
           git commit -m "ghcr-pulls: refresh container downloads chart"