🐛 fix(ci): inline gitea workflow bootstrap

remove the pre-checkout dependency on .gitea/ci/prepare_repo.sh
from the root workflows and inline the bootstrap logic instead.

add a regression test for workflow bootstrap ordering and register
it in the tests README.

.gitea/ci/prepare_repo.sh

@@ -1,51 +0,0 @@
-#!/usr/bin/env bash
-# Clones or updates the repo to WORKSPACE_DIR/<repo-name> and checks out the
-# target commit. Sets REPO_DIR in $GITHUB_ENV on success.
-#
-# Required env vars (provided by GitHub Actions context):
-#   WORKSPACE_DIR, GITHUB_SERVER_URL, GITHUB_REPOSITORY, github.sha,
-#   github.ref, github.ref_name, github.event.repository.name
-# Optional:
-#   WORKFLOW secret (used as OAuth token for private repos)
-set -euo pipefail
-
-REPO_NAME="${REPO_NAME}"
-REPO_DIR="${WORKSPACE_DIR}/${REPO_NAME}"
-TOKEN="${TOKEN:-}"
-
-if [ -n "$TOKEN" ]; then
-  REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
-else
-  REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
-fi
-
-if [ -d "$REPO_DIR" ]; then
-  if [ -d "$REPO_DIR/.git" ]; then
-    cd "$REPO_DIR"
-    git clean -fdx
-    git reset --hard
-    git fetch --all --tags --force --prune --prune-tags
-  else
-    rm -rf "$REPO_DIR"
-  fi
-fi
-
-if [ ! -d "$REPO_DIR/.git" ]; then
-  mkdir -p "$WORKSPACE_DIR"
-  git clone "$REPO_URL" "$REPO_DIR"
-  cd "$REPO_DIR"
-fi
-
-if git -C "$REPO_DIR" cat-file -e "${TARGET_SHA}^{commit}" 2>/dev/null; then
-  git -C "$REPO_DIR" checkout -f "$TARGET_SHA"
-else
-  if [ -n "${TARGET_REF:-}" ]; then
-    git -C "$REPO_DIR" fetch origin "$TARGET_REF"
-    git -C "$REPO_DIR" checkout -f FETCH_HEAD
-  else
-    git -C "$REPO_DIR" checkout -f "$TARGET_REF_NAME"
-  fi
-fi
-
-git config --global --add safe.directory "$REPO_DIR"
-echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"

.gitea/workflows/standards-check.yml

@@ -23,13 +23,55 @@ jobs:
 
     steps:
       - name: 📥 准备仓库
-        env:
+        run: |
-          REPO_NAME: ${{ github.event.repository.name }}
+          set -euo pipefail
-          TOKEN: ${{ secrets.WORKFLOW }}
+
-          TARGET_SHA: ${{ github.sha }}
+          echo "========================================"
-          TARGET_REF: ${{ github.ref }}
+          echo "📥 准备仓库到 WORKSPACE_DIR"
-          TARGET_REF_NAME: ${{ github.ref_name }}
+          echo "========================================"
-        run: bash .gitea/ci/prepare_repo.sh
+
+          REPO_NAME="${{ github.event.repository.name }}"
+          REPO_DIR="${WORKSPACE_DIR}/${REPO_NAME}"
+          TOKEN="${{ secrets.WORKFLOW }}"
+          TARGET_SHA="${{ github.sha }}"
+          TARGET_REF="${{ github.ref }}"
+          TARGET_REF_NAME="${{ github.ref_name }}"
+
+          if [ -n "$TOKEN" ]; then
+            REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
+          else
+            REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          fi
+
+          if [ -d "$REPO_DIR" ]; then
+            if [ -d "$REPO_DIR/.git" ]; then
+              cd "$REPO_DIR"
+              git clean -fdx
+              git reset --hard
+              git fetch --all --tags --force --prune --prune-tags
+            else
+              rm -rf "$REPO_DIR"
+            fi
+          fi
+
+          if [ ! -d "$REPO_DIR/.git" ]; then
+            mkdir -p "$WORKSPACE_DIR"
+            git clone "$REPO_URL" "$REPO_DIR"
+          fi
+
+          if git -C "$REPO_DIR" cat-file -e "${TARGET_SHA}^{commit}" 2>/dev/null; then
+            git -C "$REPO_DIR" checkout -f "$TARGET_SHA"
+          else
+            if [ -n "$TARGET_REF" ]; then
+              git -C "$REPO_DIR" fetch origin "$TARGET_REF"
+              git -C "$REPO_DIR" checkout -f FETCH_HEAD
+            else
+              git -C "$REPO_DIR" checkout -f "$TARGET_REF_NAME"
+            fi
+          fi
+
+          git config --global --add safe.directory "$REPO_DIR"
+          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
       - name: 🧪 Lint commit message / PR title
         run: |
           cd "$REPO_DIR"

.gitea/workflows/test.yml

@@ -30,13 +30,55 @@ jobs:
 
     steps:
       - name: 📥 准备仓库
-        env:
+        run: |
-          REPO_NAME: ${{ github.event.repository.name }}
+          set -euo pipefail
-          TOKEN: ${{ secrets.WORKFLOW }}
+
-          TARGET_SHA: ${{ github.sha }}
+          echo "========================================"
-          TARGET_REF: ${{ github.ref }}
+          echo "📥 准备仓库到 WORKSPACE_DIR"
-          TARGET_REF_NAME: ${{ github.ref_name }}
+          echo "========================================"
-        run: bash .gitea/ci/prepare_repo.sh
+
+          REPO_NAME="${{ github.event.repository.name }}"
+          REPO_DIR="${WORKSPACE_DIR}/${REPO_NAME}"
+          TOKEN="${{ secrets.WORKFLOW }}"
+          TARGET_SHA="${{ github.sha }}"
+          TARGET_REF="${{ github.ref }}"
+          TARGET_REF_NAME="${{ github.ref_name }}"
+
+          if [ -n "$TOKEN" ]; then
+            REPO_URL="https://oauth2:${TOKEN}@${GITHUB_SERVER_URL#https://}/${GITHUB_REPOSITORY}.git"
+          else
+            REPO_URL="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git"
+          fi
+
+          if [ -d "$REPO_DIR" ]; then
+            if [ -d "$REPO_DIR/.git" ]; then
+              cd "$REPO_DIR"
+              git clean -fdx
+              git reset --hard
+              git fetch --all --tags --force --prune --prune-tags
+            else
+              rm -rf "$REPO_DIR"
+            fi
+          fi
+
+          if [ ! -d "$REPO_DIR/.git" ]; then
+            mkdir -p "$WORKSPACE_DIR"
+            git clone "$REPO_URL" "$REPO_DIR"
+          fi
+
+          if git -C "$REPO_DIR" cat-file -e "${TARGET_SHA}^{commit}" 2>/dev/null; then
+            git -C "$REPO_DIR" checkout -f "$TARGET_SHA"
+          else
+            if [ -n "$TARGET_REF" ]; then
+              git -C "$REPO_DIR" fetch origin "$TARGET_REF"
+              git -C "$REPO_DIR" checkout -f FETCH_HEAD
+            else
+              git -C "$REPO_DIR" checkout -f "$TARGET_REF_NAME"
+            fi
+          fi
+
+          git config --global --add safe.directory "$REPO_DIR"
+          echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"
 
       - name: 🔧 安装测试依赖
         run: |

tests/README.md

@@ -10,6 +10,7 @@ tests/
 ├── cli/                            # Python CLI 测试（unittest）
 │   └── test_playbook_cli.py        # playbook.py 基础功能测试
 ├── test_format_md_action.py        # format_md 动作测试
+├── test_gitea_workflow_bootstrap.py # Gitea workflow 自举顺序回归测试
 ├── test_firstparty_skills_quality.py # first-party skills 元数据与结构质量测试
 ├── test_gitattributes_modes.py     # gitattr_mode 行为测试
 ├── test_no_backup_flags.py         # no_backup 行为测试

tests/test_gitea_workflow_bootstrap.py

@@ -0,0 +1,22 @@
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+TEST_WORKFLOW = ROOT / ".gitea" / "workflows" / "test.yml"
+STANDARDS_WORKFLOW = ROOT / ".gitea" / "workflows" / "standards-check.yml"
+
+
+class GiteaWorkflowBootstrapTests(unittest.TestCase):
+    def test_repo_workflows_do_not_call_repo_local_prepare_script_before_checkout(self):
+        for workflow in (TEST_WORKFLOW, STANDARDS_WORKFLOW):
+            text = workflow.read_text(encoding="utf-8")
+            with self.subTest(workflow=workflow.name):
+                self.assertNotIn("bash .gitea/ci/prepare_repo.sh", text)
+                self.assertIn('REPO_DIR="${WORKSPACE_DIR}/${REPO_NAME}"', text)
+                self.assertIn('git clone "$REPO_URL" "$REPO_DIR"', text)
+                self.assertIn('echo "REPO_DIR=$REPO_DIR" >> "$GITHUB_ENV"', text)
+
+
+if __name__ == "__main__":
+    unittest.main()