From 7b25fefdaaae471cadbc1f07931136f439f473e5 Mon Sep 17 00:00:00 2001
From: layue13 <layue13@users.noreply.git.potatolab.uk>
Date: Tue, 27 Oct 2026 08:02:08 +0000
Subject: [PATCH 1/2] fix: run without setup-node mirror; install PyYAML via
 venv

Gitea dogfood failed because actions/setup-node is not mirrored
(404 on git.potatolab.uk/actions/setup-node) and pip --user is
blocked by PEP 668. Prefer runner Node with an optional mirrored
setup-node, and install PyYAML into a workspace venv.
---
 action.yml | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/action.yml b/action.yml
index 250a8c8..1bf49cb 100644
--- a/action.yml
+++ b/action.yml
@@ -48,16 +48,40 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Setup Node (stdlib only)
+    # Gitea forges often lack an actions/setup-node mirror (clone → 404).
+    # Prefer runner-provided Node; only call setup-node when the mirror exists.
+    - name: Setup Node (optional mirror)
+      id: setup_node
+      continue-on-error: true
       uses: actions/setup-node@v4
       with:
         node-version: "20"
 
+    - name: Require Node.js
+      shell: bash
+      run: |
+        if ! command -v node >/dev/null 2>&1; then
+          echo "::error::Node.js >= 18 required for Gatekeep (merge-findings.js / publish.js)."
+          echo "Mirror actions/setup-node on this forge, preinstall Node on the runner, or add setup-node before uses: ./."
+          exit 1
+        fi
+        node --version
+
+    # PEP 668 blocks pip --user on many runners; use a workspace venv instead.
     - name: Install PyYAML (providers.yaml)
       shell: bash
       run: |
-        python3 -m pip install --user pyyaml -q
-        python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+        if python3 -c "import yaml" 2>/dev/null; then
+          python3 -c "import yaml; print('pyyaml ok', yaml.__version__)"
+          exit 0
+        fi
+        VENV="${{ github.workspace }}/.gatekeep/.venv"
+        mkdir -p "$(dirname "$VENV")"
+        python3 -m venv "$VENV"
+        "$VENV/bin/pip" install -q pyyaml
+        echo "$VENV/bin" >> "$GITHUB_PATH"
+        echo "VIRTUAL_ENV=$VENV" >> "$GITHUB_ENV"
+        "$VENV/bin/python" -c "import yaml; print('pyyaml ok', yaml.__version__)"
 
     - name: Discover entry points
       id: discover
-- 
2.47.3


From 7a581254bf6ed99c64f59d23ca9bebca7cbdba75 Mon Sep 17 00:00:00 2001
From: layue13 <layue13@users.noreply.git.potatolab.uk>
Date: Tue, 27 Oct 2026 08:06:30 +0000
Subject: [PATCH 2/2] fix: drop setup-node uses; fix GITHUB_OUTPUT python
 quoting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the optional setup-node step (still 404s as ##[error] on this
forge). Fix review.sh output writer — escaped quotes in a one-liner
caused SyntaxError after an otherwise successful publish.
---
 action.yml        | 13 +++----------
 scripts/review.sh | 13 ++++++++-----
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/action.yml b/action.yml
index 1bf49cb..9587cae 100644
--- a/action.yml
+++ b/action.yml
@@ -48,21 +48,14 @@ outputs:
 runs:
   using: composite
   steps:
-    # Gitea forges often lack an actions/setup-node mirror (clone → 404).
-    # Prefer runner-provided Node; only call setup-node when the mirror exists.
-    - name: Setup Node (optional mirror)
-      id: setup_node
-      continue-on-error: true
-      uses: actions/setup-node@v4
-      with:
-        node-version: "20"
-
+    # Do not uses: actions/setup-node — many Gitea forges have no mirror (404).
+    # Runner image / consumer workflow must provide Node >= 18.
     - name: Require Node.js
       shell: bash
       run: |
         if ! command -v node >/dev/null 2>&1; then
           echo "::error::Node.js >= 18 required for Gatekeep (merge-findings.js / publish.js)."
-          echo "Mirror actions/setup-node on this forge, preinstall Node on the runner, or add setup-node before uses: ./."
+          echo "Preinstall Node on the runner, or add a mirrored setup-node step before uses: ./."
           exit 1
         fi
         node --version
diff --git a/scripts/review.sh b/scripts/review.sh
index 74ef3f1..9916899 100644
--- a/scripts/review.sh
+++ b/scripts/review.sh
@@ -176,11 +176,14 @@ set -e
 
 META=$(cat "$OUT/merge-meta.json")
 if [[ -n "${GITHUB_OUTPUT:-}" ]]; then
-  python3 -c 'import json,os,sys
-m=json.loads(sys.argv[1])
-open(os.environ["GITHUB_OUTPUT"],"a").write(
-  f"risk_tier={m[\"risk_tier\"]}\nsecurity_blocking={str(m[\"security_blocking\"]).lower()}\nagreed_count={m[\"agreed_count\"]}\n"
-)' "$META"
+  python3 - "$META" <<'PY'
+import json, os, sys
+m = json.loads(sys.argv[1])
+with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as fh:
+    fh.write(f"risk_tier={m['risk_tier']}\n")
+    fh.write(f"security_blocking={str(m['security_blocking']).lower()}\n")
+    fh.write(f"agreed_count={m['agreed_count']}\n")
+PY
 fi
 
 exit "$pub_ec"
-- 
2.47.3