From e797da7c8971383a1cb7bbf14c05f5c815568dc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Iwo=20Strzebo=C5=84ski?= <iwo@octoturge.com>
Date: Thu, 29 Oct 2026 11:03:26 +0000
Subject: [PATCH] Clone the sibling repos with git, not a second
 actions/checkout

Run 413: a second use of actions/checkout in one job fails on this Windows
runner syncing the action's cached clone (pack .idx: Access is denied).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitea/workflows/discover-windows.yml | 35 ++++++++++++++++++---------
 1 file changed, 23 insertions(+), 12 deletions(-)

diff --git a/.gitea/workflows/discover-windows.yml b/.gitea/workflows/discover-windows.yml
index fddb32f..f5854eb 100644
--- a/.gitea/workflows/discover-windows.yml
+++ b/.gitea/workflows/discover-windows.yml
@@ -50,21 +50,32 @@ jobs:
       # (`../continuum-schemas`, `../continuum-common`), so all three are laid
       # out side by side inside the workspace - the checkout action will not
       # place a repo outside it, which is why the proxy is in a subdirectory
-      # rather than at the root. The siblings are taken from the same branch
-      # name as this one: the proxy's code needs their unreleased commits.
+      # rather than at the root.
       - uses: actions/checkout@v4
         with:
           path: continuum-proxy
-      - uses: actions/checkout@v4
-        with:
-          repository: Continuum/continuum-schemas
-          ref: ${{ github.ref_name }}
-          path: continuum-schemas
-      - uses: actions/checkout@v4
-        with:
-          repository: Continuum/continuum-common
-          ref: ${{ github.ref_name }}
-          path: continuum-common
+
+      # Plain git for the siblings, not a second `actions/checkout`: on this
+      # Windows runner a second use of the action in one job fails syncing the
+      # action's own cached clone ("...\.git\objects\pack\...idx: Access is
+      # denied", run 413). Same branch name as this one, because the proxy's
+      # code needs their unreleased commits. The job's token goes in a header
+      # for the clone and is never written to a remote URL or a log.
+      - name: Check out the sibling repositories
+        shell: powershell
+        working-directory: .
+        env:
+          CI_TOKEN: ${{ github.token }}
+          CI_SERVER: ${{ github.server_url }}
+          CI_BRANCH: ${{ github.ref_name }}
+        run: |
+          $auth = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("x-access-token:$($env:CI_TOKEN)"))
+          foreach ($repo in @("continuum-schemas", "continuum-common")) {
+            if (Test-Path $repo) { Remove-Item -Recurse -Force $repo }
+            git -c "http.extraheader=AUTHORIZATION: basic $auth" clone --quiet --depth 1 --branch $env:CI_BRANCH "$($env:CI_SERVER)/Continuum/$repo.git" $repo
+            if ($LASTEXITCODE -ne 0) { throw "could not clone $repo at branch $($env:CI_BRANCH)" }
+            Write-Host "$repo at $(git -C $repo rev-parse --short HEAD)"
+          }
 
       - name: Install the Rust MSVC toolchain
         shell: powershell