fix(ci): use HTTPS+token instead of SSH for cargo's git-dependency fetches #5

Merged

peterswimm merged 1 commit from fix/ci-https-instead-of-ssh into main

2026-07-17 14:50:05 +00:00

peterswimm commented

2026-07-17 14:27:10 +00:00

Owner

Follow-up to #4. The read-only deploy key didn't actually fix the linux runner — the real issue is deeper: this runner's container can't reach git.toilville.dev:2222 over SSH at all. It resolves to 127.0.0.1 and the connection is refused (checked via the real Forgejo action logs). That's a runner/image networking quirk, not an auth problem.

HTTPS to git.toilville.dev works fine in the same job — actions/checkout already authenticates over HTTPS successfully. So instead of continuing to chase the SSH path, this rewrites cargo's git-dependency SSH URLs to HTTPS+token via git config --global url."...".insteadOf, reusing a proven-working transport instead of two independently fragile ones.

FORGE_CI_HTTPS_TOKEN: a read-only access token scoped to Toilville/mlx-rs-mirror, stored as a secret on this repo.

Follow-up to #4. The read-only deploy key didn't actually fix the linux runner — the real issue is deeper: this runner's container can't reach `git.toilville.dev:2222` over SSH at all. It resolves to `127.0.0.1` and the connection is refused (checked via the real Forgejo action logs). That's a runner/image networking quirk, not an auth problem. HTTPS to `git.toilville.dev` works fine in the same job — `actions/checkout` already authenticates over HTTPS successfully. So instead of continuing to chase the SSH path, this rewrites cargo's git-dependency SSH URLs to HTTPS+token via `git config --global url."...".insteadOf`, reusing a proven-working transport instead of two independently fragile ones. `FORGE_CI_HTTPS_TOKEN`: a read-only access token scoped to `Toilville/mlx-rs-mirror`, stored as a secret on this repo.

peterswimm added 1 commit

2026-07-17 14:27:11 +00:00

fix(ci): use HTTPS+token instead of SSH for cargo's git-dependency fetches

CI / MLX feature (macOS + Apple Silicon) (pull_request) Failing after 3s

Details

CI / lint-workflows (pull_request) Successful in 26s

Details

CI / Core (default features, no MLX) (pull_request) Successful in 2m3s

Details

983f7cb51d

The linux runner's container can't reach git.toilville.dev:2222 over
SSH at all (confirmed via the real action logs: it resolves to
127.0.0.1 and the connection is refused — a runner/image networking
quirk, not an auth problem; the read-only deploy key from #4 didn't
help since the connection never gets far enough to authenticate).

HTTPS to git.toilville.dev works fine in the same job (actions/checkout
uses it successfully already), so rewrite cargo's SSH git-dependency
URLs to HTTPS+token via git's insteadOf instead of continuing to fight
the SSH path. FORGE_CI_HTTPS_TOKEN is a read-only access token scoped
to Toilville/mlx-rs-mirror.

FORGE_CI_DEPLOY_KEY (added in #4) is now unused by this workflow but
left in place / registered in case SSH access is useful again later.

peterswimm merged commit d9ff88b1f8 into main

2026-07-17 14:50:05 +00:00

peterswimm deleted branch fix/ci-https-instead-of-ssh

2026-07-17 14:50:05 +00:00

peterswimm referenced this pull request from a commit

2026-07-17 14:50:05 +00:00

Merge pull request 'fix(ci): use HTTPS+token instead of SSH for cargo's git-dependency fetches' (#5) from fix/ci-https-instead-of-ssh into main