Gitea's per-job token is scoped to the calling repo, so cross-repo
private submodules (micromelon-kicadlibs, micromelon_3d) fail with
'Repository not found'. Callers now pass SUBMODULE_TOKEN, a PAT scoped
to read:repository, through to actions/checkout.
The previous reusable used container: jobs, which cannot work on this
runner — the kicad_auto images have no Node, so actions/checkout's post
step dies with exit 127. It had never run successfully. This replaces it
with the docker-run design that keeb debugged into working, plus the
kicad10_auto bump and the artifact-path and @v3 pinning fixes.
When github.event.head_commit.message contains shell metacharacters
(backticks, $(…), etc.) the literal-interpolation form spliced the
raw text into bash and triggered command substitution. Caught by the
keeb pipeline on Gitea — a commit message with backticks crashed
extract_version in 3 seconds and the whole fab graph cascade-skipped.
Pattern matches the upload-bom env: COMMIT_MESSAGE indirection used
further down the same file. Also routed github.sha the same way so
the fallback branch doesn't accidentally re-introduce the same class
of bug.
Mirror this verbatim into hfsdesign/kicad-ci on Gitea after pushing.
Reusable workflow at .gitea/workflows/kibot.yml — mirrors the
GitLab-side jobs (preflight, fabrication, astable_dev/main).
Same scripts, same Astable upload contract.
GitLab CI reads /kibot-ci.yml; Gitea Actions reads
/.gitea/workflows/kibot.yml. They don't trip over each other,
so projects on either platform submodule the same kicad-ci repo
and pick up the appropriate orchestrator.
Per-project caller snippet documented in
.gitea/workflows/README.md.
timmyhadwen
Tim Hadwen