From c4656ac244eb15392012351175bf07649587faa4 Mon Sep 17 00:00:00 2001
From: Sami <sami@cryptographic-triangles.org>
Date: Tue, 28 Apr 2026 23:56:51 -0700
Subject: [PATCH] =?UTF-8?q?fix:=20gate=20auto-merge=20=E2=80=94=20use=20gi?=
 =?UTF-8?q?t=20push=20instead=20of=20PATCH=20/branches/master?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Gitea PATCH /repos/{owner}/{repo}/branches/{branch} is for renaming branches, not for moving refs; it always returned failure even when master had not diverged. Replace with a plain git push (token in extra header) which fast-forwards iff the update is FF-clean — same safety, correct mechanism.
---
 .gitea/workflows/krystie-gate.yml | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/.gitea/workflows/krystie-gate.yml b/.gitea/workflows/krystie-gate.yml
index d935ea5..ff0d248 100644
--- a/.gitea/workflows/krystie-gate.yml
+++ b/.gitea/workflows/krystie-gate.yml
@@ -114,21 +114,19 @@ jobs:
           SHA: ${{ github.sha }}
         run: |
           set -euo pipefail
-          # Refuse to merge if it's not actually a Krystie-signed commit.
-          # (Static-gate already verified, but defense in depth.)
+          # The wip branch is master + N Krystie commits. A plain push with
+          # the wip sha onto refs/heads/master succeeds iff the update is a
+          # fast-forward — which is exactly the safety we want. (Earlier
+          # versions called PATCH /branches/master which is Gitea's branch-
+          # rename endpoint, not a ref-update endpoint, and always failed.)
           REPO="${GITHUB_REPOSITORY}"  # owner/name
-          GITEA_URL="http://localhost:3030"
-          # Fast-forward via Gitea API: update master ref to the wip-branch sha.
-          curl -fsS -X PATCH \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"sha\":\"${SHA}\",\"force\":false}" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/branches/master" \
+          GIT_URL="http://localhost:3030/${REPO}.git"
+          git -c "http.extraHeader=Authorization: token ${GITEA_TOKEN}" \
+              push "${GIT_URL}" "${SHA}:refs/heads/master" \
             && echo "Master fast-forwarded to ${SHA:0:12}" \
-            || (echo "::error::Fast-forward failed — master has likely diverged" && exit 1)
-          # Delete the wip-branch (cleanup)
-          curl -fsS -X DELETE \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            "${GITEA_URL}/api/v1/repos/${REPO}/branches/${BRANCH}" \
+            || (echo "::error::Fast-forward push refused — master has likely diverged" && exit 1)
+          # Clean up the wip branch via the same push channel (delete = empty source).
+          git -c "http.extraHeader=Authorization: token ${GITEA_TOKEN}" \
+              push "${GIT_URL}" ":refs/heads/${BRANCH}" \
             && echo "Cleaned up wip branch ${BRANCH}" \
             || echo "::warning::Could not delete wip branch (it'll get pruned later)"