fix(ci): test triggering ref on PRs, unify token secret, harden JSON parsing

- ci.yml: check out the PR head (or push SHA) instead of always cloning
  main; PR checks now test the actual diff. Drop http.sslVerify=false.
  Publish to the package registry only on push events.
- preview.yml/release.yml: use GITEATOKEN (GITEA_TOKEN is reserved by
  Gitea, so these token steps were silently broken).
- deploy-chrome.yml/release.yml: parse JSON with node instead of
  python3 (not installed in the container) and grep; fail loudly
  instead of swallowing errors with 2>/dev/null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -17,13 +17,19 @@ jobs:
       - name: Install system deps
         run: apt-get update -qq && apt-get install -y zip curl git ca-certificates -qq
 
-      - name: Clone repository
+      - name: Clone repository (triggering ref)
         run: |
-          git config --global http.sslVerify false
-          git clone --depth 1 --branch main ${{ gitea.server_url }}/${{ gitea.repository }}.git /tmp/lexai
+          git clone ${{ gitea.server_url }}/${{ gitea.repository }}.git /tmp/lexai
+          cd /tmp/lexai
+          if [ "${{ gitea.event_name }}" = "pull_request" ]; then
+            git fetch origin pull/${{ gitea.event.pull_request.number }}/head:pr
+            git checkout pr
+          else
+            git checkout ${{ gitea.sha }}
+          fi
 
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --prefer-offline --no-audit --no-fund
         working-directory: /tmp/lexai
 
       - name: Type check
@@ -53,6 +59,7 @@ jobs:
         working-directory: /tmp/lexai
 
       - name: Publish to Gitea Package Registry
+        if: gitea.event_name == 'push'
         run: |
           RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT \
             "${{ gitea.server_url }}/api/packages/kibin/generic/lexai-extension/${PACKAGE_VERSION}/lexai-chrome-mv3-${PACKAGE_VERSION}.zip" \

.gitea/workflows/deploy-chrome.yml

@@ -41,7 +41,7 @@ jobs:
           VERSION=${{ gitea.ref_name || 'manual' }}
           ZIPFILE="$(pwd)/lexai-chrome-mv3-${VERSION}.zip"
           # Verify manifest exists and check version
-          cat .output/chrome-mv3/manifest.json | python3 -c "import json,sys; m=json.load(sys.stdin); print('Manifest version:', m['version'])"
+          node -e "console.log('Manifest version:', require('./.output/chrome-mv3/manifest.json').version)"
           # Zip from inside the chrome-mv3 dir so manifest.json is at root
           cd .output/chrome-mv3 && zip -r "$ZIPFILE" . && cd -
           echo "ZIP_FILE=${ZIPFILE}" >> $GITHUB_ENV
@@ -56,7 +56,7 @@ jobs:
             -d "client_secret=${{ secrets.CWS_CLIENT_SECRET }}" \
             -d "refresh_token=${{ secrets.CWS_REFRESH_TOKEN }}" \
             -d "grant_type=refresh_token")
-          ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['access_token'])" 2>/dev/null)
+          ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | node -e "let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{let d;try{d=JSON.parse(s)}catch(e){console.error('Invalid JSON token response:',s);process.exit(1)};if(!d.access_token){console.error('No access_token in response:',s);process.exit(1)};console.log(d.access_token)})")
           if [ -z "$ACCESS_TOKEN" ]; then
             echo "❌ Failed to get access token. Response: $TOKEN_RESPONSE"
             exit 1
@@ -72,7 +72,7 @@ jobs:
             -H "x-goog-api-version: 2" \
             -T "${{ env.ZIP_FILE }}")
           echo "Upload Response: $UPLOAD_BODY"
-          UPLOAD_STATE=$(echo "$UPLOAD_BODY" | python3 -c "import json,sys; d=json.load(sys.stdin); print(d.get('uploadState',''))" 2>/dev/null)
+          UPLOAD_STATE=$(echo "$UPLOAD_BODY" | node -e "let s='';process.stdin.on('data',d=>s+=d);process.stdin.on('end',()=>{let d;try{d=JSON.parse(s)}catch(e){console.error('Invalid JSON upload response:',s);process.exit(1)};console.log(d.uploadState||'')})")
           echo "Upload state: $UPLOAD_STATE"
           if [ "$UPLOAD_STATE" != "SUCCESS" ]; then
             echo "❌ Upload failed — state: $UPLOAD_STATE"

.gitea/workflows/preview.yml

@@ -43,6 +43,6 @@ jobs:
         run: |
           PR_NUM=${{ gitea.event.pull_request.number }}
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/issues/${PR_NUM}/comments" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -H "Content-Type: application/json" \
             -d "{\"body\": \"## ⚡ LexAI Preview Build Ready\n\n✅ Tests passed\n✅ Build successful\n✅ TypeScript clean\n\nCommit: \`${{ gitea.sha }}\`\"}"

.gitea/workflows/release.yml

@@ -40,7 +40,7 @@ jobs:
         run: |
           VERSION=${{ gitea.ref_name }}
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -H "Content-Type: application/json" \
             -d "{
               \"tag_name\": \"${VERSION}\",
@@ -50,14 +50,15 @@ jobs:
               \"prerelease\": false
             }" > release.json
           cat release.json
-          echo "RELEASE_ID=$(cat release.json | grep -o '\"id\":[0-9]*' | head -1 | cut -d: -f2)" >> $GITHUB_ENV
+          RELEASE_ID=$(node -e "const r=require('./release.json'); if(!r.id) { console.error('No release id in response:', JSON.stringify(r)); process.exit(1); } console.log(r.id)")
+          echo "RELEASE_ID=${RELEASE_ID}" >> $GITHUB_ENV
 
       - name: Upload ZIP to Release
         run: |
           VERSION=${{ gitea.ref_name }}
           RELEASE_ID=${{ env.RELEASE_ID }}
           curl -s -X POST "${{ gitea.server_url }}/api/v1/repos/${{ gitea.repository }}/releases/${RELEASE_ID}/assets" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -F "attachment=@lexai-chrome-mv3-${VERSION}.zip"
           echo "✅ Release ${VERSION} published!"
 
@@ -65,7 +66,7 @@ jobs:
         run: |
           VERSION=${{ gitea.ref_name }}
           curl -s -X PUT "https://git.juankibin.space/api/packages/kibin/generic/lexai-extension/${VERSION}/lexai-chrome-mv3-${VERSION}.zip" \
-            -H "Authorization: token ${{ secrets.GITEA_TOKEN }}" \
+            -H "Authorization: token ${{ secrets.GITEATOKEN }}" \
             -T lexai-chrome-mv3-${VERSION}.zip
           echo "✅ Published lexai-chrome-mv3-${VERSION}.zip to package registry"
           echo "📦 Download: https://git.juankibin.space/kibin/LexAI/packages"