self-clone grade

.forgejo/workflows/grade.yml

@@ -3,21 +3,21 @@ on: [push]
 
 # Production wiring (forgejo-runner on ghost):
 #   - the job container IS the grade image (grade-c:dev on the host daemon),
-#     so the harness runs directly — no nested docker
+#     so the harness runs directly — no nested docker, no node-dependent actions
+#   - the workflow clones the repo itself with Forgejo's built-in token
+#     (GITHUB_TOKEN / FORGEJO_TOKEN) — the automatic token has read access
 #   - runner.yaml mounts /opt/grade-hidden + /opt/grade/grade.env into every
 #     job container (host paths, never in this repo)
-#   - checkout uses Forgejo's native action (data.forgejo.org) for
-#     forgejo-runner v13
 jobs:
   grade:
     runs-on: docker
     container:
       image: grade-c:dev
     steps:
-      - uses: https://data.forgejo.org/actions/checkout@v6
       - name: Grade (blank fails, solved passes)
         run: |
-          cd "$GITHUB_WORKSPACE"
+          rm -rf /tmp/work && mkdir -p /tmp/work && cd /tmp/work
+          git clone -q --depth 1 "https://x:${GITHUB_TOKEN:-$FORGEJO_TOKEN}@git.trevon.dev/${GITHUB_REPOSITORY}.git" .
           set -a; . /run/secrets/grade.env; set +a
           python3 /opt/grade/grade_cli.py run \
             --student . --hidden /opt/grade-hidden/cs2060/record-manager \