Check out with git rather than actions/checkout

actions/checkout is a JavaScript action, so a host-mode runner needs node
on its PATH to run it and fails with "Cannot find: node in PATH" without
one. Every step is plain shell now, which needs nothing of the runner
beyond git, python3, rsync and curl.

The clone is shallow and takes its URL from the live checkout's remote, so
there is no URL or token in the workflow. It works because the runner
already has to run as the user that owns that checkout.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.gitea/workflows/deploy.yml

@@ -7,6 +7,11 @@
 # deploy/heos-panel.service for the unit and the one sudoers line the
 # restart needs.
 #
+# Every step here is plain shell, on purpose. actions/checkout is a
+# JavaScript action, and a host-mode runner can only run those if node is
+# on its PATH -- swapping the clone below back to `uses: actions/checkout`
+# brings back "Cannot find: node in PATH" on a runner without it.
+#
 # DEPLOY_PATH is also where you edit: an rsync --delete lands on top of
 # whatever is sitting there uncommitted, so commit before you push.
 
@@ -26,13 +31,12 @@ jobs:
       DEPLOY_PATH: /var/www/html/heos
       SERVICE: heos-panel
       PANEL_URL: http://127.0.0.1:5005/      # WEB_PORT in config.py
+      SRC: src                               # the clone, inside the workspace
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
       - name: Check runner tools
         run: |
+          command -v git
           command -v python3
           command -v rsync
           command -v curl
@@ -45,10 +49,24 @@ jobs:
       - name: Check the restart is allowed without a password
         run: sudo -n systemctl is-active "$SERVICE" || true
 
+      # A shallow clone of the pushed branch, taking the remote from the
+      # live checkout so there is no URL or token written down here. It
+      # works because the runner runs as the user that owns that checkout,
+      # which is the same reason it can write to DEPLOY_PATH at all.
+      - name: Checkout
+        run: |
+          rm -rf "$SRC"
+          git init --quiet "$SRC"
+          git -C "$SRC" remote add origin "$(git -C "$DEPLOY_PATH" remote get-url origin)"
+          git -C "$SRC" fetch --quiet --depth 1 origin "${GITHUB_REF_NAME:-main}"
+          git -C "$SRC" checkout --quiet FETCH_HEAD
+          git -C "$SRC" --no-pager log -1 --oneline
+
       # A throwaway virtualenv in the workspace: the one under
       # $DEPLOY_PATH/.venv is what the running panel imports from, and a
       # test run has no business touching it.
       - name: Install dependencies
+        working-directory: src
         run: |
           python3 -m venv .venv-ci
           .venv-ci/bin/pip install --quiet --upgrade pip
@@ -57,9 +75,11 @@ jobs:
       # Runs against the fake HEOS and AVR servers in tests/fakes.py, so it
       # needs no speakers and touches nothing on the network.
       - name: Run tests
+        working-directory: src
         run: .venv-ci/bin/python -m unittest discover -s tests -t . --verbose
 
       - name: Deploy to production
+        working-directory: src
         run: |
           rsync -azc --no-times --delete \
             --exclude "/.git/" \