fix(ci): checkout PR SHA via bare-repo worktree

Co-authored-by: Cursor <[email protected]>

.gitea/workflows/ci.yaml

@@ -11,23 +11,26 @@ jobs:
       - name: Typecheck, lint, and test
         run: |
           set -e
-          WORK="$(mktemp -d /var/tmp/epicnext-ci.XXXXXX)"
-          cleanup() { rm -rf "${WORK}"; }
-          trap cleanup EXIT
-
-          echo "--- CI checks (${WORK}) ---"
-          git clone --depth 50 \
-            /docker/gitea/gitea/git/repositories/remco/epicnext-cms.git \
-            "${WORK}"
-          cd "${WORK}"
+          exec 2>&1
 
+          BARE="/docker/gitea/gitea/git/repositories/remco/epicnext-cms.git"
           REF="${{ gitea.sha }}"
           if [ -z "${REF}" ]; then
             echo "ERROR: missing gitea.sha" >&2
             exit 1
           fi
-          git fetch --depth 50 origin "${REF}"
-          git checkout -f "${REF}"
+
+          WORK="$(mktemp -d /var/tmp/epicnext-ci.XXXXXX)"
+          cleanup() {
+            git -C "${BARE}" worktree remove --force "${WORK}" 2>/dev/null || rm -rf "${WORK}" || true
+          }
+          trap cleanup EXIT
+
+          echo "--- CI checks (${WORK} @ ${REF}) ---"
+          git config --global --add safe.directory "${BARE}"
+          git -C "${BARE}" worktree remove --force "${WORK}" 2>/dev/null || rm -rf "${WORK}" || true
+          git -C "${BARE}" worktree add --detach "${WORK}" "${REF}"
+          cd "${WORK}"
 
           export SKIP_ENV_VALIDATION=1
           export ARGON2_MEMORY_SIZE=1024