ci: drop macOS, skip ASan, checkout without GitHub, MinGW zip

- Replace actions/checkout (pulls from github.com) with scripts/ci_checkout.sh
  fetched from this Gitea over raw/commit.
- Remove the macOS job (no runner).
- Disable sanitizers until the Docker runner has SYS_PTRACE; it was wedging
  the only slot with AddressSanitizer:DEADLYSIGNAL.
- Add windows-cross: Nix UCRT mingw via TUNA, bootstrap_windows.sh, verify
  dist/cst-agent-*-windows-x86_64.zip. Third-party git clones go through
  gitclone.com.

.gitea/workflows/ci.yml

@@ -4,8 +4,6 @@ on:
   push:
   pull_request:
 
-# One runner: cancel the previous push's jobs (avoids a stuck ASan job
-# blocking every later commit).
 concurrency:
   group: ci-${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
@@ -19,7 +17,15 @@ jobs:
       matrix:
         cc: [gcc, clang]
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
+            -o /tmp/ci_checkout.sh
+          bash /tmp/ci_checkout.sh
       - name: Install dependencies
         run: |
           SUDO=$(command -v sudo || true)
@@ -43,11 +49,23 @@ jobs:
           ./cst-agent --workspace "$PWD" --list-sessions
           ./cst-agent --demo-ctl --workspace .
 
+  # Disabled: Docker runner lacks SYS_PTRACE; ASan spins on DEADLYSIGNAL and
+  # wedged the only runner. Re-enable after the runner gets --cap-add SYS_PTRACE
+  # (or seccomp=unconfined).
   sanitizers:
+    if: false
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
+            -o /tmp/ci_checkout.sh
+          bash /tmp/ci_checkout.sh
       - name: Install dependencies
         run: |
           SUDO=$(command -v sudo || true)
@@ -58,45 +76,83 @@ jobs:
       - name: ASan + UBSan
         timeout-minutes: 10
         env:
-          # Docker runners without SYS_PTRACE can spin forever on
-          # AddressSanitizer:DEADLYSIGNAL; keep the handler shallow and
-          # hard-cap wall time so the single runner is not wedged.
           ASAN_OPTIONS: abort_on_error=1:halt_on_error=1:detect_leaks=0:use_sigaltstack=0
           UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
-        run: |
+        run: timeout -s KILL 480 make asan
-          if ! timeout -s KILL 480 make asan; then
-            echo "::error::make asan failed or timed out after 8m (if the log is only DEADLYSIGNAL, give the runner SYS_PTRACE / seccomp=unconfined)"
-            exit 1
-          fi
 
   musl:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     container: alpine:3.20
     steps:
-      - name: Install dependencies
+      - name: Install tools + mirror
         run: |
-          # Container has no checkout yet; rewrite apk repos in place.
           sed -i 's#https\?://dl-cdn.alpinelinux.org/alpine#https://mirrors.tuna.tsinghua.edu.cn/alpine#g' \
             /etc/apk/repositories
-          apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
+          apk add --no-cache curl git bash
-      - uses: actions/checkout@v4
+      - name: Checkout
+        env:
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_SHA: ${{ github.sha }}
+        run: |
+          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
+            -o /tmp/ci_checkout.sh
+          bash /tmp/ci_checkout.sh
+      - name: Install build dependencies
+        run: apk add --no-cache build-base pkgconf curl-dev ncurses-dev git nodejs bash python3
       - name: Build + unit tests
         run: |
           make CFLAGS="-std=c11 -Wall -Wextra -O2 -Werror" -j"$(nproc)"
           make check
 
-  # Gitea instances rarely have macOS runners; set the repository variable
+  # MinGW-w64 UCRT cross build → dist/cst-agent-*-windows-x86_64.zip
-  # HAVE_MACOS_RUNNER=true once one is registered.
+  windows-cross:
-  macos:
+    runs-on: ubuntu-latest
-    if: ${{ vars.HAVE_MACOS_RUNNER == 'true' }}
+    timeout-minutes: 120
-    runs-on: macos-latest
-    timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
-      - name: Install dependencies
+        env:
-        run: brew install ncurses curl pkg-config
+          GITHUB_SERVER_URL: ${{ github.server_url }}
-      - name: Build + unit tests
+          GITHUB_REPOSITORY: ${{ github.repository }}
+          GITHUB_SHA: ${{ github.sha }}
         run: |
-          make -j"$(sysctl -n hw.ncpu)"
+          curl -fsSL "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/raw/commit/$GITHUB_SHA/scripts/ci_checkout.sh" \
-          make check
+            -o /tmp/ci_checkout.sh
+          bash /tmp/ci_checkout.sh
+      - name: Install host tools
+        run: |
+          SUDO=$(command -v sudo || true)
+          $SUDO bash scripts/ci_pkg_mirror.sh
+          $SUDO apt-get update
+          $SUDO apt-get install -y --no-install-recommends \
+            ca-certificates curl git cmake ninja-build make pkg-config \
+            python3 zip perl xz-utils
+      - name: Install Nix (TUNA)
+        run: |
+          if ! command -v nix-shell >/dev/null; then
+            curl -L https://mirrors.tuna.tsinghua.edu.cn/nix/latest/install | sh -s -- --no-daemon
+          fi
+          mkdir -p "$HOME/.config/nix"
+          printf '%s\n' \
+            'substituters = https://mirrors.tuna.tsinghua.edu.cn/nix-channels/store https://cache.nixos.org/' \
+            'trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=' \
+            > "$HOME/.config/nix/nix.conf"
+          # shellcheck source=/dev/null
+          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          nix --version
+      - name: Proxy GitHub for third_party clones
+        run: |
+          # curl/busybox-w32/ncurses sources; skip if the proxy is down
+          git config --global url."https://gitclone.com/github.com/".insteadOf "https://github.com/"
+      - name: Cross-build Windows zip
+        run: |
+          # shellcheck source=/dev/null
+          . "$HOME/.nix-profile/etc/profile.d/nix.sh"
+          nix-shell shell-win.nix --run 'scripts/bootstrap_windows.sh .'
+      - name: Verify zip
+        run: |
+          ls -lah dist/windows-x86_64/
+          ls -lah dist/cst-agent-*-windows-x86_64.zip
+          cat dist/cst-agent-*-windows-x86_64.zip.sha256
+          unzip -l dist/cst-agent-*-windows-x86_64.zip | head -20

scripts/ci_checkout.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+# Checkout this repo without downloading actions/checkout from GitHub.
+# act_runner may already have placed sources in the workspace; otherwise
+# clone from the same Gitea that started the job.
+set -euo pipefail
+
+SERVER="${GITHUB_SERVER_URL:-${GITEA_SERVER_URL:-}}"
+REPO="${GITHUB_REPOSITORY:-${GITEA_REPOSITORY:-}}"
+SHA="${GITHUB_SHA:-${GITEA_SHA:-}}"
+
+if [[ -f CMakeLists.txt && -d src ]]; then
+  echo "==> workspace already has sources"
+  git rev-parse --short HEAD 2>/dev/null || true
+  exit 0
+fi
+
+if [[ -z "$SERVER" || -z "$REPO" ]]; then
+  echo "missing GITHUB_SERVER_URL / GITHUB_REPOSITORY" >&2
+  exit 1
+fi
+
+echo "==> git clone $SERVER/$REPO"
+git clone --filter=blob:none "$SERVER/$REPO.git" _ci_src
+if [[ -n "$SHA" ]]; then
+  git -C _ci_src fetch --depth 1 origin "$SHA" || git -C _ci_src fetch origin "$SHA"
+  git -C _ci_src checkout --force "$SHA"
+fi
+# Move into the workspace root (may already contain act_runner metadata).
+shopt -s dotglob nullglob
+mv _ci_src/* .
+rmdir _ci_src 2>/dev/null || rm -rf _ci_src
+test -f CMakeLists.txt
+git rev-parse --short HEAD