ci: switch SDK to git dep, inject MODULE_SDK_PAT via insteadOf

Two prior approaches failed:

1. Sibling-clone of module-sdk into a directory two levels up
   from $GITHUB_WORKSPACE failed with a 2-second runner failure
   (bisect confirmed: workflow with ONLY the own-repo checkout
   succeeded; adding the sibling-clone step reproduced the
   failure).

2. Anonymous clone of the now-public module-sdk also failed —
   the Forgejo instance has REQUIRE_SIGNIN_VIEW=true, so making
   a repo public does not enable anonymous read.

The working approach: switch fai-module-sdk to a git dependency
in Cargo.toml and inject a stored Forgejo PAT into any outgoing
git.flemming.ws URL via 'git config url.X.insteadOf Y'. Cargo's
git fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI=true) then
authenticates transparently.

The Forgejo Actions secret MODULE_SDK_PAT carries the read token.
Locally, the same insteadOf trick works via GIT_CONFIG_COUNT
without polluting the global git config.

Bumps text-extract 0.1.4 -> 0.1.5.

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/ci.yml

@@ -8,12 +8,17 @@ on:
 
 env:
   CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
 
 jobs:
   ci:
     name: Linux x86_64 (Forgejo)
     runs-on: ubuntu-latest
     steps:
+      # Manual external-URL checkout — see fai/platform CI for
+      # background. Lays this repo at $GITHUB_WORKSPACE.
       - name: Checkout text-extract via external URL
         run: |
           set -eu
@@ -24,18 +29,57 @@ jobs:
             "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
           git fetch --depth=1 origin "$GITHUB_SHA"
           git checkout -q FETCH_HEAD
-          echo "checkout: ok, ls = $(ls)"
 
-      - name: Checkout fai/module-sdk into sibling layout
+      # The fai-module-sdk dependency is a git dep against a repo
+      # that lives in another Forgejo org. The repo-scoped
+      # GITHUB_TOKEN cannot read it, and the Forgejo instance has
+      # REQUIRE_SIGNIN_VIEW=true so anonymous read is also denied.
+      # MODULE_SDK_PAT is a stored secret with read access to
+      # fai/module-sdk; we inject it into any outgoing
+      # https://git.flemming.ws/ URL via insteadOf so cargo's git
+      # fetch (driven by CARGO_NET_GIT_FETCH_WITH_CLI) authenticates
+      # transparently.
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
         run: |
-          set -eu
+          git config --global \
-          parent="$(dirname "$GITHUB_WORKSPACE")"
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
-          grandparent="$(dirname "$parent")"
+            "https://git.flemming.ws/"
-          sdk_dir="$grandparent/module_sdk"
+
-          mkdir -p "$sdk_dir"
+      - name: Install system dependencies
-          cd "$sdk_dir"
+        run: |
-          git init -q
+          apt-get update -qq
-          git remote add origin "https://git.flemming.ws/fai/module-sdk.git"
+          apt-get install -y --no-install-recommends \
-          git fetch --depth=1 origin main
+            curl \
-          git checkout -q FETCH_HEAD
+            ca-certificates \
-          echo "module-sdk: ok, ls = $(ls)"
+            build-essential \
+            pkg-config \
+            libssl-dev \
+            git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y \
+              --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 \
+              --component rustfmt \
+              --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2

Cargo.lock

@@ -170,6 +170,7 @@ dependencies = [
 [[package]]
 name = "fai-module-sdk"
 version = "0.1.2"
+source = "git+https://git.flemming.ws/fai/module-sdk.git?branch=main#f209fbc86f531b53e576f3cdbdf75750eef3b07a"
 dependencies = [
  "fai-module-sdk-macros",
  "serde",
@@ -181,6 +182,7 @@ dependencies = [
 [[package]]
 name = "fai-module-sdk-macros"
 version = "0.1.2"
+source = "git+https://git.flemming.ws/fai/module-sdk.git?branch=main#f209fbc86f531b53e576f3cdbdf75750eef3b07a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -504,7 +506,7 @@ dependencies = [
 
 [[package]]
 name = "text_extract"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "fai-module-sdk",
  "pdf-extract",

Cargo.toml

@@ -5,7 +5,7 @@
 
 [package]
 name = "text_extract"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2024"
 authors = ["Dr. Stefan Flemming <platform@flemming.ai>"]
 license = "Apache-2.0"
@@ -18,7 +18,7 @@ rust-version = "1.85"
 crate-type = ["cdylib", "rlib"]
 
 [dependencies]
-fai-module-sdk = { path = "../../module_sdk/crates/fai-module-sdk" }
+fai-module-sdk = { git = "https://git.flemming.ws/fai/module-sdk.git", branch = "main" }
 serde = { version = "1", features = ["derive"] }
 pdf-extract = "0.7"
 zip = { version = "2", default-features = false, features = ["deflate"] }