ci: install torch separately to avoid --index-url replacing PyPI

Strip ipa.kindred.internal CA trust steps. Replace Node-dependent
actions with raw git commands for act runner compatibility.

.gitea/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, public]
   pull_request:
-    branches: [main]
+    branches: [main, public]
   workflow_dispatch:
     inputs:
       run_datagen:
@@ -37,14 +37,14 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
-        uses: https://github.com/actions/checkout@v4
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
+            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git checkout "$GITHUB_SHA" 2>/dev/null || true
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
@@ -66,24 +66,23 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
-        uses: https://github.com/actions/checkout@v4
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
+            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git checkout "$GITHUB_SHA" 2>/dev/null || true
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
 
       - name: Install dependencies
         run: |
-          pip install --cache-dir $PIP_CACHE_DIR \
+          pip install --cache-dir $PIP_CACHE_DIR torch --index-url $TORCH_INDEX
-            mypy numpy scipy \
-            torch --index-url $TORCH_INDEX
           pip install --cache-dir $PIP_CACHE_DIR torch-geometric
+          pip install --cache-dir $PIP_CACHE_DIR mypy numpy scipy
           pip install --cache-dir $PIP_CACHE_DIR -e ".[dev]"
 
       - name: Mypy
@@ -97,22 +96,21 @@ jobs:
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
-        uses: https://github.com/actions/checkout@v4
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
+            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git checkout "$GITHUB_SHA" 2>/dev/null || true
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
 
       - name: Install dependencies
         run: |
-          pip install --cache-dir $PIP_CACHE_DIR \
+          pip install --cache-dir $PIP_CACHE_DIR torch --index-url $TORCH_INDEX
-            torch --index-url $TORCH_INDEX
           pip install --cache-dir $PIP_CACHE_DIR torch-geometric
           pip install --cache-dir $PIP_CACHE_DIR -e ".[train,dev]"
 
@@ -120,45 +118,35 @@ jobs:
         run: pytest tests/ freecad/tests/ -v --tb=short
 
   # ---------------------------------------------------------------------------
-  # Dataset generation — manual trigger or on main push
+  # Dataset generation — manual trigger or on main/public push
   # ---------------------------------------------------------------------------
   datagen:
     runs-on: ubuntu-latest
     if: >-
       (github.event_name == 'workflow_dispatch' && inputs.run_datagen == true) ||
-      (github.event_name == 'push' && github.ref == 'refs/heads/main')
+      (github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/public'))
     needs: [test]
     env:
       PATH: /tmp/solver-venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
     steps:
-      - name: Trust internal CA
-        run: |
-          curl -sk https://ipa.kindred.internal/ipa/config/ca.crt \
-            -o /usr/local/share/ca-certificates/kindred-internal.crt
-          update-ca-certificates
-
       - name: Checkout
-        uses: https://github.com/actions/checkout@v4
+        run: |
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git clone --depth 1 --branch "${GITHUB_REF_NAME}" \
+            "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE" \
+            || git clone --depth 1 "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}.git" "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git checkout "$GITHUB_SHA" 2>/dev/null || true
 
       - name: Set up venv
         run: python3 -m venv $VIRTUAL_ENV
 
       - name: Install dependencies
         run: |
-          pip install --cache-dir $PIP_CACHE_DIR \
+          pip install --cache-dir $PIP_CACHE_DIR torch --index-url $TORCH_INDEX
-            torch --index-url $TORCH_INDEX
           pip install --cache-dir $PIP_CACHE_DIR torch-geometric
           pip install --cache-dir $PIP_CACHE_DIR -e ".[train]"
 
-      - name: Restore datagen checkpoint
-        id: datagen-cache
-        uses: https://github.com/actions/cache/restore@v4
-        with:
-          path: data/synthetic
-          key: datagen-${{ github.sha }}
-          restore-keys: |
-            datagen-
-
       - name: Generate dataset
         run: |
           NUM=${INPUTS_NUM_ASSEMBLIES:-100000}
@@ -172,23 +160,6 @@ jobs:
           INPUTS_NUM_ASSEMBLIES: ${{ inputs.num_assemblies }}
           INPUTS_NUM_WORKERS: ${{ inputs.num_workers }}
 
-      - name: Save datagen checkpoint
-        if: always()
-        uses: https://github.com/actions/cache/save@v4
-        with:
-          path: data/synthetic
-          key: datagen-${{ github.sha }}
-
-      - name: Upload dataset
-        uses: https://github.com/actions/upload-artifact@v3
-        with:
-          name: synthetic-dataset
-          path: |
-            data/synthetic/index.json
-            data/synthetic/stats.json
-            data/synthetic/shards/
-          retention-days: 90
-
       - name: Print summary
         if: always()
         run: |