From 562073294d47b1bc52365bd621b49430290d2809 Mon Sep 17 00:00:00 2001
From: "every.channel" <founder@every.channel>
Date: Mon, 16 Feb 2026 01:23:11 -0500
Subject: [PATCH] ci: use user-space bootstrap for age and node checks

---
 .forgejo/workflows/deploy-cloudflare.yml | 42 +++++++++++++++---------
 1 file changed, 27 insertions(+), 15 deletions(-)

diff --git a/.forgejo/workflows/deploy-cloudflare.yml b/.forgejo/workflows/deploy-cloudflare.yml
index 85ee5e1..460cd00 100644
--- a/.forgejo/workflows/deploy-cloudflare.yml
+++ b/.forgejo/workflows/deploy-cloudflare.yml
@@ -24,21 +24,33 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          as_root() {
-            if [[ "$(id -u)" = "0" ]]; then
-              "$@"
-            elif command -v sudo >/dev/null 2>&1; then
-              sudo "$@"
-            else
-              echo "error: need root or sudo to install runner dependencies"
-              exit 2
-            fi
-          }
-          if command -v apt-get >/dev/null 2>&1; then
-            as_root apt-get update
-            as_root apt-get install -y curl ca-certificates nodejs npm age
-          elif command -v apk >/dev/null 2>&1; then
-            as_root apk add --no-cache curl ca-certificates nodejs npm age
+          install -d -m 755 "$HOME/.local/bin"
+          echo "PATH=$HOME/.local/bin:$PATH" >> "$GITHUB_ENV"
+          export PATH="$HOME/.local/bin:$PATH"
+
+          if ! command -v curl >/dev/null 2>&1; then
+            echo "error: curl is required"
+            exit 2
+          fi
+
+          if ! command -v age >/dev/null 2>&1; then
+            age_version="1.2.1"
+            arch="$(uname -m)"
+            case "${arch}" in
+              x86_64|amd64) age_arch="amd64" ;;
+              aarch64|arm64) age_arch="arm64" ;;
+              *)
+                echo "error: unsupported runner arch for age prebuilt binary: ${arch}"
+                exit 2
+                ;;
+            esac
+            curl -fsSL "https://github.com/FiloSottile/age/releases/download/v${age_version}/age-v${age_version}-linux-${age_arch}.tar.gz" \
+              | tar -xz -C "$HOME/.local/bin" --strip-components=1 age/age age/age-keygen
+          fi
+
+          if ! command -v node >/dev/null 2>&1 || ! command -v npm >/dev/null 2>&1; then
+            echo "error: node and npm are required on this runner"
+            exit 2
           fi
 
       - name: Configure CI Age identity