Add validated repository patch transport

.gitea/workflows/azeroth-validated-patch.yml

@@ -0,0 +1,71 @@
+---BEGIN WORKFLOW---
+ ame: AzerothAI Validated Patch
+
+on:
+  workflow_dispatch:
+    inputs:
+      patch_file:
+        description: Patch file under ops/patches/
+        required: true
+
+jobs:
+  patch:
+    runs-on: azerothai-host
+    timeout-minutes: 10
+
+    env:
+      PATCH_FILE: ${{ inputs.patch_file }}
+      AZEROTH_ACTOR: ${{ gitea.actor }}
+      AZEROTH_REPOSITORY: ${{ gitea.repository }}
+
+    steps:
+      - name: Verify authorized request
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          [ "$AZEROTH_ACTOR" = "richard" ] || {
+            echo "Unauthorized actor: $AZEROTH_ACTOR"
+            exit 1
+          }
+
+          [ "$AZEROTH_REPOSITORY" = "richard/AzerothAI" ] || {
+            echo "Wrong repository: $AZEROTH_REPOSITORY"
+            exit 1
+          }
+
+          base="${PATCH_FILE#ops/patches/}"
+
+          [ "$base" != "$PATCH_FILE" ] || {
+            echo "Patch must be under ops/patches/"
+            exit 1
+          }
+
+          [[ "$base" != */* ]] || {
+            echo "Nested patch paths are not allowed"
+            exit 1
+          }
+
+          [[ "$base" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*\.patch$ ]] || {
+            echo "Invalid patch filename"
+            exit 1
+          }
+
+      - name: Check out patch source
+        uses: actions/checkout@v4
+
+      - name: Apply validated patch
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          [ -f "$PATCH_FILE" ] || {
+            echo "Patch file not found: $PATCH_FILE"
+            exit 1
+          }
+
+          sha="$(sha256sum "$PATCH_FILE" | awk '{print $1}')"
+          payload="$(base64 -w0 "$PATCH_FILE")"
+
+          sudo -n /usr/local/bin/azerothai-ops "apply-patch:${sha}:${payload}"
+---END WORKFLOW---