git » homepage.git » commit 91752af

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 82101b5..d5c8c0e 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -10,7 +10,7 @@ jobs:
     runs-on: homepage
     timeout-minutes: 40
     steps:
-      - name: Checkout source and website media
+      - name: Checkout source
         env:
           CHECKOUT_TOKEN: ${{ github.token }}
           GIT_LFS_SKIP_SMUDGE: '1'
@@ -22,10 +22,22 @@ jobs:
           export GIT_CONFIG_VALUE_0="Authorization: Basic $auth"
           git fetch --no-tags --depth=1 origin "$GITHUB_SHA"
           git checkout --detach FETCH_HEAD
-          git lfs fetch --include='md/**' --exclude='' origin HEAD
-          git lfs checkout md
       - name: Build pinned toolchain
         run: make container-image
+      - name: Fetch website media with pinned Git LFS
+        env:
+          CHECKOUT_TOKEN: ${{ github.token }}
+        run: |
+          auth=$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 -w0)
+          export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader
+          export GIT_CONFIG_VALUE_0="Authorization: Basic $auth"
+          podman --remote run --rm --userns=keep-id --network=host \
+            --add-host minerva:100.66.91.20 \
+            --volume "$PWD:/workspace:Z" --workdir /workspace \
+            --volume /etc/forgejo-runner-blacktide/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro \
+            --env GIT_CONFIG_COUNT --env GIT_CONFIG_KEY_0 --env GIT_CONFIG_VALUE_0 \
+            localhost/homepage-builder:2026-07-15 \
+            sh -c "git lfs fetch --include='md/**' --exclude='' origin HEAD && git lfs checkout md"
       - name: Test and verify reproducible output
         run: make verify-reproducible
       - name: Build website
diff --git a/README.md b/README.md
index 615adbf..7bce3f3 100644
--- a/README.md
+++ b/README.md
@@ -76,7 +76,7 @@ This check contacts external sites and is diagnostic; it is not part of the byte
 make deploy
 ```
 
-Deploy first runs the reproducible container build, then uses host-side rsync and Git credentials to publish to `DEPLOY_HOST`. It refuses to run unless the Git worktree is clean and `HEAD` matches its upstream branch. The container never receives SSH keys or Git credentials.
+Deploy first runs the reproducible container build, then uses host-side rsync and Git credentials to publish to `DEPLOY_HOST`. It refuses to run unless the Git worktree is clean and `HEAD` matches its upstream branch. The local build container never receives SSH keys or Git credentials. CI passes its short-lived checkout token only to a separate media-fetch container; the build and tests receive no credentials.
 
 ## Preservation tools