From d61246e7e44a687c53003d37ac0691e124dc669a Mon Sep 17 00:00:00 2001
From: tinqs-limited <ozan@tinqs.com>
Date: Fri, 22 May 2026 17:55:30 +0100
Subject: [PATCH] =?UTF-8?q?docs:=20add=20provenance=20comments=20=E2=80=94?=
 =?UTF-8?q?=20what=20was=20replaced,=20why,=20what=20was=20removed?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Each action.yml now documents:
- Original upstream repo (GitHub Actions)
- Why it was rewritten for self-hosted Gitea
- What was removed from the original
- Author and date
---
 checkout/action.yml   | 10 ++++++++++
 setup-aws/action.yml  | 10 ++++++++++
 setup-go/action.yml   | 10 ++++++++++
 setup-node/action.yml | 10 ++++++++++
 4 files changed, 40 insertions(+)

diff --git a/checkout/action.yml b/checkout/action.yml
index 37b8eef..846f2e5 100644
--- a/checkout/action.yml
+++ b/checkout/action.yml
@@ -1,3 +1,13 @@
+# Tinqs Checkout — replaces actions/checkout@v4
+# Original: https://github.com/actions/checkout (GitHub-hosted, Node.js action)
+# Why rewritten: actions/checkout requires Node.js runtime and GitHub API calls.
+#   On self-hosted Gitea (tinqs.com), it fails because it tries to hit api.github.com.
+#   This composite action uses plain git clone — works on any runner with git installed.
+# Removed from original: submodules, LFS, sparse-checkout, GitHub token auth, persist-credentials.
+#   We only need depth, ref, and optional Gitea token for private repos.
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Checkout'
 description: 'Clone a Gitea repository (replaces actions/checkout)'
 
diff --git a/setup-aws/action.yml b/setup-aws/action.yml
index 0cbaaa2..457ebc6 100644
--- a/setup-aws/action.yml
+++ b/setup-aws/action.yml
@@ -1,3 +1,13 @@
+# Tinqs Setup AWS — replaces aws-actions/configure-aws-credentials@v4
+# Original: https://github.com/aws-actions/configure-aws-credentials (GitHub-hosted, Node.js)
+# Why rewritten: Original uses OIDC federation with GitHub's token endpoint — doesn't exist
+#   on Gitea. Our runners use IAM task roles (ECS/Fargate) or instance profiles (EC2/Lightsail),
+#   so we don't need credential configuration — just install the CLI and optionally ECR login.
+# Removed from original: OIDC, assume-role, session tokens, credential masking, region output.
+#   ECR login bundled here instead of needing separate aws-actions/amazon-ecr-login.
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup AWS'
 description: 'Install AWS CLI and optionally login to ECR'
 
diff --git a/setup-go/action.yml b/setup-go/action.yml
index 3c5f6d0..97c487f 100644
--- a/setup-go/action.yml
+++ b/setup-go/action.yml
@@ -1,3 +1,13 @@
+# Tinqs Setup Go — replaces actions/setup-go@v5
+# Original: https://github.com/actions/setup-go (GitHub-hosted, Node.js action)
+# Why rewritten: Original uses GitHub's tool cache API and Node.js runtime — neither
+#   available on self-hosted Gitea runners. This composite action downloads Go directly
+#   from go.dev and sets GITHUB_PATH. Skips install if correct version already present
+#   (for when runner image has Go pre-baked).
+# Removed from original: tool cache, go-version-file, check-latest, cache (actions/cache dep).
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup Go'
 description: 'Install Go and configure PATH (replaces actions/setup-go)'
 
diff --git a/setup-node/action.yml b/setup-node/action.yml
index 3e51eef..bdd6c7a 100644
--- a/setup-node/action.yml
+++ b/setup-node/action.yml
@@ -1,3 +1,13 @@
+# Tinqs Setup Node — replaces actions/setup-node@v4
+# Original: https://github.com/actions/setup-node (GitHub-hosted, Node.js action)
+# Why rewritten: Original depends on GitHub tool cache and @actions/core Node.js package.
+#   Self-hosted Gitea runners don't have the tool cache infrastructure.
+#   This composite action installs Node via NodeSource APT repo and pnpm via npm.
+#   Skips install if correct major version already present (pre-baked runner image).
+# Removed from original: tool cache, .nvmrc/.node-version file, registry-url, cache (yarn/pnpm).
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup Node'
 description: 'Install Node.js and pnpm (replaces actions/setup-node)'