docs: add provenance comments — what was replaced, why, what was removed

Each action.yml now documents:
- Original upstream repo (GitHub Actions)
- Why it was rewritten for self-hosted Gitea
- What was removed from the original
- Author and date

checkout/action.yml

@@ -1,3 +1,13 @@
+# Tinqs Checkout — replaces actions/checkout@v4
+# Original: https://github.com/actions/checkout (GitHub-hosted, Node.js action)
+# Why rewritten: actions/checkout requires Node.js runtime and GitHub API calls.
+#   On self-hosted Gitea (tinqs.com), it fails because it tries to hit api.github.com.
+#   This composite action uses plain git clone — works on any runner with git installed.
+# Removed from original: submodules, LFS, sparse-checkout, GitHub token auth, persist-credentials.
+#   We only need depth, ref, and optional Gitea token for private repos.
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Checkout'
 description: 'Clone a Gitea repository (replaces actions/checkout)'
 

setup-aws/action.yml

@@ -1,3 +1,13 @@
+# Tinqs Setup AWS — replaces aws-actions/configure-aws-credentials@v4
+# Original: https://github.com/aws-actions/configure-aws-credentials (GitHub-hosted, Node.js)
+# Why rewritten: Original uses OIDC federation with GitHub's token endpoint — doesn't exist
+#   on Gitea. Our runners use IAM task roles (ECS/Fargate) or instance profiles (EC2/Lightsail),
+#   so we don't need credential configuration — just install the CLI and optionally ECR login.
+# Removed from original: OIDC, assume-role, session tokens, credential masking, region output.
+#   ECR login bundled here instead of needing separate aws-actions/amazon-ecr-login.
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup AWS'
 description: 'Install AWS CLI and optionally login to ECR'
 

setup-go/action.yml

@@ -1,3 +1,13 @@
+# Tinqs Setup Go — replaces actions/setup-go@v5
+# Original: https://github.com/actions/setup-go (GitHub-hosted, Node.js action)
+# Why rewritten: Original uses GitHub's tool cache API and Node.js runtime — neither
+#   available on self-hosted Gitea runners. This composite action downloads Go directly
+#   from go.dev and sets GITHUB_PATH. Skips install if correct version already present
+#   (for when runner image has Go pre-baked).
+# Removed from original: tool cache, go-version-file, check-latest, cache (actions/cache dep).
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup Go'
 description: 'Install Go and configure PATH (replaces actions/setup-go)'
 

setup-node/action.yml

@@ -1,3 +1,13 @@
+# Tinqs Setup Node — replaces actions/setup-node@v4
+# Original: https://github.com/actions/setup-node (GitHub-hosted, Node.js action)
+# Why rewritten: Original depends on GitHub tool cache and @actions/core Node.js package.
+#   Self-hosted Gitea runners don't have the tool cache infrastructure.
+#   This composite action installs Node via NodeSource APT repo and pnpm via npm.
+#   Skips install if correct major version already present (pre-baked runner image).
+# Removed from original: tool cache, .nvmrc/.node-version file, registry-url, cache (yarn/pnpm).
+# Author: Ozan / Claude Code — 2026-05-22
+# Part of: tinqs/ci (Tinqs CI toolchain)
+
 name: 'Tinqs Setup Node'
 description: 'Install Node.js and pnpm (replaces actions/setup-node)'