Use pinned official Actions without a public Tea mirror

.github/workflows/verify.yml

@@ -22,8 +22,8 @@ jobs:
       DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
       DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
-      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4
-      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.14'
       - name: Install CI dependencies with index diagnostics and fallback
@@ -75,8 +75,8 @@ jobs:
       DEBIAN_MIRROR: ${{ vars.DEBIAN_MIRROR }}
       DEBIAN_SECURITY_MIRROR: ${{ vars.DEBIAN_SECURITY_MIRROR }}
     steps:
-      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/checkout@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v4
-      - uses: https://tea.pigway.com/way/frame-flow-ci-actions/setup-python@bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46 # v5
+      - uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: https://github.com/actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.14'
       - name: Install deploy tooling

docs/deployment/GITEA_CD.md

@@ -279,28 +279,31 @@ real host mounts and restart, remains the required live acceptance.
 
 ## Actions download transport
 
-Verify and deploy fetch commit-pinned Actions from the supporting repository
-`https://tea.pigway.com/way/frame-flow-ci-actions`, subdirectories `checkout`
-and `setup-python`, at commit `bada0aa1b7e0d23fe9da66ce2ec9b193c211ea46`.
-This avoids unstable NAS downloads from GitHub (EOF/timeouts in runs 27/28)
-and slow external Gitea Action preparation (run 29, superseded).
+Verify and deploy reference official GitHub Actions directly, pinned to immutable
+commits rather than moving tags:
 
-The cache contains unmodified official upstream source, including MIT licenses:
+| Action | Official upstream commit |
+| --- | --- |
+| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 |
+| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 |
 
-| Action | Official upstream commit | Identical Git tree |
-| --- | --- | --- |
-| actions/checkout v4 | 11d5960a326750d5838078e36cf38b85af677262 | f8a7b72dc00648d050099727d25ca92a43ad1162 |
-| actions/setup-python v5 | a26af69be951a213d495a4c3e4e4022e16d87065 | 568c6310706725a8b725497dbe6b3b909cbcf6cd |
+The workflow uses explicit `https://github.com/actions/...` URLs so Gitea's
+configured default Actions host cannot redirect downloads to the project owner's
+server. Forks download Actions through their own Runner/network; no public action
+mirror is served by this project. The former Tea auxiliary repository is private
+and is no longer required by current workflows.
 
-`UPSTREAM.json` records provenance. Upstream tag SHAs were checked using the official
-GitHub API; each cached subtree hash was compared to the upstream commit tree.
-No application secrets are stored in this public upstream-source cache; its own
-Actions are disabled. Intentional action updates must repeat tree verification
-and change the workflow pin. All validation steps remain unchanged.
+Keep the NAS act_runner's existing action cache and Python toolcache persistent.
+A new action URL or commit may require an initial download; an old mirror cache
+is not automatically interchangeable with an upstream Git repository. Do not
+prune Runner caches between jobs. Python toolcache misses still download Python
+from its upstream release source. Network failures remain failures, never reasons
+to skip validation or silently fall back to the owner's Tea server.
 
-Python toolcache misses may still require setup-python to download Python from
-its upstream release source. This removes Action source download dependence,
-not every possible external download. No Runner or NAS network configuration is changed.
+Administrators needing a mainland-specific download route can configure their
+own Runner/network cache privately. Such settings must not introduce public
+workflow references to a personal mirror. This change does not modify NAS VPN,
+proxy, firewall or other applications. All validation and deploy gates remain.
 
 ### Synology Photos dependencies
 

tests/test_publication_security.py

@@ -21,3 +21,16 @@ def test_private_production_configuration_uses_secrets():
     ):
         assert "${{ secrets." + key + " }}" in workflow
         assert "${{ vars." + key + " }}" not in workflow
+
+
+def test_actions_downloads_do_not_depend_on_personal_server():
+    import re
+
+    workflow = Path(".github/workflows/verify.yml").read_text()
+    actions = re.findall(r"uses:\s*(\S+)", workflow)
+    assert len(actions) == 4
+    for action in actions:
+        assert re.fullmatch(
+            r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
+            action,
+        )