From 1f2d8f98baa1df9f5166eef08a333cfca823c8eb Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Sat, 23 May 2026 18:30:37 +0100
Subject: [PATCH] ci(testbox): avoid ready raw runners after hydration failure

---
 .github/workflows/ci-build-artifacts-testbox.yml | 8 ++++++--
 .github/workflows/ci-check-testbox.yml           | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci-build-artifacts-testbox.yml b/.github/workflows/ci-build-artifacts-testbox.yml
index 9affb0485b4..bba44ae450a 100644
--- a/.github/workflows/ci-build-artifacts-testbox.yml
+++ b/.github/workflows/ci-build-artifacts-testbox.yml
@@ -41,6 +41,10 @@ jobs:
           set -euo pipefail
 
           workdir="$GITHUB_WORKSPACE"
+          if [[ -z "$CHECKOUT_TOKEN" ]]; then
+            echo "checkout token is missing" >&2
+            exit 1
+          fi
           auth_header="$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 | tr -d '\n')"
 
           reset_checkout_dir() {
@@ -59,7 +63,7 @@ jobs:
 
             timeout --signal=TERM 30s git -C "$workdir" \
               -c protocol.version=2 \
-              -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" \
+              -c "http.extraheader=AUTHORIZATION: basic ${auth_header}" \
               fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
               "+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1
 
@@ -222,6 +226,6 @@ jobs:
 
       - name: Run Testbox
         uses: useblacksmith/run-testbox@5ca05834db1d3813554d1dd109e5f2087a8d7cbc
-        if: always()
+        if: success()
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
diff --git a/.github/workflows/ci-check-testbox.yml b/.github/workflows/ci-check-testbox.yml
index 656bf270bd0..ada06d57921 100644
--- a/.github/workflows/ci-check-testbox.yml
+++ b/.github/workflows/ci-check-testbox.yml
@@ -39,6 +39,10 @@ jobs:
           set -euo pipefail
 
           workdir="$GITHUB_WORKSPACE"
+          if [[ -z "$CHECKOUT_TOKEN" ]]; then
+            echo "checkout token is missing" >&2
+            exit 1
+          fi
           auth_header="$(printf 'x-access-token:%s' "$CHECKOUT_TOKEN" | base64 | tr -d '\n')"
 
           reset_checkout_dir() {
@@ -57,7 +61,7 @@ jobs:
 
             timeout --signal=TERM 30s git -C "$workdir" \
               -c protocol.version=2 \
-              -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth_header}" \
+              -c "http.extraheader=AUTHORIZATION: basic ${auth_header}" \
               fetch --no-tags --prune --no-recurse-submodules --depth=1 origin \
               "+${CHECKOUT_SHA}:refs/remotes/origin/ci-target" || return 1
 
@@ -124,7 +128,7 @@ jobs:
 
       - name: Run Testbox
         uses: useblacksmith/run-testbox@5ca05834db1d3813554d1dd109e5f2087a8d7cbc
-        if: always()
+        if: success()
         continue-on-error: true
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"