ci: fix submodule auth + replace matrix build for device-agent

- persist-credentials: false on all workflows (prevent Gitea overwriting insteadOf URL)
- Replace matrix strategy in build_device_agent.yaml with sequential builds (act_runner v0.6.1 ParallelExecutor crash)
- Build all 3 platforms (linux/amd64, linux/arm64, windows/amd64) in single step

.gitea/workflows/build_dashboard.yaml

@@ -15,7 +15,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with:

.gitea/workflows/build_device_agent.yaml

@@ -6,13 +6,6 @@ on:
 jobs:
   cross-build:
     runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        goos: [linux, windows]
-        goarch: [amd64, arm64]
-        exclude:
-          - goos: windows
-            goarch: arm64
     steps:
       - name: Configure git auth for submodules
         run: git config --global url."https://x-access-token:${{ secrets.BUILD_TOKEN }}@git.datadunia.com/".insteadOf "https://git.datadunia.com/"
@@ -22,25 +15,44 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-go@v5
         with:
           go-version: '1.26'
 
-      - name: Build
+      - name: Build all platforms
         working-directory: apps/device-agent
-        env:
+        shell: bash
-          CGO_ENABLED: '0'
-          GOOS: ${{ matrix.goos }}
-          GOARCH: ${{ matrix.goarch }}
         run: |
-          EXT=""
+          set -e
-          if [ "${{ matrix.goos }}" = "windows" ]; then EXT=".exe"; fi
+          mkdir -p bin
-          go build -o bin/nexus-device-agent-${{ matrix.goos }}-${{ matrix.goarch }}${EXT} .
+          for PAIR in linux/amd64 linux/arm64 windows/amd64; do
+            GOOS="${PAIR%%/*}"
+            GOARCH="${PAIR##*/}"
+            EXT=""
+            if [ "$GOOS" = "windows" ]; then EXT=".exe"; fi
+            OUT="bin/nexus-device-agent-${GOOS}-${GOARCH}${EXT}"
+            echo "Building $OUT ..."
+            CGO_ENABLED=0 GOOS="$GOOS" GOARCH="$GOARCH" go build -o "$OUT" .
+          done
+          echo "=== Build output ==="
+          ls -la bin/
 
-      - name: Upload artifact
+      - name: Upload linux/amd64
         uses: actions/upload-artifact@v3
         with:
-          name: nexus-device-agent-${{ matrix.goos }}-${{ matrix.goarch }}
+          name: nexus-device-agent-linux-amd64
-          path: apps/device-agent/bin/nexus-device-agent-*
+          path: apps/device-agent/bin/nexus-device-agent-linux-amd64
+
+      - name: Upload linux/arm64
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexus-device-agent-linux-arm64
+          path: apps/device-agent/bin/nexus-device-agent-linux-arm64
+
+      - name: Upload windows/amd64
+        uses: actions/upload-artifact@v3
+        with:
+          name: nexus-device-agent-windows-amd64
+          path: apps/device-agent/bin/nexus-device-agent-windows-amd64.exe

.gitea/workflows/build_server_core.yaml

@@ -15,7 +15,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-go@v5
         with:

.gitea/workflows/docs_call.yaml

@@ -15,7 +15,7 @@ jobs:
           submodules: true
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - uses: actions/setup-node@v4
         with:

.gitea/workflows/release_call.yaml

@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.BUILD_TOKEN }}
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Download all artifacts
         uses: actions/download-artifact@v3