ci: Run build after checks pass, fix deploy checkout

.gitea/workflows/lint.yml

@@ -20,6 +20,7 @@ on:
 jobs:
   build:
     name: Build Firmware
+    needs: [cppcheck, flawfinder, gitleaks, shellcheck]
     runs-on: anvil
     container:
       image: docker.io/espressif/idf:v5.3
@@ -72,22 +73,20 @@ jobs:
     steps:
       - name: Checkout
         run: |
-          git clone --depth=1 --branch=${{ github.ref_name }} \
-            https://oauth2:${{ github.token }}@git.mymx.me/${{ github.repository }}.git workspace
-          cd workspace
+          mkdir -p workspace
+          curl -sL -H "Authorization: token ${{ github.token }}" \
+            "https://git.mymx.me/api/v1/repos/${{ github.repository }}/archive/${{ github.ref_name }}.tar.gz" \
+            | tar -xz --strip-components=1 -C workspace
 
       - name: Build firmware
         run: |
-          cd workspace
-          . $HOME/esp/esp-idf/export.sh
-          cd get-started/csi_recv_router
-          idf.py build
+          cd workspace && . $HOME/esp/esp-idf/export.sh && cd get-started/csi_recv_router && idf.py build
 
       - name: Create release and upload firmware
         env:
           GITEA_TOKEN: ${{ github.token }}
+        working-directory: workspace
         run: |
-          cd workspace
           TAG="${{ github.ref_name }}"
           REPO="${{ github.repository }}"
           API_URL="https://git.mymx.me/api/v1"
@@ -119,8 +118,8 @@ jobs:
             "$API_URL/repos/$REPO/releases/$RELEASE_ID/assets?name=csi_recv_router.bin"
 
       - name: Deploy via OTA
+        working-directory: workspace
         run: |
-          cd workspace
           SENSORS="muddy-storm:192.168.129.29 amber-maple:192.168.129.30 hollow-acorn:192.168.129.31"
           OTA_PORT=8899
           EXPECTED_VERSION="${{ github.ref_name }}"