Replace Node.js with data.forgejo.org/oci/node 24-trixie (#1604)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [data.forgejo.org/oci/node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/docker-node)) | container | replacement | `24-bookworm` → `24-trixie` |

This is a special PR that replaces `data.forgejo.org/oci/node` with the community suggested minimal stable replacement version.

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://code.forgejo.org/forgejo/end-to-end/pulls/1604
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>

.dockerignore

@@ -0,0 +1 @@
+.git

.editorconfig

@@ -0,0 +1,10 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+tab_width = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.forgejo/prepare-end-to-end/action.yml

@@ -0,0 +1,41 @@
+inputs:
+  built:
+    description: 'True if a source build is available, false otherwise'
+
+runs:
+  using: "composite"
+  steps:
+      - name: cache S3 binaries
+        id: S3
+        uses: https://data.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            /usr/local/bin/minio
+            /usr/local/bin/mc
+            /usr/local/bin/garage
+          key: S3
+
+      - uses: https://data.forgejo.org/actions/setup-forgejo@v3.1.6
+        with:
+          install-only: true
+      - run: forgejo-binary.sh ensure_user forgejo
+      - name: inputs context dump for debug
+        run: |
+          set -x
+          cat <<EOF
+          ${{ toJSON(inputs) }}
+          EOF
+      - uses: actions/download-artifact@v3
+        if: ${{ inputs.built == 'yes' }}
+        with:
+          name: forgejo-dev
+          path: /srv/forgejo-binaries
+      - name: chown/chmod /srv/forgejo-binaries
+        run: |
+          mkdir -p /srv/forgejo-binaries
+          chown -R forgejo /srv/forgejo-binaries
+          chmod -R +x /srv/forgejo-binaries
+      - run: |
+          script=$(pwd)/end-to-end.sh
+          $script run dependencies
+          $script clobber

.forgejo/upload-coverage/action.yml

@@ -0,0 +1,11 @@
+inputs:
+  scope:
+    description: 'Scope of the coverage'
+
+runs:
+  using: "composite"
+  steps:
+      - uses: actions/upload-artifact@v3
+        with:
+          name: coverage-${{ inputs.scope }}
+          path: /tmp/forgejo-end-to-end/coverage

.forgejo/workflows/actions.yml

@@ -1,82 +0,0 @@
-#
-#
-# https://code.forgejo.org/forgejo/end-to-end/settings/actions
-#
-# secrets.CASCADE_DOCS_ORIGIN_TOKEN
-#   https://code.forgejo.org/forgejo-ci scope write:issue, read:repository, read:user
-# vars.CASCADE_DOCS_DESTINATION_DOER
-#   forgejo-cascading-pr (https://codeberg.org/forgejo-cascading-pr)
-# secrets.CASCADE_DOCS_DESTINATION_TOKEN
-#   https://codeberg.org/forgejo-cascading-pr scope write:issue, write:repository, read:user
-# vars.CASCADE_DOCS_FORCE_VERSION
-#   replace the generated documentation for a given version even if it has already
-#   been generated (e.g. v7.0.0-test)
-#
-
-on:
-  pull_request:
-  push:
-    branches:
-      - 'main'
-
-jobs:
-  actions:
-    runs-on: self-hosted
-    strategy:
-      matrix:
-        info:
-          - version: v7.0
-            branch: next
-            forgejo: https://codeberg.org
-            repo: forgejo-experimental/forgejo
-            tests: ${{ vars.V7_0_TESTS }}
-          - version: v1.21
-            forgejo: https://codeberg.org
-            repo: forgejo/forgejo
-            tests: ${{ vars.V1_21_TESTS }}
-          - version: v1.20
-            forgejo: https://codeberg.org
-            repo: forgejo/forgejo
-            tests: ${{ vars.V1_20_TESTS }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: https://code.forgejo.org/actions/setup-forgejo@v2
-        with:
-          install-only: true
-
-      - name: run
-        id: run
-        if: matrix.info.tests != 'none'
-        shell: bash
-        run: |
-          set -x
-          forgejo-binary.sh ensure_user forgejo
-          full_version=$(curl -sS ${{ matrix.info.forgejo }}/api/v1/repos/${{ matrix.info.repo }}/releases | jq -r '.[] | .tag_name | select(startswith("${{ matrix.info.version }}"))' | sort -r | head -1)
-          binary=${{ matrix.info.forgejo }}/${{ matrix.info.repo }}/releases/download/${full_version}/forgejo-${full_version#v}-linux-amd64
-
-          export DIR=$(mktemp -d)
-          chown forgejo $DIR /srv
-
-          su -c "actions/run.sh $binary $full_version ${{ matrix.info.version }} ${{ matrix.info.tests }}" forgejo
-
-          echo full_version="$full_version" >> $GITHUB_OUTPUT
-
-      - name: update documentation
-        if: matrix.info.tests != 'none' && github.ref == 'refs/heads/main'
-        uses: https://code.forgejo.org/actions/cascading-pr@v1
-        with:
-          origin-url: ${{ env.GITHUB_SERVER_URL }}
-          origin-repo: ${{ github.repository }}
-          origin-token: ${{ secrets.CASCADE_DOCS_ORIGIN_TOKEN }}
-          origin-ref: refs/heads/main
-          destination-url: https://codeberg.org
-          destination-fork-repo: ${{ vars.CASCADE_DOCS_DESTINATION_DOER }}/docs
-          destination-repo: forgejo/docs
-          destination-branch: ${{ matrix.info.branch || matrix.info.version }}
-          destination-token: ${{ secrets.CASCADE_DOCS_DESTINATION_TOKEN }}
-          prefix: ${{ env.GITHUB_REPOSITORY }}-${{ matrix.info.version }}
-          update: .forgejo/cascading-docs
-        env:
-          FORCE_VERSION: "${{ vars.CASCADE_DOCS_FORCE_VERSION }}"
-          VERSION: "${{ steps.run.outputs.full_version }}"

.forgejo/workflows/end-to-end.yml

@@ -0,0 +1,166 @@
+#
+#
+# https://code.forgejo.org/forgejo/end-to-end/settings/actions
+#
+
+on:
+  pull_request:
+  push:
+    branches:
+      - 'main'
+
+enable-email-notifications: true
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: 'data.forgejo.org/oci/node:24-trixie'
+    outputs:
+      built: "${{ steps.build.outputs.built }}"
+      forgejo_versions_json: "${{ steps.build.outputs.forgejo_versions_json }}"
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/setup-go@v5
+        with:
+          go-version: "1.25"
+      - name: lib/build.sh
+        id: build
+        run: |
+          mkdir $d /tmp/forgejo-upload
+          touch /tmp/forgejo-upload/PLACEHOLDER
+
+          if ! test -f forgejo/build-from-sources; then
+             echo forgejo/build-from-sources is not present, do not build any version from source
+             source lib/lib.sh
+             echo "forgejo_versions_json=$(node -p "JSON.stringify(process.argv[1].split(' '))" "$RELEASE_NUMBERS")" >> $FORGEJO_OUTPUT
+             echo "built=no" >> $FORGEJO_OUTPUT
+             exit 0
+          fi
+
+          set -x
+          #
+          # SQLite needs gcc to be compiled
+          #
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get update -qq
+          apt-get -q install -y -qq build-essential
+
+          d=/tmp/forgejo-binaries
+
+          for version in $(cat forgejo/build-from-sources) ; do
+            lib/build.sh $version $d
+            forgejo=$d/forgejo-$version-dev
+            $forgejo --version
+            mv $forgejo /tmp/forgejo-upload/forgejo-$version
+          done
+
+          echo "forgejo_versions_json=$(node -p "JSON.stringify(process.argv[1].split(' '))" "$(cat forgejo/build-from-sources)")" >> $FORGEJO_OUTPUT
+          echo "built=yes" >> $FORGEJO_OUTPUT
+
+      - name: steps context dump for debug
+        run: |
+          set -x
+          cat <<EOF
+          ${{ toJSON(steps) }}
+          EOF
+
+      - uses: actions/upload-artifact@v3
+        if: ${{ steps.build.outputs.built == 'yes' }}
+        with:
+          name: forgejo-dev
+          path: /tmp/forgejo-upload
+
+  packages:
+    needs: [build]
+    runs-on: lxc-trixie
+    strategy:
+      matrix:
+        forgejo_version: ${{ fromJSON(needs.build.outputs.forgejo_versions_json) }}
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - uses: ./.forgejo/prepare-end-to-end
+        with:
+            built: ${{ needs.build.outputs.built }}
+      - run: su forgejo -c "./end-to-end.sh test_packages ${{ matrix.forgejo_version }}"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: packages
+      - name: full logs
+        if: always()
+        run: su forgejo -c "./end-to-end.sh show_logs"
+
+  actions:
+    needs: [build]
+    runs-on: lxc-trixie
+    strategy:
+      matrix:
+        forgejo_version: ${{ fromJSON(needs.build.outputs.forgejo_versions_json) }}
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - uses: ./.forgejo/prepare-end-to-end
+        with:
+            built: ${{ needs.build.outputs.built }}
+      - run: ./end-to-end.sh prepare_dockerd
+      - run: su forgejo -c "./end-to-end.sh test_actions ${{ matrix.forgejo_version }}"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: actions
+      - name: full logs
+        if: always()
+        run: su forgejo -c "./end-to-end.sh show_logs"
+
+  federation:
+    needs: [build]
+    runs-on: lxc-trixie
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - uses: ./.forgejo/prepare-end-to-end
+        with:
+            built: ${{ needs.build.outputs.built }}
+      - name: install zstd
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get -q install -y -qq zstd
+      - name: cache GitLab OCI image
+        uses: https://data.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            /srv/forgejo-binaries/gitlab
+          key: gitlab
+      - name: setup dbus
+        run: |
+          apt-get -q install -y -qq dbus
+          systemctl enable --now dbus
+      - name: run test_federation
+        run: |
+          chown -R forgejo:forgejo .
+          su forgejo -c "./end-to-end.sh test_federation"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: federation
+      - name: full logs
+        if: always()
+        run: su forgejo -c "./end-to-end.sh show_logs"
+
+  upgrade:
+    name: upgrade and storage
+    needs: [build]
+    runs-on: lxc-trixie
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - uses: ./.forgejo/prepare-end-to-end
+        with:
+            built: ${{ needs.build.outputs.built }}
+      - run: su forgejo -c "./end-to-end.sh test_upgrades"
+      - run: su forgejo -c "./end-to-end.sh test_storage"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: upgrade
+      - name: full logs
+        if: always()
+        run: su forgejo -c "./end-to-end.sh show_logs"

.forgejo/workflows/packages.yml

@@ -1,43 +0,0 @@
-on:
-  pull_request:
-  push:
-    branches:
-      - 'main'
-
-jobs:
-  packages:
-    runs-on: self-hosted
-    strategy:
-      matrix:
-        info:
-          - version: v7.0
-            branch: next
-            forgejo: https://codeberg.org
-            repo: forgejo-experimental/forgejo
-            tests: ${{ vars.V7_0_TESTS }}
-          - version: v1.21
-            forgejo: https://codeberg.org
-            repo: forgejo/forgejo
-            tests: ${{ vars.V1_21_TESTS }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: https://code.forgejo.org/actions/setup-forgejo@v2
-        with:
-          install-only: true
-
-      - name: run
-        if: matrix.info.tests != 'none'
-        shell: bash
-        run: |
-          set -x
-          forgejo-binary.sh ensure_user forgejo
-          full_version=$(curl -sS ${{ matrix.info.forgejo }}/api/v1/repos/${{ matrix.info.repo }}/releases | jq -r '.[] | .tag_name | select(startswith("${{ matrix.info.version }}"))' | sort -r | head -1)
-          binary=${{ matrix.info.forgejo }}/${{ matrix.info.repo }}/releases/download/${full_version}/forgejo-${full_version#v}-linux-amd64
-
-          export DIR=$(mktemp -d)
-          chown forgejo $DIR /srv
-
-          export VERBOSE="${{ vars.VERBOSE || false }}"
-
-          su -c "packages/run.sh $binary $full_version ${{ matrix.info.version }} ${{ matrix.info.tests }}" forgejo

.forgejo/workflows/upgrade.yml

@@ -1,41 +0,0 @@
-name: upgrade
-
-on:
-  pull_request:
-  push:
-    branches:
-      - 'main'
-
-jobs:
-  upgrade:
-    runs-on: docker
-    container:
-      image: 'docker.io/node:20-bookworm'
-    steps:
-      - name: cache S3 binaries
-        id: S3
-        uses: https://code.forgejo.org/actions/cache@v3
-        with:
-          path: |
-            /usr/local/bin/minio
-            /usr/local/bin/mc
-            /usr/local/bin/garage
-          key: S3
-
-      - name: skip if S3 cache hit
-        if: steps.S3.outputs.cache-hit != 'true'
-        run: echo no hit
-
-      - uses: https://code.forgejo.org/actions/checkout@v4
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version: "1.21"
-      - run: |
-          git config --add safe.directory '*'
-          adduser --quiet --comment forgejo --disabled-password forgejo
-          chown -R forgejo:forgejo .
-      - run: |
-          script=$(pwd)/forgejo/upgrades/test-upgrade.sh
-          $script run dependencies
-          $script clobber
-          su forgejo -c "$script test_upgrades"

.gitignore

@@ -1,12 +1,9 @@
 *~
-forgejo-api
-forgejo-header
 forgejo-ip
 forgejo-runner-home
 forgejo-runner-pid
 forgejo-runner-token
 forgejo-runner.clientpid
 forgejo-runner.log
-forgejo-token
 .runner
 #*

Dockerfile

@@ -0,0 +1,50 @@
+FROM data.forgejo.org/oci/node:24-trixie
+
+ENV PATH=$PATH:/setup-forgejo
+ENV _CONTAINERS_USERNS_CONFIGURED=""
+
+RUN apt-get update && \
+    apt-get --assume-yes --no-install-recommends install \
+        aardvark-dns \
+        ca-certificates \
+        curl \
+        daemon \
+        fuse-overlayfs \
+        gettext \
+        git \
+        jq \
+        libcap2-bin \
+        neovim \
+        nftables \
+        passt \
+        podman \
+        podman-compose \
+        podman-docker \
+        procps \
+        pup \
+        slirp4netns \
+        sudo \
+        tcpdump \
+        uidmap \
+        wget && \
+    adduser -u 1001 forgejo-tests && \
+    groupadd wheel && \
+    adduser forgejo-tests wheel && \
+    echo "%wheel ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers && \
+    echo "forgejo-tests:10000:9999" > /etc/subuid && \
+    echo "forgejo-tests:10000:9999" > /etc/subgid && \
+    mkdir /srv/forgejo-binaries && \
+    chown forgejo-tests:forgejo-tests /srv/forgejo-binaries && \
+    apt-get clean && \
+    apt-get autoremove --purge && \
+    apt-get autoclean
+
+COPY --chown=1001:1001 . /e2e
+
+RUN git clone https://code.forgejo.org/actions/setup-forgejo.git /setup-forgejo
+
+USER forgejo-tests
+
+WORKDIR /e2e
+
+ENTRYPOINT /bin/bash

README.md

@@ -1,16 +1,36 @@
 # Forgejo end-to-end tests
 
+- [Forgejo end-to-end tests](#forgejo-end-to-end-tests)
+  - [Removing legacy tests](#removing-legacy-tests)
+  - [Hacking](#hacking)
+    - [Running from locally built binary](#running-from-locally-built-binary)
+      - [Forgejo](#forgejo)
+      - [Forgejo runner](#forgejo-runner)
+    - [Running from locally built container image](#running-from-locally-built-container-image)
+  - [Running actions tests locally](#running-actions-tests-locally)
+  - [Running federation tests locally](#running-federation-tests-locally)
+    - [Federated Mastodon Follow Test](#federated-mastodon-follow-test)
+  - [Running other tests locally](#running-other-tests-locally)
+  - [Running tests in Docker/Podman](#running-tests-in-dockerpodman)
+
 A series of tests scenarios and assertions covering
 [Forgejo](https://codeberg.org/forgejo/forgejo) and the [Forgejo
-runner](https://code.forgejo.org/forgejo/runner). They partially rely
-on [Forgejo actions](https://code.forgejo.org/actions) developped
-specifically for testing such as
-[setup-forgejo](https://code.forgejo.org/actions/setup-forgejo).
+runner](https://code.forgejo.org/forgejo/runner).
 
 They are designed to run using Forgejo releases and development
 versions compiled from designated repositories.
 
-# Hacking
+## Removing legacy tests
+
+End-to-end tests cover the supported range of releases and when one of
+them is EOL, it must be removed as well as the tests that target it
+specifically. Otherwise the test suite would grow indefinitely.
+
+When a release is EOL, a branch is cut with a name following the
+pattern `legacy/vX.Y-vA.B`. For instance when `v8.0` is published and
+`v1.21` is EOL, the branch `legacy/v8.0-v1.21` is cut.
+
+## Hacking
 
 docker and sudo must be installed with insecure registries allowed in
 /etc/docker/daemon.json for the IP that will be used for forgejo such
@@ -18,111 +38,117 @@ as:
 
 ```json
 {
-  "insecure-registries": [ "10.80.4.76:3000" ]
+  "insecure-registries": [ "10.0.0.0/8" ]
 }
-```  
+```
 
 Use setup-forgejo from source.
 
 The [setup-forgejo](https://code.forgejo.org/actions/setup-forgejo)
 repository is a [Forgejo
-Action](https://forgejo.org/docs/v1.21/user/actions/) which is meant
+Action](https://forgejo.org/docs/v7.0/user/actions/) which is meant
 to be used in workflows. However, it is implemented as shell scripts that
 can also be used to create Forgejo instances and runners locally. This
 is convenient for testing and the reason why it needs to be added to the PATH.
-For instance, it is a dependency of the `actions/run.sh` script.
+For instance, it is a dependency of the `end-to-end.sh` script.
 
 ```sh
 git clone https://code.forgejo.org/actions/setup-forgejo
 export PATH=$(pwd)/setup-forgejo:$PATH
 git clone https://code.forgejo.org/forgejo/end-to-end
 cd end-to-end
-export DIR=/tmp/end-to-end
-rm -fr /tmp/end-to-end ; sudo rm -fr /srv/example ; sudo mkdir /srv/example ; sudo chown -R $USER /srv/example
 ```
 
-Run using Forgejo built from source.
+### Running from locally built binary
+
+Before injecting a manually built binary, make sure a simple test was
+run so that the directories are populated.
+
+#### Forgejo
+
+From a checkout of https://codeberg.org/forgejo/forgejo/
 
 ```sh
-make TAGS='bindata sqlite sqlite_unlock_notify' generate forgejo
-cp -a forgejo $DIR/forgejo
+make clean-all && make frontend && make TAGS='bindata sqlite sqlite_unlock_notify' generate forgejo
+cp -a forgejo /srv/forgejo-binaries/forgejo-11.0
 ```
 
-## Running actions locally
+It will be used whenever the version `11.0` is specified in a test.
+
+#### Forgejo runner
+
+From a checkout of https://code.forgejo.org/forgejo/runner
+
+```sh
+make --always-make forgejo-runner
+cp forgejo-runner /tmp/forgejo-end-to-end/forgejo-runner
+```
+
+### Running from locally built container image
+
+```bash
+docker buildx build --output=type=docker --tag codeberg.org/forgejo/forgejo:latest .
+```
+
+## Running actions tests locally
 
 To run and debug workflows from `actions/example-*`, from the root of
 the source directory, with docker and forgejo-curl.sh installed, mimic
-what `.forgejo/workflows/actions.yml` does. There may be some manual
+what `.forgejo/workflows/end-to-end.yml` does. There may be some manual
 tweaking (such as creating temporary directories) because the tests
 run as root in the context of Forgejo Actions and assume they have
 admin permissions. But they do not need to run as root and must work
 fine when run as a regular user.
 
-Run one example
-
 ```sh
-actions/run.sh https://codeberg.org/forgejo-experimental/forgejo/releases/download/v7.0.0-test/forgejo-7.0.0-test-linux-amd64 v7.0.0-test v7_0 cron # runs actions/example-cron
+export FORGEJO_RUNNER_LOGS=/tmp/forgejo-end-to-end/forgejo-runner.log
+./end-to-end.sh run dependencies
+./end-to-end.sh actions_setup 10.0
+firefox 0.0.0.0:3000 # user root / admin1234
+./end-to-end.sh actions_verify_example echo
+./end-to-end.sh actions_teardown
 ```
 
-Cleanup. It will teardown Forgejo & the runner and not run them because there is nothing to test.
+Note that `with-docker-tcp` requires the docker daemon listens to
+tcp://127.0.0.1:2375. See `actions/actions.sh` for how to do that.
+
+## Running federation tests locally
+
+To run and debug scenarios from `federation/*`, from the root of
+the source directory, mimic what `.forgejo/workflows/end-to-end.yml` does.
 
 ```sh
-actions/run.sh https://codeberg.org/forgejo-experimental/forgejo/releases/download/v7.0.0-test/forgejo-7.0.0-test-linux-amd64 v7.0.0-test v7_0 none
+./end-to-end.sh run dependencies
+./end-to-end.sh federation_setup 12.0
+firefox 0.0.0.0:3001 # user root / admin1234
+firefox 0.0.0.0:3002 # user root / admin1234
+firefox 0.0.0.0:3003 # user root / admin1234
+./end-to-end.sh federation_verify_scenario star
+./end-to-end.sh federation_verify_scenario gotosocial
+./end-to-end.sh federation_verify_scenario mastodon
+./end-to-end.sh federation_teardown
 ```
 
-Run all examples for v7_0
+## Running other tests locally
+
+To run and debug tests, from the root of the source directory.
+
+Run one test. When the test fails the instance can be inspected at http://0.0.0.0:3000
 
 ```sh
-actions/run.sh https://codeberg.org/forgejo-experimental/forgejo/releases/download/v7.0.0-test/forgejo-7.0.0-test-linux-amd64 v7.0.0-test v7_0
+./end-to-end.sh test_packages_alpine
+./end-to-end.sh test_storage_stable_s3 minio
 ```
 
-Run from sources
+Cleanup. It will teardown the Forgejo instance.
 
 ```sh
-make TAGS='bindata sqlite sqlite_unlock_notify' generate forgejo
-cp -a forgejo $DIR/forgejo
+./end-to-end.sh stop
 ```
 
-Remote testing
+## Running tests in Docker/Podman
 
-To reduce the runtime the following variables can be set to control
-the number of cases run by the
-[actions](.forgejo/workflows/actions.yml) tests. If set to
-**none** they are not run at all for that version of Forgejo. If
-it does not exist, all tests are run.
-
-* `v7_0_TESTS`
-* `V1_21_TESTS`
-* `V1_20_TESTS`
-
-## Running packages locally
-
-To run and debug package tests, from the root of the source directory.
-
-Run one test
-
-```sh
-packages/run.sh https://codeberg.org/forgejo-experimental/forgejo/releases/download/v7.0.0-test/forgejo-7.0.0-test-linux-amd64 v7.0.0-test v7_0 alpine # runs packages/alpine.sh
-```
-
-Cleanup. It will teardown Forgejo and not run them because there is nothing to test.
-
-```sh
-packages/run.sh https://codeberg.org/forgejo-experimental/forgejo/releases/download/v7.0.0-test/forgejo-7.0.0-test-linux-amd64 v7.0.0-test v7_0 none
-```
-Run all examples for v7_0
-
-```sh
-packages/run.sh https://codeberg.org/forgejo-experimental/forgejo/releases/download/v7.0.0-test/forgejo-7.0.0-test-linux-amd64 v7.0.0-test v7_0
-```
-
-Remote testing
-
-To reduce the runtime the following variables can be set to control
-the number of cases run by the
-[packages test](.forgejo/workflows/packages.yml) tests. If set to
-**none** they are not run at all for that version of Forgejo. If
-it does not exist, all tests are run.
-
-* `v7_0_PACKAGES_TESTS`
-* `V1_21_PACKAGES_TESTS`
+There is an included Dockerfile in which the tests can be run. Building the
+conatiner will copy the the entire repo state into the container from which
+changes to the tests can be tested. Note: running in podman requires the
+`--privileged` flag because this will run podman in podman for some tests.

actions/actions.sh

@@ -0,0 +1,189 @@
+# Copyright 2024 The Forgejo Authors
+# SPDX-License-Identifier: MIT
+
+ACTIONS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+function actions_export_variables() {
+    export HOST_PORT
+    export url=http://${FORGEJO_USER}:${FORGEJO_PASSWORD}@${HOST_PORT}
+    export token=$(cat $DOT_FORGEJO_CURL/token)
+}
+
+function actions_verify_feature() {
+    local feature=$1
+
+    actions_export_variables
+
+    export FEATURE_DIR=$ACTIONS_DIR/feature-$feature
+
+    echo "============================ RUN feature-$feature ==================="
+    bash -ex $FEATURE_DIR/run.sh || return 1
+}
+
+function actions_verify_example() {
+    local example=$1
+
+    actions_export_variables
+    actions_cleanup_example_volume
+
+    export example
+    export EXAMPLE_DIR=$ACTIONS_DIR/example-$example
+
+    if test -f $EXAMPLE_DIR/setup.sh; then
+        echo "============================ SETUP example-$example ==================="
+        bash -ex $EXAMPLE_DIR/setup.sh || return 1
+    fi
+
+    if test -f $EXAMPLE_DIR/run.sh; then
+        echo "============================ RUN example-$example ==================="
+        bash -ex $EXAMPLE_DIR/run.sh || return 1
+    else
+        forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example $example $token || return 1
+    fi
+
+    if test -f $EXAMPLE_DIR/teardown.sh; then
+        echo "============================ TEARDOWN example-$example ==================="
+        bash -ex $EXAMPLE_DIR/teardown.sh || return 1
+    fi
+
+    actions_save_contexts $example
+}
+
+function actions_save_contexts() {
+    local example="$1"
+
+    if test -d /srv/example/$example/contexts; then
+        mkdir -p /srv/contexts
+        rsync -av /srv/example/$example/contexts/ /srv/contexts/$example/
+    fi
+}
+
+function actions_cleanup_example_volume() {
+    if test $(id -u) != 0; then
+        $SUDO chown $(id -u) /srv
+    fi
+
+    if ! test -d /srv/example; then
+        mkdir -p /srv/example
+        return
+    fi
+
+    $SUDO rm -fr /srv/example/*
+}
+
+function actions_setup() {
+    local version=$1
+    actions_teardown
+
+    reset_forgejo $ACTIONS_DIR/default-app.ini
+    start_forgejo $version
+
+    export FORGEJO_RUNNER_LOGS=$DIR/forgejo-runner.log
+
+    actions_cleanup_example_volume
+    export FORGEJO_RUNNER_CONFIG=$ACTIONS_DIR/runner-config.yaml
+    forgejo-runner.sh setup '' '' http://${HOST_PORT}
+}
+
+function actions_teardown() {
+    forgejo-curl.sh logout
+    forgejo-runner.sh teardown
+    stop_forgejo
+}
+
+function actions_runner_version() {
+    local runner_version=$($DIR/forgejo-runner --version | sed -n -e 's/forgejo-runner version v//p')
+    if test -z "$runner_version"; then
+        $DIR/forgejo-runner --version
+        echo failed to parse version
+        false
+    fi
+    echo $runner_version
+}
+
+function prepare_dockerd() {
+    mkdir -p /etc/systemd/system/docker.service.d
+    cat >/etc/systemd/system/docker.service.d/override.conf <<'EOF'
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/dockerd -H unix:///var/run/docker.sock -H tcp://127.0.0.1:2375 --containerd=/run/containerd/containerd.sock $DOCKER_OPTS
+EOF
+    systemctl daemon-reload
+    if ! systemctl restart docker.service; then
+        journalctl --no-pager --unit docker.service
+        return 1
+    fi
+    netstat -lntp | grep 127.0.0.1:2375
+}
+
+function test_actions() {
+    local versions="${1:-$RELEASE_NUMBERS}"
+
+    for version in $versions; do
+
+        actions_setup $version
+        local runner_version=$(actions_runner_version)
+
+        log_info "Testing actions with Forgejo $version & Forgejo runner $runner_version"
+
+        run actions_verify_example with-docker-tcp
+        if dpkg --compare-versions $runner_version gt 5.0.2; then
+            for example in with-docker-host with-docker-socket without-docker-socket; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $runner_version gt 10.0.0; then
+            run actions_verify_example force-rebuild
+        fi
+
+        if dpkg --compare-versions $version ge 7.0 && dpkg --compare-versions $runner_version gt 3.3.0; then
+            for example in artifacts-v4; do
+                run actions_verify_example $example
+            done
+        fi
+
+        for example in echo matrix needs workflow-call lxc config-options cache cache-pull-request checkout service container expression local-action docker-action if if-fail push tag push-cancel artifacts pull-request context private-workflow-call create-runner-file; do
+            run actions_verify_example $example
+        done
+
+        if dpkg --compare-versions $runner_version ge 6.3.0; then
+            run actions_verify_example cache-proxy
+        fi
+
+        if dpkg --compare-versions $runner_version ge 8.0.0; then
+            run actions_verify_example shell
+        fi
+
+        if dpkg --compare-versions $version lt 7.1; then
+            for example in cron; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $version ge 7.1; then
+            for example in automerge post-7-0-schedule; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $version ge 8.0; then
+            for example in workflow-dispatch; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $version ge 9.0; then
+            run actions_verify_example schedule-noncancel
+        fi
+
+        if dpkg --compare-versions $version ge 14.0; then
+            run actions_verify_example matrix-dynamic
+        fi
+
+        if dpkg --compare-versions $version ge 15.0; then
+            run actions_verify_example workflow-call-expansion
+            run actions_verify_example id-tokens
+        fi
+    done
+}

actions/default-app.ini

@@ -1,19 +1,24 @@
-RUN_MODE = prod
-WORK_PATH = ${WORK_PATH}
+RUN_MODE = dev
+WORK_PATH = forgejo-work-path
 
 [server]
 APP_DATA_PATH = ${WORK_PATH}/data
+DOMAIN = ${IP}
 HTTP_PORT = 3000
 SSH_LISTEN_PORT = 2222
 LFS_START_SERVER = true
 
+[queue]
+TYPE = immediate
+
 [database]
 DB_TYPE = sqlite3
+PATH = ${WORK_PATH}/forgejo.db
 
 [log]
 MODE = file
-LEVEL = debug
-ROUTER = file
+LEVEL = trace
+logger.router.MODE = file
 
 [log.file]
 FILE_NAME = forgejo.log
@@ -24,21 +29,7 @@ INSTALL_LOCK = true
 [repository]
 ENABLE_PUSH_CREATE_USER = true
 DEFAULT_PUSH_CREATE_PRIVATE = false
+DEFAULT_REPO_UNITS = repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions
 
-[attachment]
-PATH = relative-attachments
-
-[lfs]
-PATH = relative-lfs
-
-[avatar]
-PATH = relative-avatars
-
-[repo-avatar]
-PATH = relative-repo-avatars
-
-[repo-archive]
-PATH = relative-repo-archive
-
-[packages]
-PATH = relative-packages
+[actions]
+ENABLED = true

actions/example-artifacts-v4/.forgejo/workflows/test.yml

@@ -0,0 +1,47 @@
+on: [push]
+jobs:
+  upload-many:
+    runs-on: docker
+    steps:
+    - run: mkdir -p artifacts
+
+    - run: touch artifacts/ONE artifacts/TWO
+
+    - uses: https://data.forgejo.org/forgejo/upload-artifact@v4
+      with:
+        name: many-artifacts
+        path: artifacts/
+
+  download-many:
+    needs: [upload-many]
+    runs-on: docker
+    steps:
+    - uses: https://data.forgejo.org/forgejo/download-artifact@v4
+
+    - run: |
+        test -f many-artifacts/ONE
+        test -f many-artifacts/TWO
+
+  upload-one:
+    runs-on: docker
+    steps:
+    - run: mkdir -p path/to/artifact
+
+    - run: echo hello > path/to/artifact/world.txt
+
+    - uses: https://data.forgejo.org/forgejo/upload-artifact@v4
+      with:
+        name: my-artifact
+        path: path/to/artifact/world.txt
+
+  download-one:
+    needs: [upload-one]
+    runs-on: docker
+    steps:
+    - run: "! test -f world.txt"
+
+    - uses: https://data.forgejo.org/forgejo/download-artifact@v4
+      with:
+        name: my-artifact
+
+    - run: "test -f world.txt"

actions/example-automerge/.forgejo/workflows/test.yml

@@ -0,0 +1,13 @@
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+      options: "--volume /srv/example:/srv/example"
+
+    steps:
+      - run: |
+          ${{ vars.SCRIPT }}

actions/example-automerge/run.sh

@@ -0,0 +1,108 @@
+TMPDIR=$(mktemp -d)
+
+trap "rm -fr $TMPDIR" EXIT
+
+source $EXAMPLE_DIR/../../lib/lib.sh
+
+api=$url/api/v1
+repo=root/example-automerge
+export d=/srv/example/automerge
+
+function reset_automerge_pr() {
+    #
+    # repository with a pull_request event workflow that always succeeds
+    #
+    mkdir -p $d
+
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repo >&/dev/null || true
+    forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repo/actions/variables/SCRIPT >&/dev/null || true
+    forgejo-curl.sh api_json -X POST --data-raw '{"value":"true"}' $api/repos/$repo/actions/variables/SCRIPT
+
+    (
+        cd $d
+        rm -fr example-automerge
+        git clone $url/$repo
+        cd example-automerge
+        git checkout -b other
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-pr-branch
+        echo other >>README
+        git add .
+        git commit -m 'other change'
+        git push --force -u origin other
+    )
+
+    #
+    # make sure the runner won't race with the sequence that follows
+    #
+    forgejo-runner.sh teardown
+    #
+    # create a PR and schedule it for automerge when the workflow succeeds
+    #
+    api_pr_delete_all $api $repo
+    forgejo-curl.sh api_json --data-raw '{"title":"PR title","base":"main","head":"other"}' $api/repos/$repo/pulls >$TMPDIR/pr.json
+    local pr=$(jq -r .number <$TMPDIR/pr.json)
+    forgejo-curl.sh api_json --data-raw '{"Do":"merge","merge_when_checks_succeed":true}' $api/repos/$repo/pulls/$pr/merge
+    if api_pr_is_merged $api $repo $pr; then
+        echo pull request already merged although it should not be
+        return 1
+    fi
+}
+
+function verify_automerge_on_status_success() {
+    reset_automerge_pr
+    local pr=$(jq -r .number <$TMPDIR/pr.json)
+    #
+    # run the workflow
+    #
+    forgejo-runner.sh run
+    local sha=$(api_branch_tip $api $repo other)
+    api_pr_wait_success $api $repo $sha
+    #
+    # verify the PR was automerged
+    #
+    if ! retry api_pr_is_merged $api $repo $pr; then
+        echo pull request is not automerged as expected
+        return 1
+    fi
+}
+
+function verify_automerge_on_reviewer_approval() {
+    reset_automerge_pr
+    local pr=$(jq -r .number <$TMPDIR/pr.json)
+    #
+    # require at least one review for a PR to be merged
+    #
+    api_branch_protect $api $repo main
+    #
+    # run the workflow
+    #
+    forgejo-runner.sh run
+    local sha=$(api_branch_tip $api $repo other)
+    api_pr_wait_success $api $repo $sha
+    #
+    # approve the PR
+    #
+    local username=user1
+    api_user_create $api $username $username@example.com
+    api_user_make_admin $api $username
+    user_login $username
+    DOT=$API_TMPDIR/$username api_pr_approve $api $repo $pr
+    #
+    # verify the PR was automerged
+    #
+    if ! retry api_pr_is_merged $api $repo $pr; then
+        echo pull request is not automerged as expected
+        return 1
+    fi
+}
+
+function main() {
+    verify_automerge_on_status_success
+    verify_automerge_on_reviewer_approval
+}
+
+main

actions/example-automerge/setup.sh

@@ -0,0 +1 @@
+mkdir -p /srv/example/automerge

actions/example-cache-proxy/getter/.forgejo/workflows/get.yml

@@ -0,0 +1,25 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: thecoolsecretcachekey
+
+      - name: verify something
+        run: |
+          set -x
+          test SOMETHING = $(cat /usr/local/bin/something)
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep.outputs.cache-hit }}" = true

actions/example-cache-proxy/run.sh

@@ -0,0 +1,22 @@
+source $EXAMPLE_DIR/../../lib/lib.sh
+
+api=$url/api/v1
+repostorer=root/example-cache-proxy-storer
+repogetter=root/example-cache-proxy-getter
+
+function main() {
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repostorer >&/dev/null || true
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repogetter >&/dev/null || true
+
+    forgejo-test-helper.sh push_workflow actions/example-$example/storer $url root example-$example-storer setup-forgejo $token
+    local shastorer=$(forgejo-test-helper.sh branch_tip $url $repostorer main)
+
+    forgejo-test-helper.sh wait_success $url $repostorer $shastorer
+
+    forgejo-test-helper.sh push_workflow actions/example-$example/getter $url root example-$example-getter setup-forgejo $token
+    local shagetter=$(forgejo-test-helper.sh branch_tip $url $repogetter main)
+    
+    forgejo-test-helper.sh wait_failure $url $repogetter $shagetter
+}
+
+main

actions/example-cache-proxy/runner-config.yaml

@@ -0,0 +1,29 @@
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cache-proxy/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-cache-proxy/storer/.forgejo/workflows/store.yml

@@ -0,0 +1,17 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: create something
+        run: echo SOMETHING > /usr/local/bin/something
+
+      - name: cache save
+        uses: https://data.forgejo.org/actions/cache/save@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: thecoolsecretcachekey

actions/example-cache-proxy/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-cache-pull-request/.forgejo/workflows/test.yml

@@ -0,0 +1,96 @@
+on:
+  pull_request:
+    types:
+      - opened
+      - closed
+
+jobs:
+  save-cache:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep1
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey-${{ forge.event.pull_request.head.repo.full_name }}
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep1.outputs.cache-hit }}" != true
+
+      - name: create something
+        run: echo SOMETHING > /usr/local/bin/something
+
+      - name: cache save
+        uses: https://data.forgejo.org/actions/cache/save@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: ${{ steps.cachestep1.outputs.cache-primary-key }}
+
+  restore-cache:
+    runs-on: docker
+    needs: [save-cache]
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep2
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey-${{ forge.event.pull_request.head.repo.full_name }}
+
+      - name: verify something
+        run: |
+          set -x
+          test SOMETHING = $(cat /usr/local/bin/something)
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep2.outputs.cache-hit }}" = true
+
+  test:
+    runs-on: docker
+    needs: [restore-cache]
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+      options: "--volume /srv/example:/srv/example"
+
+    steps:
+      - name: setup
+        shell: bash
+        run: |
+          set -x
+          test $FORGEJO_TOKEN = ${{ env.FORGEJO_TOKEN }}
+          test $FORGEJO_TOKEN = ${{ forge.token }}
+          export DEBIAN_FRONTEND=noninteractive ; apt-get -qq update ; apt-get install -y -qq curl git >& /dev/null
+          curl -sS -o /usr/local/bin/forgejo-curl.sh https://code.forgejo.org/forgejo/forgejo-curl/raw/branch/main/forgejo-curl.sh && chmod +x /usr/local/bin/forgejo-curl.sh
+          forgejo-curl.sh --token "$FORGEJO_TOKEN" login $FORGEJO_SERVER_URL
+          forgejo-curl.sh api_json $FORGEJO_SERVER_URL/api/v1/user
+
+      - name: determine if the PR is from a fork
+        id: forked
+        run: |
+          set -x
+          if test ${{ forge.event.pull_request.base.repo.full_name }} = ${{ forge.event.pull_request.head.repo.full_name }} ; then
+            echo value=false >> $FORGEJO_OUTPUT
+          else
+            echo value=true >> $FORGEJO_OUTPUT
+          fi
+
+      - name: save event
+        run: |
+          set -x
+          d=/srv/example/cache-pull-request/contexts/${{ forgejo.event.pull_request.head.repo.owner.username }}/$FORGEJO_EVENT_NAME
+          mkdir -p $d
+          cat > $d/forgejo-${{ forgejo.event.action }} <<'EOF'
+          ${{ toJSON(forgejo) }}
+          EOF

actions/example-cache-pull-request/assert-contexts-closed.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -ex
+
+c=$d/contexts
+
+for user in cache-fork-org root; do
+    test -f $c/$user/pull_request/forgejo-closed
+done

actions/example-cache-pull-request/assert-contexts-opened.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -ex
+
+c=$d/contexts
+
+for user in cache-fork-org root; do
+    test -f $c/$user/pull_request/forgejo-opened
+done

actions/example-cache-pull-request/run.sh

@@ -0,0 +1,80 @@
+TMPDIR=$(mktemp -d)
+
+trap "rm -fr $TMPDIR" EXIT
+
+api=$url/api/v1
+export d=/srv/example/cache-pull-request
+
+function main() {
+    mkdir -p $d
+
+    #
+    # open a pull request
+    # - from the same repository
+    # - from a forked repository
+    #
+    forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+    forgejo-curl.sh api_json --data-raw '{"username":"cache-fork-org"}' $api/orgs
+    forgejo-curl.sh api_json --data-raw '{"organization":"cache-fork-org"}' $api/repos/root/example-cache-pull-request/forks
+
+    (
+        cd $d
+        git clone $url/cache-fork-org/example-cache-pull-request fork
+        cd fork
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-pr-branch
+        git add .
+        git commit -m 'fork change'
+        git push
+    )
+
+    forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR from fork","base":"main","head":"cache-fork-org:main"}' $api/repos/root/example-cache-pull-request/pulls
+
+    (
+        cd $d
+        git clone $url/root/example-cache-pull-request
+        cd example-cache-pull-request
+        git checkout -b other
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-forked-pr
+        git add .
+        git commit -m 'other change'
+        git push --force -u origin other
+    )
+
+    forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR same repo","base":"main","head":"other"}' $api/repos/root/example-cache-pull-request/pulls
+
+    export RETRY_DELAYS="10 20 60 60 60 60 60"
+
+    #
+    # wait for the opened event to succeed using the cache on all pull requests
+    #
+    if ! forgejo.sh retry $EXAMPLE_DIR/assert-contexts-opened.sh; then
+        echo "assert-contexts-opened.sh failed; printing related logs and information:"
+        find $d
+        sed -e 's/^/[RUNNER LOGS]/' <$FORGEJO_RUNNER_LOGS
+        return 1
+    fi
+
+    #
+    # merge all pull requests
+    #
+    forgejo-curl.sh api_json $api/repos/root/example-cache-pull-request/pulls | jq -r '.[] | .number' | while read pr; do
+        forgejo-curl.sh api_json --data-raw '{"Do":"merge"}' $api/repos/root/example-cache-pull-request/pulls/$pr/merge
+    done
+
+    #
+    # wait for the closed event to succeed using the cache on all pull requests
+    #
+    if ! forgejo.sh retry $EXAMPLE_DIR/assert-contexts-closed.sh; then
+        echo "assert-contexts-closed.sh failed; printing related logs and information:"
+        find $d
+        sed -e 's/^/[RUNNER LOGS]/' <$FORGEJO_RUNNER_LOGS
+        return 1
+    fi
+}
+
+main

actions/example-cache-pull-request/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cache-pull-request/setup.sh

@@ -0,0 +1,2 @@
+mkdir -p /srv/example/cache-pull-request
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-cache-pull-request/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-cache/.forgejo/workflows/test.yml

@@ -0,0 +1,54 @@
+on: [push]
+
+jobs:
+  save-cache:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep1
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep1.outputs.cache-hit }}" != true
+
+      - name: create something
+        run: echo SOMETHING > /usr/local/bin/something
+
+      - name: cache save
+        uses: https://data.forgejo.org/actions/cache/save@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: ${{ steps.cachestep1.outputs.cache-primary-key }}
+
+  restore-cache:
+    runs-on: docker
+    needs: [save-cache]
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep2
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey
+
+      - name: verify something
+        run: |
+          set -x
+          test SOMETHING = $(cat /usr/local/bin/something)
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep2.outputs.cache-hit }}" = true

actions/example-cache/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cache/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-cache/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-config-options/.forgejo/workflows/test.yml

@@ -0,0 +1,26 @@
+on: [push]
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+        options: "--hostname customname"
+    steps:
+    - run: |
+            test -f /srv/example-config-options-volume-valid
+    - run: |
+            ! test -w /srv/example-config-options-volume-valid
+    - run: |
+            ! test -f /srv/example-config-options-volume-invalid
+    - run: |
+            set -x
+            test "$FROB" = "NITZ"
+    - run: |
+            set -x
+            test "$VAR_FROM_ENV_FILE" = "VALUE_FROM_ENV_FILE"
+    - run: |
+            set -x
+            test "$VAR_FROM_ENV_IN_CONFIG" = "VALUE_FROM_ENV_IN_CONFIG"
+    - run: |
+            set -x
+            test "$(cat /etc/hostname)" = customname

actions/example-config-options/env_file

@@ -0,0 +1 @@
+VAR_FROM_ENV_FILE=VALUE_FROM_ENV_FILE

actions/example-config-options/runner-config.yaml

@@ -0,0 +1,33 @@
+
+log:
+  level: debug
+  job_level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  envs:
+      VAR_FROM_ENV_IN_CONFIG: VALUE_FROM_ENV_IN_CONFIG
+  env_file: env_file
+  timeout: 3h
+  insecure: true
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: ""
+  privileged: false
+  options: "--volume /srv/example-config-options-volume-valid:/srv/example-config-options-volume-valid:ro --volume /srv/example-config-options-volume-invalid:/srv/example-config-options-volume-invalid --env FROB=NITZ"
+  workdir_parent:
+  valid_volumes: ["/srv/example-config-options-volume-valid"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-config-options/setup.sh

@@ -0,0 +1,6 @@
+>/srv/example-config-options-volume-valid
+>/srv/example-config-options-volume-invalid
+TMPDIR=$(mktemp -d)
+cp $EXAMPLE_DIR/runner-config.yaml $EXAMPLE_DIR/env_file $TMPDIR
+sed -i -e "s|env_file:.*|env_file: $TMPDIR/env_file|" $TMPDIR/runner-config.yaml
+FORGEJO_RUNNER_CONFIG=$TMPDIR/runner-config.yaml forgejo-runner.sh reload

actions/example-config-options/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-container/.forgejo/workflows/test.yml

@@ -3,6 +3,6 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: alpine:3.19
+      image: data.forgejo.org/oci/alpine:3.23
     steps:
       - run: grep Alpine /etc/os-release

actions/example-context/.forgejo/workflows/test.yml

@@ -4,7 +4,7 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       volumes:
         - /srv/example:/srv/example
     steps:
@@ -15,174 +15,240 @@ jobs:
           test "$CI" = true
           test "$CI" = "${{ env.CI }}"
 
-      - name: GITHUB_ACTION
+      - name: FORGEJO_ACTION
         run: |
           set -x
-          echo "$GITHUB_ACTION" | grep -E '^[0-9]+$'
-          test "$GITHUB_ACTION" = "${{ env.GITHUB_ACTION }}"
-          test "$GITHUB_ACTION" = "${{ github.ACTION }}"
+          echo "$FORGEJO_ACTION" | grep -E '^[0-9]+$'
+          test "$FORGEJO_ACTION" = "${{ env.FORGEJO_ACTION }}"
+          test "$FORGEJO_ACTION" = "${{ github.ACTION }}"
+          test "$FORGEJO_ACTION" = "${{ forge.ACTION }}"
+          test "$FORGEJO_ACTION" = "${{ forgejo.ACTION }}"
+          test "$FORGEJO_ACTION" = "$GITHUB_ACTION"
 
       # See also actions/example-local-action/.forgejo/local-action/action.yml
-      - name: GITHUB_ACTION_PATH
+      - name: FORGEJO_ACTION_PATH
         run: |
           set -x
-          test -z "$GITHUB_ACTION_PATH"
-          test "$GITHUB_ACTION_PATH" = "${{ env.GITHUB_ACTION_PATH }}"
-          test "$GITHUB_ACTION_PATH" = "${{ github.ACTION_PATH }}"
+          test -z "$FORGEJO_ACTION_PATH"
+          test "$FORGEJO_ACTION_PATH" = "${{ env.FORGEJO_ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "${{ github.ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "${{ forge.ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "${{ forgejo.ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "$GITHUB_ACTION_PATH"
 
       - name: when running an action
-        if: ${{ env.GITHUB_ACTIONS }}
+        if: ${{ env.FORGEJO_ACTIONS }}
         uses: SELF@main
         with:
           input-one: "otherone"
 
-      - name: GITHUB_ACTION_REPOSITORY
-        run: test -f /srv/example/example-context/GITHUB_ACTION_REPOSITORY
+      - name: FORGEJO_ACTION_REPOSITORY
+        run: test -f /srv/example/example-context/FORGEJO_ACTION_REPOSITORY
 
-      - name: GITHUB_ACTION_PATH
-        run: test -f /srv/example/example-context/GITHUB_ACTION_PATH
+      - name: FORGEJO_ACTION_PATH
+        run: test -f /srv/example/example-context/FORGEJO_ACTION_PATH
 
-      - name: GITHUB_ACTIONS
+      - name: FORGEJO_ACTIONS
         run: |
           set -x
-          test "$GITHUB_ACTIONS" = true
-          test "$GITHUB_ACTIONS" = "${{ env.GITHUB_ACTIONS }}"
+          test "$FORGEJO_ACTIONS" = true
+          test "$FORGEJO_ACTIONS" = "${{ env.FORGEJO_ACTIONS }}"
+          test "$FORGEJO_ACTIONS" = "$GITHUB_ACTIONS"
 
-      - name: GITHUB_ACTOR
+      - name: FORGEJO_ACTOR
         run: |
           set -x
-          test "$GITHUB_ACTOR"
-          test "$GITHUB_ACTOR" = "${{ env.GITHUB_ACTOR }}"
-          test "$GITHUB_ACTOR" = "${{ github.ACTOR }}"
+          test "$FORGEJO_ACTOR"
+          test "$FORGEJO_ACTOR" = "${{ env.FORGEJO_ACTOR }}"
+          test "$FORGEJO_ACTOR" = "${{ github.ACTOR }}"
+          test "$FORGEJO_ACTOR" = "${{ forge.ACTOR }}"
+          test "$FORGEJO_ACTOR" = "${{ forgejo.ACTOR }}"
+          test "$FORGEJO_ACTOR" = "$GITHUB_ACTOR"
 
-      - name: GITHUB_API_URL
+      - name: FORGEJO_API_URL
         shell: bash
         run: |
           set -x
-          [[ "$GITHUB_API_URL" =~ /api/v1$ ]]
-          test "$GITHUB_API_URL" = "${{ env.GITHUB_API_URL }}"
-          test "$GITHUB_API_URL" = "${{ github.API_URL }}"
+          [[ "$FORGEJO_API_URL" =~ /api/v1$ ]]
+          test "$FORGEJO_API_URL" = "${{ env.FORGEJO_API_URL }}"
+          test "$FORGEJO_API_URL" = "${{ github.API_URL }}"
+          test "$FORGEJO_API_URL" = "${{ forge.API_URL }}"
+          test "$FORGEJO_API_URL" = "${{ forgejo.API_URL }}"
+          test "$FORGEJO_API_URL" = "$GITHUB_API_URL"
 
       # See also actions/example-pull-request/.forgejo/workflows/test.yml
-      - name: GITHUB_BASE_REF
+      - name: FORGEJO_BASE_REF
         run: |
           set -x
-          test -z "$GITHUB_BASE_REF"
-          test "$GITHUB_BASE_REF" = "${{ env.GITHUB_BASE_REF }}"
-          test "$GITHUB_BASE_REF" = "${{ github.BASE_REF }}"
+          test -z "$FORGEJO_BASE_REF"
+          test "$FORGEJO_BASE_REF" = "${{ env.FORGEJO_BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "${{ github.BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "${{ forge.BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "${{ forgejo.BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "$GITHUB_BASE_REF"
 
       # See also actions/example-pull-request/.forgejo/workflows/test.yml
-      - name: GITHUB_HEAD_REF
+      - name: FORGEJO_HEAD_REF
         run: |
           set -x
-          test -z "$GITHUB_HEAD_REF"
-          test "$GITHUB_HEAD_REF" = "${{ env.GITHUB_HEAD_REF }}"
-          test "$GITHUB_HEAD_REF" = "${{ github.HEAD_REF }}"
+          test -z "$FORGEJO_HEAD_REF"
+          test "$FORGEJO_HEAD_REF" = "${{ env.FORGEJO_HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ github.HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ forge.HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ forgejo.HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "$GITHUB_HEAD_REF"
 
-      - name: GITHUB_ENV
+      - name: FORGEJO_ENV
         run: |
           set -x
-          test -f "$GITHUB_ENV"
-          test "$GITHUB_ENV" = "${{ env.GITHUB_ENV }}"
+          test -f "$FORGEJO_ENV"
+          test "$FORGEJO_ENV" = "${{ env.FORGEJO_ENV }}"
+          test "$FORGEJO_ENV" = "$GITHUB_ENV"
 
-      - name: GITHUB_EVENT_NAME
+      - name: FORGEJO_EVENT_NAME
         run: |
           set -x
-          test "$GITHUB_EVENT_NAME" = push
-          test "$GITHUB_EVENT_NAME" = "${{ env.GITHUB_EVENT_NAME }}"
-          test "$GITHUB_EVENT_NAME" = "${{ github.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = push
+          test "$FORGEJO_EVENT_NAME" = "${{ env.FORGEJO_EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "${{ github.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "${{ forge.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "${{ forgejo.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "$GITHUB_EVENT_NAME"
 
-      - name: GITHUB_JOB
+      - name: FORGEJO_JOB
         run: |
           set -x
-          test "$GITHUB_JOB" = test
-          test "$GITHUB_JOB" = "${{ env.GITHUB_JOB }}"
-          test "$GITHUB_JOB" = "${{ github.JOB }}"
+          test "$FORGEJO_JOB" = test
+          test "$FORGEJO_JOB" = "${{ env.FORGEJO_JOB }}"
+          test "$FORGEJO_JOB" = "${{ github.JOB }}"
+          test "$FORGEJO_JOB" = "${{ forge.JOB }}"
+          test "$FORGEJO_JOB" = "${{ forgejo.JOB }}"
+          test "$FORGEJO_JOB" = "$GITHUB_JOB"
 
-      - name: GITHUB_OUTPUT
+      - name: FORGEJO_OUTPUT
         run: |
           set -x
-          test -f "$GITHUB_OUTPUT"
-          test "$GITHUB_OUTPUT" = "${{ env.GITHUB_OUTPUT }}"
+          test -f "$FORGEJO_OUTPUT"
+          test "$FORGEJO_OUTPUT" = "${{ env.FORGEJO_OUTPUT }}"
+          test "$FORGEJO_OUTPUT" = "$GITHUB_OUTPUT"
 
-      - name: GITHUB_PATH
+      - name: FORGEJO_PATH
         run: |
           set -x
-          test -f "$GITHUB_PATH"
-          test "$GITHUB_PATH" = "${{ env.GITHUB_PATH }}"
+          test -f "$FORGEJO_PATH"
+          test "$FORGEJO_PATH" = "${{ env.FORGEJO_PATH }}"
+          test "$FORGEJO_PATH" = "$GITHUB_PATH"
 
-      - name: GITHUB_REF
+      - name: FORGEJO_REF
         shell: bash
         run: |
           set -x
-          [[ "$GITHUB_REF" =~ ^refs/ ]]
-          test "$GITHUB_REF" = "${{ env.GITHUB_REF }}"
-          test "$GITHUB_REF" = "${{ github.REF }}"
+          [[ "$FORGEJO_REF" =~ ^refs/ ]]
+          test "$FORGEJO_REF" = "${{ env.FORGEJO_REF }}"
+          test "$FORGEJO_REF" = "${{ github.REF }}"
+          test "$FORGEJO_REF" = "${{ forge.REF }}"
+          test "$FORGEJO_REF" = "${{ forgejo.REF }}"
+          test "$FORGEJO_REF" = "$GITHUB_REF"
 
-      - name: GITHUB_REF_NAME
+      - name: FORGEJO_REF_NAME
         shell: bash
         run: |
           set -x
-          ! [[ "$GITHUB_REF_NAME" =~ ^refs/ ]]
-          test "$GITHUB_REF_NAME" = "${{ env.GITHUB_REF_NAME }}"
-          test "$GITHUB_REF_NAME" = "${{ github.REF_NAME }}"
+          ! [[ "$FORGEJO_REF_NAME" =~ ^refs/ ]]
+          test "$FORGEJO_REF_NAME" = "${{ env.FORGEJO_REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "${{ github.REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "${{ forge.REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "${{ forgejo.REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "$GITHUB_REF_NAME"
 
-      - name: GITHUB_REPOSITORY
+      - name: FORGEJO_REPOSITORY
         run: |
           set -x
-          test "$GITHUB_REPOSITORY" = root/example-context
-          test "$GITHUB_REPOSITORY" = "${{ env.GITHUB_REPOSITORY }}"
-          test "$GITHUB_REPOSITORY" = "${{ github.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = root/example-context
+          test "$FORGEJO_REPOSITORY" = "${{ env.FORGEJO_REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "${{ github.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "${{ forge.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "${{ forgejo.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "$GITHUB_REPOSITORY"
 
-      - name: GITHUB_REPOSITORY_OWNER
+      - name: FORGEJO_REPOSITORY_OWNER
         run: |
           set -x
-          test "$GITHUB_REPOSITORY_OWNER" = root
-          test "$GITHUB_REPOSITORY_OWNER" = "${{ env.GITHUB_REPOSITORY_OWNER }}"
-          test "$GITHUB_REPOSITORY_OWNER" = "${{ github.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = root
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ env.FORGEJO_REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ github.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ forge.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ forgejo.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "$GITHUB_REPOSITORY_OWNER"
 
-      - name: GITHUB_RUN_NUMBER
+      - name: FORGEJO_RUN_NUMBER
         run: |
           set -x
-          echo "$GITHUB_RUN_NUMBER" | grep -E '^[0-9]+$'
-          test "$GITHUB_RUN_NUMBER" = "${{ env.GITHUB_RUN_NUMBER }}"
-          test "$GITHUB_RUN_NUMBER" = "${{ github.RUN_NUMBER }}"
+          echo "$FORGEJO_RUN_NUMBER" | grep -E '^[0-9]+$'
+          test "$FORGEJO_RUN_NUMBER" = "${{ env.FORGEJO_RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "${{ github.RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "${{ forge.RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "${{ forgejo.RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "$GITHUB_RUN_NUMBER"
 
-      - name: GITHUB_SERVER_URL
+      - name: FORGEJO_RUN_ID
+        run: |
+          set -x
+          echo "$FORGEJO_RUN_ID" | grep -E '^[0-9]+$'
+          test "$FORGEJO_RUN_ID" = "${{ env.FORGEJO_RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "${{ github.RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "${{ forge.RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "${{ forgejo.RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "$GITHUB_RUN_ID"
+
+      - name: FORGEJO_SERVER_URL
         shell: bash
         run: |
           set -x
-          [[ "$GITHUB_SERVER_URL" =~ ^http ]]
-          test "$GITHUB_SERVER_URL" = "${{ env.GITHUB_SERVER_URL }}"
-          test "$GITHUB_SERVER_URL" = "${{ github.SERVER_URL }}"
+          [[ "$FORGEJO_SERVER_URL" =~ ^http ]]
+          test "$FORGEJO_SERVER_URL" = "${{ env.FORGEJO_SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "${{ github.SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "${{ forge.SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "${{ forgejo.SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "$GITHUB_SERVER_URL"
 
-      - name: GITHUB_SHA
+      - name: FORGEJO_SHA
         run: |
           set -x
-          test "$GITHUB_SHA"
-          test "$GITHUB_SHA" = "${{ env.GITHUB_SHA }}"
-          test "$GITHUB_SHA" = "${{ github.SHA }}"
+          test "$FORGEJO_SHA"
+          test "$FORGEJO_SHA" = "${{ env.FORGEJO_SHA }}"
+          test "$FORGEJO_SHA" = "${{ github.SHA }}"
+          test "$FORGEJO_SHA" = "${{ forge.SHA }}"
+          test "$FORGEJO_SHA" = "${{ forgejo.SHA }}"
+          test "$FORGEJO_SHA" = "$GITHUB_SHA"
 
-      - name: GITHUB_STEP_SUMMARY
+      - name: FORGEJO_STEP_SUMMARY
         run: |
           set -x
-          test -f "$GITHUB_STEP_SUMMARY"
-          test "$GITHUB_STEP_SUMMARY" = "${{ env.GITHUB_STEP_SUMMARY }}"
+          test -f "$FORGEJO_STEP_SUMMARY"
+          test "$FORGEJO_STEP_SUMMARY" = "${{ env.FORGEJO_STEP_SUMMARY }}"
+          test "$FORGEJO_STEP_SUMMARY" = "$GITHUB_STEP_SUMMARY"
 
       # See also actions/example-pull-request/.forgejo/workflows/test.yml
-      - name: GITHUB_TOKEN
+      - name: FORGEJO_TOKEN
         run: |
           set -x
-          test "$GITHUB_TOKEN"
-          test "$GITHUB_TOKEN" = "${{ env.GITHUB_TOKEN }}"
-          test "$GITHUB_TOKEN" = "${{ github.TOKEN }}"
+          test "$FORGEJO_TOKEN"
+          test "$FORGEJO_TOKEN" = "${{ env.FORGEJO_TOKEN }}"
+          test "$FORGEJO_TOKEN" = "${{ github.TOKEN }}"
+          test "$FORGEJO_TOKEN" = "${{ forge.TOKEN }}"
+          test "$FORGEJO_TOKEN" = "${{ forgejo.TOKEN }}"
+          test "$FORGEJO_TOKEN" = "$GITHUB_TOKEN"
 
-      - name: GITHUB_WORKSPACE
+      - name: FORGEJO_WORKSPACE
         run: |
           set -x
-          test -d "$GITHUB_WORKSPACE"
-          test "$GITHUB_WORKSPACE" = "${{ env.GITHUB_WORKSPACE }}"
-          test "$GITHUB_WORKSPACE" = "${{ github.WORKSPACE }}"
+          test -d "$FORGEJO_WORKSPACE"
+          test "$FORGEJO_WORKSPACE" = "${{ env.FORGEJO_WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "${{ github.WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "${{ forge.WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "${{ forgejo.WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "$GITHUB_WORKSPACE"
 
       - name: RUNNER_ARCH
         run: |
@@ -194,11 +260,10 @@ jobs:
           set -x
           test "$RUNNER_OS" = Linux
 
-      # runner 3.3.0 $RUNNER_TOOL_CACHE is not an existing directory
-      # - name: RUNNER_TOOL_CACHE
-      #   run: |
-      #     set -x
-      #     test -d "$RUNNER_TOOL_CACHE"
+      - name: RUNNER_TOOL_CACHE
+        run: |
+          set -x
+          test "$RUNNER_TOOL_CACHE"
 
       - name: RUNNER_TEMP
         run: |

actions/example-context/action-for-context/action.yml

@@ -6,18 +6,27 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: GITHUB_ACTION_REPOSITORY
+    - name: FORGEJO_ACTION_REPOSITORY
       run: |
         set -x
-        test "$GITHUB_ACTION_REPOSITORY" = root/action-for-context
-        test "$GITHUB_ACTION_REPOSITORY" = "${{ env.GITHUB_ACTION_REPOSITORY }}"
-        test "$GITHUB_ACTION_REPOSITORY" = "${{ github.ACTION_REPOSITORY }}"
-        touch /srv/example/example-context/GITHUB_ACTION_REPOSITORY
+        test "$FORGEJO_ACTION_REPOSITORY" = root/action-for-context
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ env.FORGEJO_ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ github.ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ forge.ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ forgejo.ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "$GITHUB_ACTION_REPOSITORY"
+        touch /srv/example/example-context/FORGEJO_ACTION_REPOSITORY
 
-    - name: GITHUB_ACTION_PATH
+    - name: FORGEJO_ACTION_PATH
       shell: bash
       run: |
         set -x
-        [[ "$GITHUB_ACTION_PATH" =~ action-for-context@main$ ]]
-        test "$GITHUB_ACTION_PATH" = "${{ github.ACTION_PATH }}"
-        touch /srv/example/example-context/GITHUB_ACTION_PATH
+        # prior to Forgejo runner 8.0.0 the action path is built out of the file path.
+        # with Forgejo runner 8.0.0 and above is it a 64 character hash string
+        # e.g. /var/run/act/actions/1b/5c1802fa47e35716c2a0977bc907049d31aef29191cba400011c0b38b52d12
+        [[ "$FORGEJO_ACTION_PATH" =~ action-for-context@main$ ]] || [[ "$FORGEJO_ACTION_PATH" =~ /[0-9a-f]{2}/[0-9a-f]{62}$ ]]
+        test "$FORGEJO_ACTION_PATH" = "${{ github.ACTION_PATH }}"
+        test "$FORGEJO_ACTION_PATH" = "${{ forge.ACTION_PATH }}"
+        test "$FORGEJO_ACTION_PATH" = "${{ forgejo.ACTION_PATH }}"
+        test "$FORGEJO_ACTION_PATH" = "$GITHUB_ACTION_PATH"
+        touch /srv/example/example-context/FORGEJO_ACTION_PATH

actions/example-create-runner-file/.forgejo/workflows/test.yaml

@@ -0,0 +1,9 @@
+on:
+  push:
+
+jobs:
+  test:
+    runs-on: create-runner-file
+    steps:
+      - run: |
+          echo "OK"

actions/example-create-runner-file/run.sh

@@ -0,0 +1,40 @@
+source "lib/lib.sh"
+
+api="$url/api/v1"
+
+function main() {
+    local repo
+    repo="root/example-$example"
+
+    secret="$(openssl rand -hex 20)"
+    runner_name="runner-$(openssl rand -hex 5)"
+
+    create_offline_registration_token "$runner_name" root "$secret"
+
+    # Changing to $DIR is necessary so that `.runner` gets created there. Otherwise, `forgejo-runner` would not pick it up.
+    pushd "$DIR" || exit 1
+    ./forgejo-runner -c "$EXAMPLE_DIR/runner-config.yaml" create-runner-file --instance "http://$IP:3000" --name "$runner_name" --secret "$secret" --connect
+    popd || exit 1
+
+    FORGEJO_RUNNER_CONFIG="$EXAMPLE_DIR/runner-config.yaml" forgejo-runner.sh reload
+
+    label_count=$(jq '.labels | length ' "$DIR/.runner")
+    if [[ "$label_count" != "1" ]] ; then
+      echo "Unexpected number of labels in .runner file: $label_count instead of 1" >&2
+      exit 1
+    fi
+
+    runner_label=$(jq -r '.labels[0]' "$DIR/.runner")
+    if [[ "$runner_label" != "create-runner-file:docker://code.forgejo.org/oci/node:24-trixie" ]] ; then
+      echo "Unexpected runner label: '$runner_label' instead of create-runner-file:docker://code.forgejo.org/oci/node:24-trixie" >&2
+      exit 1
+    fi
+
+    forgejo-test-helper.sh push_workflow "actions/example-$example" "$url" root "example-$example" setup-forgejo "$token"
+
+    local sha
+    sha="$(forgejo-test-helper.sh branch_tip "$url" "$repo" main)"
+    forgejo-test-helper.sh wait_success "$url" "$repo" "$sha"
+}
+
+main

actions/example-create-runner-file/runner-config.yaml

@@ -0,0 +1,31 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+    - "create-runner-file:docker://code.forgejo.org/oci/node:24-trixie"
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cron/.forgejo/workflows/test.yml

@@ -6,17 +6,17 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example:/srv/example"
 
     steps:
-      - run: |
-          touch /srv/example/cron-volume/DONE
-
       - name: save context
         run: |
-          d=/srv/example/cron/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/cron/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}
           EOF
+
+      - run: |
+          touch /srv/example/cron-volume/DONE

actions/example-cron/run.sh

@@ -7,7 +7,7 @@ forgejo-test-helper.sh push_workflow actions/example-$example $url root example-
 # See https://codeberg.org/forgejo/forgejo/pulls/1941 for more information
 #
 function verify_ref() {
-    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db  'select ref from action_schedule')
+    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db 'select ref from action_schedule')
     test "${ref##*/}" = "main"
 }
 verify_ref
@@ -16,12 +16,12 @@ forgejo-curl.sh api_json --data '{"new_branch_name":"zzzz"}' $api/repos/root/exa
 verify_ref
 
 # cron runs once per minute, give it three minutes max before declaring failure
-if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/cron-volume/DONE ; then
+if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/cron-volume/DONE; then
     cat $FORGEJO_RUNNER_LOGS
     false
 fi
 
 c=/srv/example/cron/contexts/schedule/github
 cat $c
-test "schedule" = "$(jq -r .event_name < $c)"
-test "schedule" = "$(jq -r .event.action < $c)"
+test "schedule" = "$(jq -r .event_name <$c)"
+test "schedule" = "$(jq -r .event.action <$c)"

actions/example-docker-action/.forgejo/workflows/test.yml

@@ -9,11 +9,11 @@ jobs:
       #
       - uses: https://code.forgejo.org/forgejo/test-setup-forgejo-docker@main
         with:
-          args: ${{ github.workspace }}/SOMEFILE
+          args: ${{ forgejo.workspace }}/SOMEFILE
       #
       # ... which then also exists in the job workspace
       # because both docker containers are automatically
       # sharing the volume that contains it.
       #
       - run: |
-          test -f ${{ github.workspace }}/SOMEFILE
+          test -f ${{ forgejo.workspace }}/SOMEFILE

actions/example-expression/.forgejo/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
         if: ${{ env.KEY1 == 'nogood' }}
       - name: if does not skip
         id: conditional
-        run: echo 'check=good' >> $GITHUB_OUTPUT
+        run: echo 'check=good' >> $FORGEJO_OUTPUT
         if: env.KEY1 == 'value1'
       - name: verify if did not skip
         run: test ${{ steps.conditional.outputs.check }} = good
@@ -98,10 +98,11 @@ jobs:
           set -x
           test "${{ fromJSON('["one","two"]')[0] }}" = 'one'
 
-      # As of act v1.13.0 this fails for real (before it pretended to work but did not)
-      # - name: hashFiles
-      #   run: |
-      #     set -x
-      #     hash="bd52020371c038c4ad38a8d2df05dfa1a220d40fbe1ae83b63d6010cb527e531"
-      #     test "${{ hashFiles('actions/example-expression/.forgejo/fileone.txt') }}" = $hash
-      #     test "${{ hashFiles('actions/example-expression/.forgejo/fileone.*') }}" = $hash
+      - uses: actions/checkout@v4
+
+      - name: hashFiles
+        run: |
+          set -x
+          hash="aea6ca2329c852f5b480ec35e1fe09d39a6bd1b50f4f9cc38fbd4fef870dc107"
+          test "${{ hashFiles('.forgejo/fileone.txt') }}" = $hash
+          test "${{ hashFiles('.forgejo/fileone.*') }}" = $hash

actions/example-force-rebuild/.forgejo/workflows/test.yml

@@ -0,0 +1,11 @@
+on: [push]
+
+jobs:
+  ls:
+    runs-on: docker
+    steps:
+      - uses: https://code.forgejo.org/forgejo/test-setup-forgejo-docker@main
+        with:
+          args: ${{ forgejo.workspace }}/SOMEFILE
+      - run: |
+          test -f ${{ forgejo.workspace }}/SOMEFILE

actions/example-force-rebuild/run.sh

@@ -0,0 +1,69 @@
+TMPDIR=$(mktemp -d)
+
+trap "rm -fr $TMPDIR" EXIT
+
+function setup_with_rebuild() {
+    FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config-with-rebuild.yml forgejo-runner.sh reload
+}
+
+function setup_without_rebuild() {
+    FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config-without-rebuild.yml forgejo-runner.sh reload
+}
+
+function run() {
+    local dir="$1"
+    local expected="$2"
+    local repo=root/example-$example
+    forgejo-test-helper.sh push_workflow $dir $url root example-$example setup-forgejo $token
+    sha=$(forgejo-test-helper.sh branch_tip $url $repo main)
+    forgejo-test-helper.sh wait_$expected $url $repo $sha
+}
+
+function get_remote_image() {
+    docker image ls --format='{{ .Repository }}' | grep '^runner-remote-docker-action'
+}
+
+function remove_remote_images() {
+    docker image ls --format='{{ .Repository }}' | grep '^runner-remote-docker-action' | while read image; do
+        docker rmi $image
+    done
+}
+
+function was_built() {
+    grep --quiet 'docker build -t runner-remote-docker-action' $FORGEJO_RUNNER_LOGS
+}
+
+function main() {
+    local dir=$TMPDIR/repository
+    cp -a $EXAMPLE_DIR $dir
+
+    remove_remote_images
+
+    :
+    : Run one
+    :
+    setup_without_rebuild
+    run $dir success
+    local image="$(get_remote_image)"
+    test "$image"
+    was_built
+
+    :
+    : Run two: verify the image was not rebuilt
+    :
+    setup_without_rebuild # resets the logs
+    run $dir success
+    test "$image" = "$(get_remote_image)"
+    ! was_built
+
+    :
+    : Run two: verify the image was rebuilt and
+    : the image name stayed the same
+    :
+    setup_with_rebuild
+    run $dir success
+    test "$image" = "$(get_remote_image)"
+    was_built
+}
+
+main

actions/example-force-rebuild/runner-config-with-rebuild.yml

@@ -0,0 +1,31 @@
+log:
+  level: trace
+  job_level: trace
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+  force_rebuild: true
+
+host:
+  workdir_parent:

actions/example-force-rebuild/runner-config-without-rebuild.yml

@@ -0,0 +1,31 @@
+log:
+  level: trace
+  job_level: trace
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+  force_rebuild: false
+
+host:
+  workdir_parent:

actions/example-force-rebuild/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-id-tokens/.forgejo/workflows/test.yml

@@ -0,0 +1,78 @@
+on: [push]
+
+env:
+    JWT_CLI_VERSION: 6.2.0 # renovate: datasource=github-releases depName=jwt-cli packageName=mike-engel/jwt-cli
+
+jobs:
+    generation-allowed:
+        enable-openid-connect: true
+        runs-on: docker
+        container:
+            image: data.forgejo.org/oci/ci:1
+        steps:
+            - run: curl -L -o jwt-linux.tar.gz https://github.com/mike-engel/jwt-cli/releases/download/${{ env.JWT_CLI_VERSION }}/jwt-linux-musl.tar.gz && tar -xvzf ./jwt-linux.tar.gz && chmod a+x ./jwt
+            - name: validate token generation works
+              run: |
+                  RAW_JWT=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=exampleAudience" | jq -r ".value")
+                  if [[ -z "RAW_JWT" ]]; then
+                    echo "Error: RAW_JWT should be set"
+                    exit 1
+                  fi
+
+                  DECODED_JWT_BODY=$(echo $RAW_JWT | jq -R 'split(".") | .[1] | @base64d | fromjson')
+                  if [[ -z "$DECODED_JWT_BODY" ]]; then
+                    echo "Error: DECODED_JWT_BODY should be set"
+                    exit 1
+                  fi
+
+                  ISS=$(echo $DECODED_JWT_BODY | jq -r '.iss')
+                  if [[ -z "$ISS" ]]; then
+                    echo "Error: ISS should be set"
+                    exit 1
+                  fi
+
+                  curl "$ISS/.well-known/keys" > jwks.json
+                  JWKS=$(cat ./jwks.json)
+                  if [[ -z "$JWKS" ]]; then
+                    echo "Error: JWKS should be set"
+                    exit 1
+                  fi
+
+                  # Verify that the JWT decodes with the JWKS data
+                  ./jwt decode -S @./jwks.json -A RS256 $RAW_JWT || (echo "Error: failed signature validation" && exit 1)
+
+                  WORKFLOW=$(echo $DECODED_JWT_BODY | jq -r '.workflow')
+                  AUD=$(echo $DECODED_JWT_BODY | jq -r '.aud')
+                  EVENT_NAME=$(echo $DECODED_JWT_BODY | jq -r '.event_name')
+                  SUB=$(echo $DECODED_JWT_BODY | jq -r '.sub')
+                  if [[ "$WORKFLOW" != "test.yml" ]]; then
+                    echo "Error: WORKFLOW should be test.yml but is $WORKFLOW"
+                    exit 1
+                  fi
+                  if [[ "$AUD" != "exampleAudience" ]]; then
+                    echo "Error: AUD should be exampleAudience but is $AUD"
+                    exit 1
+                  fi
+                  if [[ "$EVENT_NAME" != "push" ]]; then
+                    echo "Error: EVENT_NAME should be push but is $EVENT_NAME"
+                    exit 1
+                  fi
+                  if [[ "$SUB" != "repo:root/example-id-tokens:ref:refs/heads/main" ]]; then
+                    echo "Error: SUB should be repo:root/example-id-tokens:ref:refs/heads/main but is $SUB"
+                    exit 1
+                  fi
+
+    generation-not-allowed:
+        enable-openid-connect: false
+        runs-on: docker
+        steps:
+            - name: check variables are unset
+              run: |
+                  if [[ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ]]; then
+                    echo "Error: ACTIONS_ID_TOKEN_REQUEST_TOKEN should be unset"
+                    exit 1
+                  fi
+                  if [[ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ]]; then
+                    echo "Error: ACTIONS_ID_TOKEN_REQUEST_TOKEN should be unset"
+                    exit 1
+                  fi

actions/example-if-cancel/.forgejo/workflows/test.yml

@@ -1,9 +1,3 @@
-#
-# As of Forgejo v1.20 running this example would require using the web
-# endpoints because there is no API to do the same.
-#
-# It was manually tested to **not work** with Forgejo v1.21 & runner 3.0.1
-#
 on: [push]
 
 jobs:

actions/example-if/.forgejo/workflows/test.yml

@@ -8,7 +8,7 @@ jobs:
       - name: if true
         if: true
         id: if_true
-        run: echo 'check=good' >> $GITHUB_OUTPUT
+        run: echo 'check=good' >> $FORGEJO_OUTPUT
       - name: verify if true was run
         run: test ${{ steps.if_true.outputs.check }} = good
 

actions/example-local-action/.forgejo/local-action/action.yml

@@ -13,10 +13,10 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: GITHUB_ACTION_PATH
+    - name: FORGEJO_ACTION_PATH
       run: |
         set -x
-        test "$(basename $GITHUB_ACTION_PATH)" = local-action
-        test "$GITHUB_ACTION_PATH" = "${{ env.GITHUB_ACTION_PATH }}"
+        test -e "$FORGEJO_ACTION_PATH"
+        test "$FORGEJO_ACTION_PATH" = "${{ env.FORGEJO_ACTION_PATH }}"
 
-    - run: echo key=${{ inputs.input-two-required }} >> $GITHUB_OUTPUT
+    - run: echo key=${{ inputs.input-two-required }} >> $FORGEJO_OUTPUT

actions/example-lxc/.forgejo/workflows/test.yml

@@ -0,0 +1,16 @@
+on: [push]
+
+jobs:
+  job1:
+    runs-on: lxc
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - run: systemctl --no-pager list-units
+  job2:
+    runs-on: lxc
+    steps:
+      - run: echo OK2
+  job3:
+    runs-on: lxc
+    steps:
+      - run: echo OK3

actions/example-lxc/runner-config.yaml

@@ -0,0 +1,31 @@
+
+log:
+  level: debug
+  job_level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["lxc:lxc://debian:bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-lxc/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-lxc/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-matrix-dynamic/.forgejo/workflows/test.yml

@@ -0,0 +1,49 @@
+on: [push]
+jobs:
+  define-matrix:
+    runs-on: docker
+    outputs:
+      scalar-value: ${{ steps.define.outputs.scalar }}
+      array-value: ${{ steps.define.outputs.array }}
+      matrix-value: ${{ steps.define.outputs.matrix }}
+    steps:
+      - id: define
+        run: |
+          echo 'scalar=scalar value' >> "$FORGEJO_OUTPUT"
+          echo 'array=["value 1", "value 2"]' >> "$FORGEJO_OUTPUT"
+          echo 'matrix={"dimension-1": ["d1 v1", "d1 v2"], "dimension-2": ["d2 v1", "d2 v2"]}' >> "$GITHUB_OUTPUT"
+
+  scalar-job:
+    runs-on: docker
+    needs: define-matrix
+    strategy:
+      matrix:
+        scalar:
+          - "${{ needs.define-matrix.outputs.scalar-value }}"
+          - hard-coded value
+    steps:
+      - run: |
+          set -x
+          [ "${{ matrix.scalar }}" = "scalar value" ] || [ "${{ matrix.scalar }}" = "hard-coded value" ] || exit 1
+
+  array-job:
+    runs-on: docker
+    needs: define-matrix
+    strategy:
+      matrix:
+        array: ${{ fromJSON(needs.define-matrix.outputs.array-value) }}
+    steps:
+      - run: |
+          set -x
+          [ "${{ matrix.array }}" = "value 1" ] || [ "${{ matrix.array }}" = "value 2" ] || exit 1
+
+  matrix-job:
+    runs-on: docker
+    needs: define-matrix
+    strategy:
+      matrix: ${{ fromJSON(needs.define-matrix.outputs.matrix-value) }}
+    steps:
+      - run: |
+          set -x
+          [ "${{ matrix.dimension-1 }}" = "d1 v1" ] || [ "${{ matrix.dimension-1 }}" = "d1 v2" ] || exit 1
+          [ "${{ matrix.dimension-2 }}" = "d2 v1" ] || [ "${{ matrix.dimension-2 }}" = "d2 v2" ] || exit 1

actions/example-matrix-dynamic/run.sh

@@ -0,0 +1,10 @@
+forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+# Verify that the matrix in the job was expanded correctly by checking that
+# there are 9 completed jobs, by their commit statuses being present on the
+# main branch's HEAD.
+api=$url/api/v1
+sha=$(forgejo-curl.sh api_json $api/repos/root/example-matrix-dynamic/branches/main | jq -r ".commit.id")
+num_runs=$(forgejo-curl.sh api_json $api/repos/root/example-matrix-dynamic/commits/$sha/status | jq ".total_count")
+echo "Expecting 9 commit statuses, found $num_runs commit statuses"
+test $num_runs = 9

actions/example-matrix/.forgejo/workflows/test.yml

@@ -0,0 +1,12 @@
+on: [push]
+jobs:
+  test:
+    runs-on: docker
+    name: name-${{ matrix.version }}
+    strategy:
+      matrix:
+        version: [1.18, 1.19]
+    steps:
+      - run: |
+         set -x
+         test "${{ matrix.version }}"

actions/example-needs/.forgejo/workflows/test.yml

@@ -0,0 +1,19 @@
+on: [push]
+jobs:
+  job1:
+    runs-on: docker
+    outputs:
+        job1output: ${{ steps.step1.outputs.value }}
+    steps:
+      - id: step1
+        run: |
+          set -x
+          echo "value=value1" >> $FORGEJO_OUTPUT
+
+  job2:
+    needs: [job1]
+    runs-on: docker
+    steps:
+      - run: |
+          set -x
+          test "${{ needs.job1.outputs.job1output }}" = "value1"

actions/example-post-7-0-schedule/.forgejo/workflows/test.yml

@@ -0,0 +1,23 @@
+on:
+  schedule:
+    - cron: '* * * * *'
+
+jobs:
+  test:
+    runs-on: ${{ vars.TEST_SCHEDULE_RUNSON }}
+    container:
+      image: data.forgejo.org/oci/debian:trixie
+      options: "--volume /srv/example:/srv/example"
+
+    steps:
+      - name: save context
+        run: |
+          d=/srv/example/post-7-0-schedule/contexts/$FORGEJO_EVENT_NAME
+          mkdir -p $d
+          cat > $d/github <<'EOF'
+          ${{ toJSON(github) }}
+          EOF
+
+      - run: |
+          echo "TEST_SCHEDULE_RUNSON=${{ vars.TEST_SCHEDULE_RUNSON }}"
+          touch /srv/example/post-7-0-schedule-volume/DONE

actions/example-post-7-0-schedule/run.sh

@@ -0,0 +1,30 @@
+forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+forgejo-curl.sh web -X POST http://${HOST_PORT}/admin/actions/variables/1/delete || true
+forgejo-curl.sh web --form name=TEST_SCHEDULE_RUNSON --form data=docker http://${HOST_PORT}/admin/actions/variables/new
+
+#
+# Verify that creating a new branch with the same SHA as the default branch
+# does not change the ref associated with the schedule
+#
+# See https://codeberg.org/forgejo/forgejo/pulls/1941 for more information
+#
+function verify_ref() {
+    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db 'select ref from action_schedule')
+    test "${ref##*/}" = "main"
+}
+verify_ref
+api=$url/api/v1
+forgejo-curl.sh api_json --data '{"new_branch_name":"zzzz"}' $api/repos/root/example-post-7-0-schedule/branches
+verify_ref
+
+# runs once per minute, give it three minutes max before declaring failure
+if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/post-7-0-schedule-volume/DONE; then
+    cat $FORGEJO_RUNNER_LOGS
+    false
+fi
+
+c=/srv/example/post-7-0-schedule/contexts/schedule/github
+cat $c
+test "schedule" = "$(jq -r .event_name <$c)"
+test "schedule" = "$(jq -r .event.action <$c)"

actions/example-post-7-0-schedule/setup.sh

@@ -0,0 +1 @@
+mkdir -p /srv/example/post-7-0-schedule-volume

actions/example-private-workflow-call/.forgejo/workflows/reusable.yaml

@@ -0,0 +1,10 @@
+on:
+  workflow_call:
+
+jobs:
+  build:
+    runs-on: "docker"
+    container:
+      image: data.forgejo.org/oci/node:24-trixie
+    steps:
+      - run: echo 'OK'

actions/example-private-workflow-call/.forgejo/workflows/test.yaml

@@ -0,0 +1,11 @@
+on:
+  push:
+
+jobs:
+  test:
+    # `runs-on` disables workflow expansion. We want that in this case, because then Forgejo Runner has to authenticate
+    # itself to access the reusable workflow.
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:24-trixie
+    uses: ./.forgejo/workflows/reusable.yaml

actions/example-private-workflow-call/run.sh

@@ -0,0 +1,42 @@
+api="$url/api/v1"
+export d=/srv/example/private-workflow-call
+
+function main() {
+    mkdir -p "$d"
+
+    local repo
+    repo="root/example-$example"
+
+    forgejo-test-helper.sh push_workflow "actions/example-$example" "$url" root "example-$example" setup-forgejo "$token"
+
+    # push_workflow creates the repository and triggers a first workflow run. Wait for it to succeed. Ensures that the
+    # workflow is valid.
+    local sha
+    sha="$(forgejo-test-helper.sh branch_tip "$url" "$repo" main)"
+    forgejo-test-helper.sh wait_success "$url" "$repo" "$sha"
+
+    # Make the repository private. That is necessary to verify that Forgejo Runner includes the correct credentials when
+    # cloning the workflow.
+    forgejo-curl.sh api_json -X PATCH --data-raw '{"private":true}' "$api/repos/root/example-$example"
+
+    # Create a new commit that triggers a new workflow run that can be identified uniquely.
+    (
+        cd "$d" || exit 1
+        git clone "$url/root/example-$example"
+        cd "example-$example" || exit 1
+         git config user.email root@example.com
+        git config user.name username
+        echo "A new file" > test.txt
+        git add .
+        git commit -m 'Commit a new file'
+        git push
+    )
+
+    # Wait for the workflow pulled from the private repository to succeed.
+    local new_sha
+    new_sha="$(forgejo-test-helper.sh branch_tip "$url" "$repo" main)"
+    [[ "$new_sha" != "$sha" ]] || exit 1
+    forgejo-test-helper.sh wait_success "$url" "$repo" "$new_sha"
+}
+
+main

actions/example-private-workflow-call/setup.sh

@@ -0,0 +1 @@
+mkdir -p /srv/example/private-workflow-call

actions/example-pull-request/.forgejo/workflows/test.yml

@@ -9,7 +9,7 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       options: "--volume /srv/example:/srv/example"
 
     steps:
@@ -17,45 +17,45 @@ jobs:
         shell: bash
         run: |
           set -x
-          test $GITHUB_TOKEN = ${{ env.GITHUB_TOKEN }}
-          test $GITHUB_TOKEN = ${{ github.token }}
+          test $FORGEJO_TOKEN = ${{ env.FORGEJO_TOKEN }}
+          test $FORGEJO_TOKEN = ${{ forgejo.token }}
           export DEBIAN_FRONTEND=noninteractive ; apt-get -qq update ; apt-get install -y -qq curl git >& /dev/null
           curl -sS -o /usr/local/bin/forgejo-curl.sh https://code.forgejo.org/forgejo/forgejo-curl/raw/branch/main/forgejo-curl.sh && chmod +x /usr/local/bin/forgejo-curl.sh
-          forgejo-curl.sh --token "$GITHUB_TOKEN" login $GITHUB_SERVER_URL
-          forgejo-curl.sh api_json $GITHUB_SERVER_URL/api/v1/user
+          forgejo-curl.sh --token "$FORGEJO_TOKEN" login $FORGEJO_SERVER_URL
+          forgejo-curl.sh api_json $FORGEJO_SERVER_URL/api/v1/user
 
       - name: determine if the PR is from a fork
         id: forked
         run: |
-          if test ${{ github.event.pull_request.base.repo.full_name }} = ${{ github.event.pull_request.head.repo.full_name }} ; then
-            echo value=false >> $GITHUB_OUTPUT
+          if test ${{ forgejo.event.pull_request.base.repo.full_name }} = ${{ forge.event.pull_request.head.repo.full_name }} ; then
+            echo value=false >> $FORGEJO_OUTPUT
           else
-            echo value=true >> $GITHUB_OUTPUT
+            echo value=true >> $FORGEJO_OUTPUT
           fi
 
       # See also actions/example-context/.forgejo/workflows/test.yml
-      - name: env.GITHUB_BASE_REF
+      - name: env.FORGEJO_BASE_REF
         run: |
           set -x
-          test "$GITHUB_BASE_REF" = main
-          test "$GITHUB_BASE_REF" = "${{ env.GITHUB_BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = main
+          test "$FORGEJO_BASE_REF" = "${{ env.FORGEJO_BASE_REF }}"
 
       # See also actions/example-context/.forgejo/workflows/test.yml
-      - name: env.GITHUB_HEAD_REF
+      - name: env.FORGEJO_HEAD_REF
         run: |
           set -x
           if ${{ steps.forked.outputs.value }} ; then
-              test "$GITHUB_HEAD_REF" = main
+              test "$FORGEJO_HEAD_REF" = main
           else
-              test "$GITHUB_HEAD_REF" = other
+              test "$FORGEJO_HEAD_REF" = other
           fi
-          test "$GITHUB_HEAD_REF" = "${{ env.GITHUB_HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ env.FORGEJO_HEAD_REF }}"
 
       - name: secrets
         shell: bash
         run: |
           set -x
-          case $GITHUB_EVENT_NAME in
+          case $FORGEJO_EVENT_NAME in
             pull_request_target)
               #
               # all PRs: secrets
@@ -76,7 +76,7 @@ jobs:
               fi
               ;;
             *)
-              echo unexpected event $GITHUB_EVENT_NAME
+              echo unexpected event $FORGEJO_EVENT_NAME
               false
               ;;
           esac
@@ -95,9 +95,9 @@ jobs:
           #
           # create an issue
           #
-          base_repo=${{ github.event.pull_request.base.repo.full_name }}
-          forgejo-curl.sh api_json --data-raw '{"title":"ISSUE"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/issues
-          url=$(echo $GITHUB_SERVER_URL | sed -e "s|://|://$GITHUB_TOKEN@|")
+          base_repo=${{ forgejo.event.pull_request.base.repo.full_name }}
+          forgejo-curl.sh api_json --data-raw '{"title":"ISSUE"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/issues
+          url=$(echo $FORGEJO_SERVER_URL | sed -e "s|://|://$FORGEJO_TOKEN@|")
           git clone $url/$base_repo base
           branch=B$RANDOM
           (
@@ -108,7 +108,7 @@ jobs:
             echo CHANGE >> README
             git add .
             git commit -m 'change'
-            case $GITHUB_EVENT_NAME in
+            case $FORGEJO_EVENT_NAME in
               pull_request_target|pull_request)
                 #
                 # repository write scope via http git passthrough
@@ -117,15 +117,15 @@ jobs:
                 #
                 # repository write scope via the API
                 #
-                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"title":"PR","base":"main","head":"'$branch'"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/pulls
-                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"color":"#ffffff","name":"labelname"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/labels
+                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"title":"PR","base":"main","head":"'$branch'"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/pulls
+                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"color":"#ffffff","name":"labelname"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/labels
                 #
                 # See https://codeberg.org/forgejo/forgejo/issues/1525
                 #
-                ! forgejo-curl.sh api_json --data-raw '{"new_branch_name":"B'$RANDOM'"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/branches
+                ! forgejo-curl.sh api_json --data-raw '{"new_branch_name":"B'$RANDOM'"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/branches
                 ;;
               *)
-                echo unexpected event $GITHUB_EVENT_NAME
+                echo unexpected event $FORGEJO_EVENT_NAME
                 false
                 ;;
             esac
@@ -133,17 +133,17 @@ jobs:
 
       - name: save event
         run: |
-          d=/srv/example/pull-request/contexts/${{ github.event.pull_request.head.repo.owner.username }}/$GITHUB_EVENT_NAME
+          d=/srv/example/pull-request/contexts/${{ forgejo.event.pull_request.head.repo.owner.username }}/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}
           EOF
 
-      - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
       - name: checkout the default branch if pull_request_target
         run: |
           set -x
-          case $GITHUB_EVENT_NAME in
+          case $FORGEJO_EVENT_NAME in
             pull_request_target)
               ! test -f file-unique-to-the-pr-branch
               ;;
@@ -151,7 +151,7 @@ jobs:
               test -f file-unique-to-the-pr-branch
               ;;
             *)
-              echo unexpected event $GITHUB_EVENT_NAME
+              echo unexpected event $FORGEJO_EVENT_NAME
               false
               ;;
           esac

actions/example-pull-request/assert-contexts.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+
+set -ex
+
+c=$d/contexts
+
+test opened = "$(jq -r .event.action <$c/fork-org/pull_request/github)"
+test opened = "$(jq -r .event.action <$c/fork-org/pull_request_target/github)"
+
+test opened = "$(jq -r .event.action <$c/root/pull_request/github)"
+test opened = "$(jq -r .event.action <$c/root/pull_request_target/github)"

actions/example-pull-request/assert-token.sh

@@ -1,11 +0,0 @@
-#!/bin/bash
-
-set -ex
-
-c=$d/contexts
-
-test opened = "$(jq -r .event.action < $c/fork-org/pull_request/github)"
-test opened = "$(jq -r .event.action < $c/fork-org/pull_request_target/github)"
-
-test opened = "$(jq -r .event.action < $c/root/pull_request/github)"
-test opened = "$(jq -r .event.action < $c/root/pull_request_target/github)"

actions/example-pull-request/run.sh

@@ -3,7 +3,7 @@ export d=/srv/example/pull-request
 
 PROOF='some proof'
 
-function setup() {
+function main() {
     mkdir -p $d
 
     forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
@@ -12,50 +12,45 @@ function setup() {
     forgejo-curl.sh api_json --data-raw '{"organization":"fork-org"}' $api/repos/root/example-pull-request/forks
     forgejo-curl.sh api_json -X PUT --data-raw '{"data":"AAAA"}' $api/repos/root/example-pull-request/actions/secrets/SECRET
 
-
     (
-	cd $d
-	git clone $url/fork-org/example-pull-request fork
-	cd fork
-	git config user.email root@example.com
-	git config user.name username
-	echo fork $PROOF >> README
-	touch file-unique-to-the-pr-branch
-	git add .
-	git commit -m 'fork change'
-	git push
+        cd $d
+        git clone $url/fork-org/example-pull-request fork
+        cd fork
+        git config user.email root@example.com
+        git config user.name username
+        echo fork $PROOF >>README
+        touch file-unique-to-the-pr-branch
+        git add .
+        git commit -m 'fork change'
+        git push
     )
 
     forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR from fork","base":"main","head":"fork-org:main"}' $api/repos/root/example-pull-request/pulls
 
     (
-	cd $d
-	git clone $url/root/example-pull-request
-	cd example-pull-request
-	git checkout -b other
-	git config user.email root@example.com
-	git config user.name username
-	touch file-unique-to-the-pr-branch
-	echo other $PROOF >> README
-	git add .
-	git commit -m 'other change'
-	git push --force -u origin other
+        cd $d
+        git clone $url/root/example-pull-request
+        cd example-pull-request
+        git checkout -b other
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-pr-branch
+        echo other $PROOF >>README
+        git add .
+        git commit -m 'other change'
+        git push --force -u origin other
     )
 
     forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR same repo","base":"main","head":"other"}' $api/repos/root/example-pull-request/pulls
 
     export RETRY_DELAYS="60 60 60 60 60 60 60"
-    for assert in $EXAMPLE_DIR/assert-*.sh ; do
-	if ! forgejo.sh retry $assert ; then
-	    find $d
-	    sed -e 's/^/[RUNNER LOGS]/' < $FORGEJO_RUNNER_LOGS
-	    false
-	fi
+    for assert in $EXAMPLE_DIR/assert-*.sh; do
+        if ! forgejo.sh retry $assert; then
+            find $d
+            sed -e 's/^/[RUNNER LOGS]/' <$FORGEJO_RUNNER_LOGS
+            false
+        fi
     done
 }
 
-function main() {
-    setup
-}
-
 main

actions/example-pull-request/setup.sh

@@ -1,2 +1 @@
 mkdir -p /srv/example/pull-request
-

actions/example-push-cancel/run.sh

@@ -11,8 +11,8 @@ forgejo-test-helper.sh wait_running $url $repo $sha
 #
 # push to the same branch
 #
-forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+forgejo-test-helper.sh push_workflow actions/example-echo $url root example-$example setup-forgejo $token
 #
-# wait for the workflow to be canceld as a result of the previous push
+# wait for the workflow to be canceled as a result of the previous push
 #
 forgejo-test-helper.sh wait_failure $url $repo $sha 'Has been cancelled'

actions/example-push/.forgejo/workflows/test.yml

@@ -9,14 +9,14 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       volumes:
         - /srv/example:/srv/example
     steps:
 
       - name: save event
         run: |
-          d=/srv/example/push/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/push/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}

actions/example-schedule-noncancel/.forgejo/workflows/schedule_continue.yml

@@ -0,0 +1,15 @@
+on:
+  schedule:
+    - cron: "* * * * *"
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/debian:trixie
+      volumes:
+        - /srv/example:/srv/example
+    steps:
+      - run: |
+          while ! [ -f /srv/example/schedule-noncancel/PUSHED ]; do
+              sleep 3
+          done

actions/example-schedule-noncancel/run.sh

@@ -0,0 +1,99 @@
+repo=root/example-$example
+#
+# delete the repository
+#
+api=$url/api/v1
+if forgejo-curl.sh api_json -X GET $api/repos/root/example-$example; then
+    forgejo-curl.sh api_json -X DELETE $api/repos/root/example-$example
+fi
+
+#
+# push the repository
+#
+forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+#
+# get the run id of the workflow that just started
+#
+getScheduleRun() {
+    rm -f $DIR/forgejo-work-path/forgejo.copy.db
+    cp $DIR/forgejo-work-path/forgejo.db $DIR/forgejo-work-path/forgejo.copy.db
+    sqlite3 $DIR/forgejo-work-path/forgejo.copy.db \
+        "pragma busy_timeout = 5000; \
+    select action_run.id \
+    from action_run \
+    inner join action_schedule on action_run.schedule_id = action_schedule.id \
+    inner join repository on action_schedule.repo_id = repository.id \
+    where repository.name = 'example-schedule-noncancel' \
+    order by action_run.created desc limit 1" | sed '2q;d'
+}
+
+run_id=$(getScheduleRun)
+while [ -z $run_id ]; do
+    echo waiting 5...
+    sleep 5
+    run_id=$(getScheduleRun)
+done
+
+echo Schedule run id: $run_id
+
+#
+# Wait for it to be started
+#
+checkStarted() {
+    rm -f $DIR/forgejo-work-path/forgejo.copy.db
+    cp $DIR/forgejo-work-path/forgejo.db $DIR/forgejo-work-path/forgejo.copy.db
+    sqlite3 $DIR/forgejo-work-path/forgejo.copy.db \
+        "pragma busy_timeout = 5000; \
+    select id \
+    from action_run \
+    where id = $run_id \
+    and started is not null" | sed '2q;d'
+}
+
+started_check=$(checkStarted)
+while [ -z $started_check ]; do
+    echo waiting 2...
+    sleep 2
+    started_check=$(checkStarted)
+done
+
+echo Run has started
+echo Push to repo again
+
+#
+# Push to the repo again
+#
+forgejo-test-helper.sh push_workflow actions/example-echo $url root example-$example setup-forgejo $token
+
+echo Signal to the workflow that the push has happened
+mkdir -p /srv/example/schedule-noncancel
+touch /srv/example/schedule-noncancel/PUSHED
+
+#
+# Wait for the workflow to finish anyway
+#
+echo Wait for workflow to finish
+
+checkFinished() {
+    rm -f $DIR/forgejo-work-path/forgejo.copy.db
+    cp $DIR/forgejo-work-path/forgejo.db $DIR/forgejo-work-path/forgejo.copy.db
+    sqlite3 $DIR/forgejo-work-path/forgejo.copy.db \
+        "pragma busy_timeout = 5000; \
+    select status \
+    from action_run \
+    where id = $run_id \
+    and (status != 6 and status != 5)" | sed '2q;d'
+}
+
+finished_status=$(checkFinished)
+while [ -z $finished_status ]; do
+    echo waiting 5...
+    sleep 5
+    finished_status=$(checkFinished)
+done
+
+echo Workflow finished.
+rm -f $DIR/forgejo-work-path/forgejo.copy.db
+
+test $finished_status = 1

actions/example-schedule-noncancel/teardown.sh

@@ -0,0 +1,4 @@
+#
+# this will effectively discard any linger workflow so they do not interfere with other tests
+#
+forgejo-runner.sh reload

actions/example-service/.forgejo/workflows/test.yml

@@ -2,16 +2,32 @@ on: [push]
 
 jobs:
   #
-  # No volume involved
+  # No volume involved & the container is implicit
+  #
+  simple-no-container:
+    runs-on: docker
+    services:
+      pgsql:
+        image: data.forgejo.org/oci/postgres:15
+        env:
+          POSTGRES_DB: test
+          POSTGRES_PASSWORD: postgres
+    steps:
+    - run: |
+       apt-get update -qq
+       apt-get install -y -qq  postgresql-client
+       PGPASSWORD=postgres psql -h pgsql -U postgres -c '\dt' test
+  #
+  # No volume involved & the container is explicit
   #
   simple:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
 
     services:
       pgsql:
-        image: code.forgejo.org/oci/postgres:15
+        image: data.forgejo.org/oci/postgres:15
         env:
           POSTGRES_DB: test
           POSTGRES_PASSWORD: postgres
@@ -27,7 +43,7 @@ jobs:
     needs: [simple]
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid --volume /srv/example-service-volume-invalid:/srv/example-service-volume-invalid"
 
     steps:
@@ -42,12 +58,12 @@ jobs:
     needs: [volume-on-step]
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid"
 
     services:
       myservice:
-        image: code.forgejo.org/oci/debian:bookworm
+        image: data.forgejo.org/oci/debian:trixie
         options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid"
         cmd: ["bash", "-c", "echo -n SUCCESS > /srv/example-service-volume-valid ; sleep infinity"]
 

actions/example-service/runner-config.yaml

@@ -1,6 +1,6 @@
 
 log:
-  level: info
+  level: debug
 
 runner:
   file: .runner

actions/example-service/setup.sh

@@ -1,3 +1,3 @@
-> /srv/example-service-volume-valid
-> /srv/example-service-volume-invalid
+>/srv/example-service-volume-valid
+>/srv/example-service-volume-invalid
 FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-shell/.forgejo/workflows/test.yml

@@ -0,0 +1,87 @@
+on: [push]
+
+env:
+    ASSERT_SHELL: 'set -x ; readlink /proc/$$/exe ; readlink /proc/$$/exe | grep '
+
+jobs:
+  default:
+    # docker:docker://code.forgejo.org/oci/node:22-bookworm
+    runs-on: docker
+    steps:
+      - name: default is bash
+        run: |
+            ${{ env.ASSERT_SHELL }} /bash
+
+  sh-fallback:
+    needs: [default]
+    # alpine:docker://code.forgejo.org/oci/alpine:latest
+    runs-on: alpine
+    steps:
+      - name: default is bash but with a fallback to sh in case it does not exist
+        run: |
+            ${{ env.ASSERT_SHELL }} /busybox
+
+  sh-fallback-with-container:
+    needs: [sh-fallback]
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/alpine:latest
+    steps:
+      - name: default is bash but with a fallback to sh in case it does not exist
+        run: |
+            ${{ env.ASSERT_SHELL }} /busybox
+
+  defaults-run:
+    needs: [sh-fallback-with-container]
+    # alpine:docker://code.forgejo.org/oci/alpine:latest
+    runs-on: alpine
+    defaults:
+        run:
+            shell: sh
+    steps:
+      - name: default is sh which is an alias for busybox in alpine
+        run: |
+            ${{ env.ASSERT_SHELL }} /busybox
+
+  python:
+    needs: [alpine]
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/python:slim
+    steps:
+      - name: python => python {0}
+        shell: python
+        run: |
+            print("something")
+
+  other:
+    needs: [python]
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:22-bookworm
+    steps:
+      - name: default is bash
+        run: |
+            ${{ env.ASSERT_SHELL }} /bash
+
+      - name: bash => bash --noprofile --norc -e -o pipefail {0}
+        shell: bash
+        run: |
+            ${{ env.ASSERT_SHELL }} /bash
+            shopt -o
+            shopt -o | grep --quiet 'pipefail.*on'
+
+      - name: sh => sh -e {0}
+        shell: sh
+        run: |
+            ${{ env.ASSERT_SHELL }} /dash
+
+      - name: node => node {0}
+        shell: node
+        run: |
+            console.log("something")
+
+      - name: dash -e {0}
+        shell: dash -e {0}
+        run: |
+            ${{ env.ASSERT_SHELL }} /dash

actions/example-shell/runner-config.yaml

@@ -0,0 +1,32 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+      - docker:docker://code.forgejo.org/oci/node:22-bookworm
+      - alpine:docker://code.forgejo.org/oci/alpine:latest
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: ""
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: []
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-shell/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-shell/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-tag/.forgejo/workflows/test.yml

@@ -7,14 +7,14 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       volumes:
         - /srv/example:/srv/example
     steps:
 
       - name: save event
         run: |
-          d=/srv/example/tag/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/tag/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}

actions/example-with-docker-host/.forgejo/workflows/test.yml

@@ -0,0 +1,10 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/docker:28-cli
+    steps:
+      - run: ls -l /var/run/docker.sock
+      - run: docker ps

actions/example-with-docker-host/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: "unix:///var/run/docker.sock"
+
+host:
+  workdir_parent:

actions/example-with-docker-host/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-with-docker-host/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-with-docker-socket/.forgejo/workflows/test.yml

@@ -0,0 +1,10 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/docker:28-cli
+    steps:
+      - run: ls -l /var/run/docker.sock
+      - run: docker ps

actions/example-with-docker-socket/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: "automount"
+
+host:
+  workdir_parent:

actions/example-with-docker-socket/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-with-docker-socket/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-with-docker-tcp/.forgejo/workflows/test.yml

@@ -0,0 +1,11 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - run: |
+          ! test -e /var/run/docker.sock
+          ! env | grep DOCKER_HOST