Replace Node.js with data.forgejo.org/oci/node 24-trixie (#1604)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [data.forgejo.org/oci/node](https://hub.docker.com/_/node) ([source](https://github.com/nodejs/docker-node)) | container | replacement | `24-bookworm` → `24-trixie` |

This is a special PR that replaces `data.forgejo.org/oci/node` with the community suggested minimal stable replacement version.

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My41LjAiLCJ1cGRhdGVkSW5WZXIiOiI0My41LjAiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbXX0=-->

Reviewed-on: https://code.forgejo.org/forgejo/end-to-end/pulls/1604
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.code.forgejo.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>

.dockerignore

@@ -0,0 +1 @@
+.git

.editorconfig

@@ -1,3 +1,10 @@
 root = true
+
 [*]
-tab_width: 8
+indent_style = space
+indent_size = 4
+tab_width = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

.forgejo/prepare-end-to-end/action.yml

@@ -1,9 +1,13 @@
+inputs:
+  built:
+    description: 'True if a source build is available, false otherwise'
+
 runs:
   using: "composite"
   steps:
       - name: cache S3 binaries
         id: S3
-        uses: https://code.forgejo.org/actions/cache@v3
+        uses: https://data.forgejo.org/actions/cache@v4
         with:
           path: |
             /usr/local/bin/minio
@@ -11,18 +15,26 @@ runs:
             /usr/local/bin/garage
           key: S3
 
-      - uses: https://code.forgejo.org/actions/setup-forgejo@v2
+      - uses: https://data.forgejo.org/actions/setup-forgejo@v3.1.6
         with:
           install-only: true
       - run: forgejo-binary.sh ensure_user forgejo
+      - name: inputs context dump for debug
+        run: |
+          set -x
+          cat <<EOF
+          ${{ toJSON(inputs) }}
+          EOF
       - uses: actions/download-artifact@v3
+        if: ${{ inputs.built == 'yes' }}
         with:
           name: forgejo-dev
           path: /srv/forgejo-binaries
       - name: chown/chmod /srv/forgejo-binaries
         run: |
-          chmod +x /srv/forgejo-binaries/*
+          mkdir -p /srv/forgejo-binaries
           chown -R forgejo /srv/forgejo-binaries
+          chmod -R +x /srv/forgejo-binaries
       - run: |
           script=$(pwd)/end-to-end.sh
           $script run dependencies

.forgejo/upload-coverage/action.yml

@@ -0,0 +1,11 @@
+inputs:
+  scope:
+    description: 'Scope of the coverage'
+
+runs:
+  using: "composite"
+  steps:
+      - uses: actions/upload-artifact@v3
+        with:
+          name: coverage-${{ inputs.scope }}
+          path: /tmp/forgejo-end-to-end/coverage

.forgejo/workflows/end-to-end.yml

@@ -2,16 +2,6 @@
 #
 # https://code.forgejo.org/forgejo/end-to-end/settings/actions
 #
-# secrets.CASCADE_DOCS_ORIGIN_TOKEN
-#   https://code.forgejo.org/forgejo-ci scope write:issue, read:repository, read:user
-# vars.CASCADE_DOCS_DESTINATION_DOER
-#   forgejo-cascading-pr (https://codeberg.org/forgejo-cascading-pr)
-# secrets.CASCADE_DOCS_DESTINATION_TOKEN
-#   https://codeberg.org/forgejo-cascading-pr scope write:issue, write:repository, read:user
-# vars.CASCADE_DOCS_FORCE_VERSION
-#   replace the generated documentation for a given version even if it has already
-#   been generated (e.g. v7.0.0-test)
-#
 
 on:
   pull_request:
@@ -19,20 +9,36 @@ on:
     branches:
       - 'main'
 
+enable-email-notifications: true
+
 jobs:
   build:
     runs-on: docker
     container:
-      image: 'docker.io/node:20-bookworm'
+      image: 'data.forgejo.org/oci/node:24-trixie'
+    outputs:
+      built: "${{ steps.build.outputs.built }}"
+      forgejo_versions_json: "${{ steps.build.outputs.forgejo_versions_json }}"
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
-      - uses: https://code.forgejo.org/actions/setup-go@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/setup-go@v5
         with:
-          go-version: "1.22"
+          go-version: "1.25"
       - name: lib/build.sh
+        id: build
         run: |
-          set -x
+          mkdir $d /tmp/forgejo-upload
+          touch /tmp/forgejo-upload/PLACEHOLDER
 
+          if ! test -f forgejo/build-from-sources; then
+             echo forgejo/build-from-sources is not present, do not build any version from source
+             source lib/lib.sh
+             echo "forgejo_versions_json=$(node -p "JSON.stringify(process.argv[1].split(' '))" "$RELEASE_NUMBERS")" >> $FORGEJO_OUTPUT
+             echo "built=no" >> $FORGEJO_OUTPUT
+             exit 0
+          fi
+
+          set -x
           #
           # SQLite needs gcc to be compiled
           #
@@ -41,93 +47,120 @@ jobs:
           apt-get -q install -y -qq build-essential
 
           d=/tmp/forgejo-binaries
-          mkdir $d /tmp/forgejo-upload
 
-          for version in $(ls forgejo/sources) ; do
-            forgejo=$d/forgejo-$version-dev
+          for version in $(cat forgejo/build-from-sources) ; do
             lib/build.sh $version $d
+            forgejo=$d/forgejo-$version-dev
             $forgejo --version
-            mv $forgejo /tmp/forgejo-upload
+            mv $forgejo /tmp/forgejo-upload/forgejo-$version
           done
+
+          echo "forgejo_versions_json=$(node -p "JSON.stringify(process.argv[1].split(' '))" "$(cat forgejo/build-from-sources)")" >> $FORGEJO_OUTPUT
+          echo "built=yes" >> $FORGEJO_OUTPUT
+
+      - name: steps context dump for debug
+        run: |
+          set -x
+          cat <<EOF
+          ${{ toJSON(steps) }}
+          EOF
+
       - uses: actions/upload-artifact@v3
+        if: ${{ steps.build.outputs.built == 'yes' }}
         with:
           name: forgejo-dev
           path: /tmp/forgejo-upload
 
   packages:
     needs: [build]
-    runs-on: lxc-bookworm
+    runs-on: lxc-trixie
+    strategy:
+      matrix:
+        forgejo_version: ${{ fromJSON(needs.build.outputs.forgejo_versions_json) }}
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
       - uses: ./.forgejo/prepare-end-to-end
-      - run: su forgejo -c "./end-to-end.sh test_packages"
+        with:
+            built: ${{ needs.build.outputs.built }}
+      - run: su forgejo -c "./end-to-end.sh test_packages ${{ matrix.forgejo_version }}"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: packages
       - name: full logs
         if: always()
         run: su forgejo -c "./end-to-end.sh show_logs"
 
   actions:
     needs: [build]
-    runs-on: lxc-bookworm
+    runs-on: lxc-trixie
+    strategy:
+      matrix:
+        forgejo_version: ${{ fromJSON(needs.build.outputs.forgejo_versions_json) }}
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
       - uses: ./.forgejo/prepare-end-to-end
-      - run: su forgejo -c "./end-to-end.sh test_actions"
+        with:
+            built: ${{ needs.build.outputs.built }}
+      - run: ./end-to-end.sh prepare_dockerd
+      - run: su forgejo -c "./end-to-end.sh test_actions ${{ matrix.forgejo_version }}"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: actions
       - name: full logs
         if: always()
         run: su forgejo -c "./end-to-end.sh show_logs"
 
-  actions-docs:
+  federation:
     needs: [build]
-    runs-on: lxc-bookworm
-    if: github.ref == 'refs/heads/main'
-    strategy:
-      matrix:
-        info:
-          - version: "7.0"
-            branch: next
-            forgejo: https://codeberg.org
-            owner: forgejo-experimental
-          - version: "1.21"
-            forgejo: https://codeberg.org
-            owner: forgejo
+    runs-on: lxc-trixie
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
       - uses: ./.forgejo/prepare-end-to-end
-      - name: set full-version
-        id: full-version
-        shell: bash
-        run: |
-          set -x
-          full_version=$(./end-to-end.sh full_version ${{ matrix.info.version }} ${{ matrix.info.owner }})
-          echo value="$full_version" >> $GITHUB_OUTPUT
-      - run: su forgejo -c "./end-to-end.sh test_actions ${{ matrix.info.version }}"
-      - name: update documentation
-        uses: https://code.forgejo.org/actions/cascading-pr@v2.1
         with:
-          origin-url: ${{ env.GITHUB_SERVER_URL }}
-          origin-repo: ${{ github.repository }}
-          origin-token: ${{ secrets.CASCADE_DOCS_ORIGIN_TOKEN }}
-          origin-ref: refs/heads/main
-          destination-url: https://codeberg.org
-          destination-fork-repo: ${{ vars.CASCADE_DOCS_DESTINATION_DOER }}/docs
-          destination-repo: forgejo/docs
-          destination-branch: ${{ matrix.info.branch || format('v{0}', matrix.info.version) }}
-          destination-token: ${{ secrets.CASCADE_DOCS_DESTINATION_TOKEN }}
-          prefix: ${{ env.GITHUB_REPOSITORY }}-${{ matrix.info.version }}
-          update: .forgejo/cascading-docs
-        env:
-          FORCE_VERSION: "${{ vars.CASCADE_DOCS_FORCE_VERSION }}"
-          VERSION: "${{ steps.full-version.outputs.value }}"
+            built: ${{ needs.build.outputs.built }}
+      - name: install zstd
+        run: |
+          export DEBIAN_FRONTEND=noninteractive
+          apt-get -q install -y -qq zstd
+      - name: cache GitLab OCI image
+        uses: https://data.forgejo.org/actions/cache@v4
+        with:
+          path: |
+            /srv/forgejo-binaries/gitlab
+          key: gitlab
+      - name: setup dbus
+        run: |
+          apt-get -q install -y -qq dbus
+          systemctl enable --now dbus
+      - name: run test_federation
+        run: |
+          chown -R forgejo:forgejo .
+          su forgejo -c "./end-to-end.sh test_federation"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: federation
+      - name: full logs
+        if: always()
+        run: su forgejo -c "./end-to-end.sh show_logs"
 
   upgrade:
     name: upgrade and storage
     needs: [build]
-    runs-on: lxc-bookworm
+    runs-on: lxc-trixie
     steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
       - uses: ./.forgejo/prepare-end-to-end
+        with:
+            built: ${{ needs.build.outputs.built }}
       - run: su forgejo -c "./end-to-end.sh test_upgrades"
       - run: su forgejo -c "./end-to-end.sh test_storage"
+      - if: ${{ needs.build.outputs.built == 'yes' }}
+        uses: ./.forgejo/upload-coverage
+        with:
+            scope: upgrade
       - name: full logs
         if: always()
         run: su forgejo -c "./end-to-end.sh show_logs"

Dockerfile

@@ -0,0 +1,50 @@
+FROM data.forgejo.org/oci/node:24-trixie
+
+ENV PATH=$PATH:/setup-forgejo
+ENV _CONTAINERS_USERNS_CONFIGURED=""
+
+RUN apt-get update && \
+    apt-get --assume-yes --no-install-recommends install \
+        aardvark-dns \
+        ca-certificates \
+        curl \
+        daemon \
+        fuse-overlayfs \
+        gettext \
+        git \
+        jq \
+        libcap2-bin \
+        neovim \
+        nftables \
+        passt \
+        podman \
+        podman-compose \
+        podman-docker \
+        procps \
+        pup \
+        slirp4netns \
+        sudo \
+        tcpdump \
+        uidmap \
+        wget && \
+    adduser -u 1001 forgejo-tests && \
+    groupadd wheel && \
+    adduser forgejo-tests wheel && \
+    echo "%wheel ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers && \
+    echo "forgejo-tests:10000:9999" > /etc/subuid && \
+    echo "forgejo-tests:10000:9999" > /etc/subgid && \
+    mkdir /srv/forgejo-binaries && \
+    chown forgejo-tests:forgejo-tests /srv/forgejo-binaries && \
+    apt-get clean && \
+    apt-get autoremove --purge && \
+    apt-get autoclean
+
+COPY --chown=1001:1001 . /e2e
+
+RUN git clone https://code.forgejo.org/actions/setup-forgejo.git /setup-forgejo
+
+USER forgejo-tests
+
+WORKDIR /e2e
+
+ENTRYPOINT /bin/bash

README.md

@@ -1,16 +1,36 @@
 # Forgejo end-to-end tests
 
+- [Forgejo end-to-end tests](#forgejo-end-to-end-tests)
+  - [Removing legacy tests](#removing-legacy-tests)
+  - [Hacking](#hacking)
+    - [Running from locally built binary](#running-from-locally-built-binary)
+      - [Forgejo](#forgejo)
+      - [Forgejo runner](#forgejo-runner)
+    - [Running from locally built container image](#running-from-locally-built-container-image)
+  - [Running actions tests locally](#running-actions-tests-locally)
+  - [Running federation tests locally](#running-federation-tests-locally)
+    - [Federated Mastodon Follow Test](#federated-mastodon-follow-test)
+  - [Running other tests locally](#running-other-tests-locally)
+  - [Running tests in Docker/Podman](#running-tests-in-dockerpodman)
+
 A series of tests scenarios and assertions covering
 [Forgejo](https://codeberg.org/forgejo/forgejo) and the [Forgejo
-runner](https://code.forgejo.org/forgejo/runner). They partially rely
-on [Forgejo actions](https://code.forgejo.org/actions) developped
-specifically for testing such as
-[setup-forgejo](https://code.forgejo.org/actions/setup-forgejo).
+runner](https://code.forgejo.org/forgejo/runner).
 
 They are designed to run using Forgejo releases and development
 versions compiled from designated repositories.
 
-# Hacking
+## Removing legacy tests
+
+End-to-end tests cover the supported range of releases and when one of
+them is EOL, it must be removed as well as the tests that target it
+specifically. Otherwise the test suite would grow indefinitely.
+
+When a release is EOL, a branch is cut with a name following the
+pattern `legacy/vX.Y-vA.B`. For instance when `v8.0` is published and
+`v1.21` is EOL, the branch `legacy/v8.0-v1.21` is cut.
+
+## Hacking
 
 docker and sudo must be installed with insecure registries allowed in
 /etc/docker/daemon.json for the IP that will be used for forgejo such
@@ -20,13 +40,13 @@ as:
 {
   "insecure-registries": [ "10.0.0.0/8" ]
 }
-```  
+```
 
 Use setup-forgejo from source.
 
 The [setup-forgejo](https://code.forgejo.org/actions/setup-forgejo)
 repository is a [Forgejo
-Action](https://forgejo.org/docs/v1.21/user/actions/) which is meant
+Action](https://forgejo.org/docs/v7.0/user/actions/) which is meant
 to be used in workflows. However, it is implemented as shell scripts that
 can also be used to create Forgejo instances and runners locally. This
 is convenient for testing and the reason why it needs to be added to the PATH.
@@ -39,31 +59,76 @@ git clone https://code.forgejo.org/forgejo/end-to-end
 cd end-to-end
 ```
 
-## Running from locally built binary
+### Running from locally built binary
+
+Before injecting a manually built binary, make sure a simple test was
+run so that the directories are populated.
+
+#### Forgejo
+
+From a checkout of https://codeberg.org/forgejo/forgejo/
 
 ```sh
-make TAGS='bindata sqlite sqlite_unlock_notify' generate forgejo
-cp -a forgejo /srv/forgejo-binaries/forgejo-7.0-dev
+make clean-all && make frontend && make TAGS='bindata sqlite sqlite_unlock_notify' generate forgejo
+cp -a forgejo /srv/forgejo-binaries/forgejo-11.0
 ```
 
-It will be used whenver the version `7.0-dev` is specified in a test.
+It will be used whenever the version `11.0` is specified in a test.
 
-## Running actions locally
+#### Forgejo runner
+
+From a checkout of https://code.forgejo.org/forgejo/runner
+
+```sh
+make --always-make forgejo-runner
+cp forgejo-runner /tmp/forgejo-end-to-end/forgejo-runner
+```
+
+### Running from locally built container image
+
+```bash
+docker buildx build --output=type=docker --tag codeberg.org/forgejo/forgejo:latest .
+```
+
+## Running actions tests locally
 
 To run and debug workflows from `actions/example-*`, from the root of
 the source directory, with docker and forgejo-curl.sh installed, mimic
-what `.forgejo/workflows/actions.yml` does. There may be some manual
+what `.forgejo/workflows/end-to-end.yml` does. There may be some manual
 tweaking (such as creating temporary directories) because the tests
 run as root in the context of Forgejo Actions and assume they have
 admin permissions. But they do not need to run as root and must work
 fine when run as a regular user.
 
 ```sh
-./end-to-end.sh actions_setup 1.21
+export FORGEJO_RUNNER_LOGS=/tmp/forgejo-end-to-end/forgejo-runner.log
+./end-to-end.sh run dependencies
+./end-to-end.sh actions_setup 10.0
 firefox 0.0.0.0:3000 # user root / admin1234
-./end-to-end.sh actions_verify_example artifacts
+./end-to-end.sh actions_verify_example echo
 ./end-to-end.sh actions_teardown
 ```
+
+Note that `with-docker-tcp` requires the docker daemon listens to
+tcp://127.0.0.1:2375. See `actions/actions.sh` for how to do that.
+
+## Running federation tests locally
+
+To run and debug scenarios from `federation/*`, from the root of
+the source directory, mimic what `.forgejo/workflows/end-to-end.yml` does.
+
+```sh
+./end-to-end.sh run dependencies
+./end-to-end.sh federation_setup 12.0
+firefox 0.0.0.0:3001 # user root / admin1234
+firefox 0.0.0.0:3002 # user root / admin1234
+firefox 0.0.0.0:3003 # user root / admin1234
+./end-to-end.sh federation_verify_scenario star
+./end-to-end.sh federation_verify_scenario gotosocial
+./end-to-end.sh federation_verify_scenario mastodon
+./end-to-end.sh federation_teardown
+```
+
 ## Running other tests locally
 
 To run and debug tests, from the root of the source directory.
@@ -80,3 +145,10 @@ Cleanup. It will teardown the Forgejo instance.
 ```sh
 ./end-to-end.sh stop
 ```
+
+## Running tests in Docker/Podman
+
+There is an included Dockerfile in which the tests can be run. Building the
+conatiner will copy the the entire repo state into the container from which
+changes to the tests can be tested. Note: running in podman requires the
+`--privileged` flag because this will run podman in podman for some tests.

actions/actions.sh

@@ -1,57 +1,71 @@
 # Copyright 2024 The Forgejo Authors
 # SPDX-License-Identifier: MIT
 
-ACTIONS_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+ACTIONS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+function actions_export_variables() {
+    export HOST_PORT
+    export url=http://${FORGEJO_USER}:${FORGEJO_PASSWORD}@${HOST_PORT}
+    export token=$(cat $DOT_FORGEJO_CURL/token)
+}
+
+function actions_verify_feature() {
+    local feature=$1
+
+    actions_export_variables
+
+    export FEATURE_DIR=$ACTIONS_DIR/feature-$feature
+
+    echo "============================ RUN feature-$feature ==================="
+    bash -ex $FEATURE_DIR/run.sh || return 1
+}
 
 function actions_verify_example() {
-  local example=$1
+    local example=$1
 
-  export HOST_PORT
-  export url=http://${FORGEJO_USER}:${FORGEJO_PASSWORD}@${HOST_PORT}
-  export token=$(cat $DOT_FORGEJO_CURL/token)
+    actions_export_variables
+    actions_cleanup_example_volume
 
-  actions_cleanup_example_volume
+    export example
+    export EXAMPLE_DIR=$ACTIONS_DIR/example-$example
 
-  export example
-  export EXAMPLE_DIR=$ACTIONS_DIR/example-$example
+    if test -f $EXAMPLE_DIR/setup.sh; then
+        echo "============================ SETUP example-$example ==================="
+        bash -ex $EXAMPLE_DIR/setup.sh || return 1
+    fi
 
-  if test -f $EXAMPLE_DIR/setup.sh ; then
-    echo "============================ SETUP example-$example ==================="
-    bash -ex $EXAMPLE_DIR/setup.sh || return 1
-  fi
+    if test -f $EXAMPLE_DIR/run.sh; then
+        echo "============================ RUN example-$example ==================="
+        bash -ex $EXAMPLE_DIR/run.sh || return 1
+    else
+        forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example $example $token || return 1
+    fi
 
-  if test -f $EXAMPLE_DIR/run.sh ; then
-    echo "============================ RUN example-$example ==================="
-    bash -ex $EXAMPLE_DIR/run.sh || return 1
-  else
-    forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example $example $token || return 1
-  fi
+    if test -f $EXAMPLE_DIR/teardown.sh; then
+        echo "============================ TEARDOWN example-$example ==================="
+        bash -ex $EXAMPLE_DIR/teardown.sh || return 1
+    fi
 
-  if test -f $EXAMPLE_DIR/teardown.sh ; then
-    echo "============================ TEARDOWN example-$example ==================="
-    bash -ex $EXAMPLE_DIR/teardown.sh || return 1
-  fi
-
-  actions_save_contexts $example
+    actions_save_contexts $example
 }
 
 function actions_save_contexts() {
     local example="$1"
 
     if test -d /srv/example/$example/contexts; then
-	mkdir -p /srv/contexts
-	rsync -av /srv/example/$example/contexts/ /srv/contexts/$example/
+        mkdir -p /srv/contexts
+        rsync -av /srv/example/$example/contexts/ /srv/contexts/$example/
     fi
 }
 
 function actions_cleanup_example_volume() {
-    if test $(id -u) != 0 ; then
-	$SUDO chown $(id -u) /srv
+    if test $(id -u) != 0; then
+        $SUDO chown $(id -u) /srv
     fi
 
-    if ! test -d /srv/example ; then
-	mkdir -p /srv/example
-	return
+    if ! test -d /srv/example; then
+        mkdir -p /srv/example
+        return
     fi
 
     $SUDO rm -fr /srv/example/*
@@ -74,55 +88,102 @@ function actions_setup() {
 function actions_teardown() {
     forgejo-curl.sh logout
     forgejo-runner.sh teardown
-    stop_daemon forgejo
+    stop_forgejo
 }
 
 function actions_runner_version() {
     local runner_version=$($DIR/forgejo-runner --version | sed -n -e 's/forgejo-runner version v//p')
-    if test -z "$runner_version" ; then
-	$DIR/forgejo-runner --version
-	echo failed to parse version
-	false
+    if test -z "$runner_version"; then
+        $DIR/forgejo-runner --version
+        echo failed to parse version
+        false
     fi
     echo $runner_version
 }
 
+function prepare_dockerd() {
+    mkdir -p /etc/systemd/system/docker.service.d
+    cat >/etc/systemd/system/docker.service.d/override.conf <<'EOF'
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/dockerd -H unix:///var/run/docker.sock -H tcp://127.0.0.1:2375 --containerd=/run/containerd/containerd.sock $DOCKER_OPTS
+EOF
+    systemctl daemon-reload
+    if ! systemctl restart docker.service; then
+        journalctl --no-pager --unit docker.service
+        return 1
+    fi
+    netstat -lntp | grep 127.0.0.1:2375
+}
+
 function test_actions() {
-    local versions="${1:-1.20 1.21 $RELEASE_NUMBERS_AND_DEV}"
+    local versions="${1:-$RELEASE_NUMBERS}"
 
-    for version in $versions ; do
+    for version in $versions; do
 
-	actions_setup $version
-	local runner_version=$(actions_runner_version)
+        actions_setup $version
+        local runner_version=$(actions_runner_version)
 
-	log_info "Testing actions with Forgejo $version & Forgejo runner $runner_version"
+        log_info "Testing actions with Forgejo $version & Forgejo runner $runner_version"
 
-	if dpkg --compare-versions $version ge 7.0 && dpkg --compare-versions $runner_version gt 3.3.0 ; then
-	    for example in artifacts-v4 ; do
-		run actions_verify_example $example
-	    done
-	fi
-
-	for example in echo checkout service container expression local-action docker-action if if-fail ; do
-	    run actions_verify_example $example
-	done
-
-	if dpkg --compare-versions $version gt 1.20 ; then
-	    for example in push tag push-cancel artifacts pull-request context ; do
-		run actions_verify_example $example
-	    done
-	fi
-
-        if dpkg --compare-versions $version gt 1.20  && dpkg --compare-versions $version lt 7.1 ; then
-	    for example in cron ; do
-		run actions_verify_example $example
-	    done
-	fi
-
-        if dpkg --compare-versions $version ge 7.1 ; then
-            for example in post-7-0-schedule ; do
+        run actions_verify_example with-docker-tcp
+        if dpkg --compare-versions $runner_version gt 5.0.2; then
+            for example in with-docker-host with-docker-socket without-docker-socket; do
                 run actions_verify_example $example
             done
         fi
+
+        if dpkg --compare-versions $runner_version gt 10.0.0; then
+            run actions_verify_example force-rebuild
+        fi
+
+        if dpkg --compare-versions $version ge 7.0 && dpkg --compare-versions $runner_version gt 3.3.0; then
+            for example in artifacts-v4; do
+                run actions_verify_example $example
+            done
+        fi
+
+        for example in echo matrix needs workflow-call lxc config-options cache cache-pull-request checkout service container expression local-action docker-action if if-fail push tag push-cancel artifacts pull-request context private-workflow-call create-runner-file; do
+            run actions_verify_example $example
+        done
+
+        if dpkg --compare-versions $runner_version ge 6.3.0; then
+            run actions_verify_example cache-proxy
+        fi
+
+        if dpkg --compare-versions $runner_version ge 8.0.0; then
+            run actions_verify_example shell
+        fi
+
+        if dpkg --compare-versions $version lt 7.1; then
+            for example in cron; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $version ge 7.1; then
+            for example in automerge post-7-0-schedule; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $version ge 8.0; then
+            for example in workflow-dispatch; do
+                run actions_verify_example $example
+            done
+        fi
+
+        if dpkg --compare-versions $version ge 9.0; then
+            run actions_verify_example schedule-noncancel
+        fi
+
+        if dpkg --compare-versions $version ge 14.0; then
+            run actions_verify_example matrix-dynamic
+        fi
+
+        if dpkg --compare-versions $version ge 15.0; then
+            run actions_verify_example workflow-call-expansion
+            run actions_verify_example id-tokens
+        fi
     done
 }

actions/default-app.ini

@@ -1,5 +1,5 @@
-RUN_MODE = prod
-WORK_PATH = ${WORK_PATH}
+RUN_MODE = dev
+WORK_PATH = forgejo-work-path
 
 [server]
 APP_DATA_PATH = ${WORK_PATH}/data
@@ -18,7 +18,7 @@ PATH = ${WORK_PATH}/forgejo.db
 [log]
 MODE = file
 LEVEL = trace
-ROUTER = file
+logger.router.MODE = file
 
 [log.file]
 FILE_NAME = forgejo.log

actions/example-artifacts-v4/.forgejo/workflows/test.yml

@@ -7,7 +7,7 @@ jobs:
 
     - run: touch artifacts/ONE artifacts/TWO
 
-    - uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+    - uses: https://data.forgejo.org/forgejo/upload-artifact@v4
       with:
         name: many-artifacts
         path: artifacts/
@@ -16,7 +16,7 @@ jobs:
     needs: [upload-many]
     runs-on: docker
     steps:
-    - uses: https://code.forgejo.org/forgejo/download-artifact@v4
+    - uses: https://data.forgejo.org/forgejo/download-artifact@v4
 
     - run: |
         test -f many-artifacts/ONE
@@ -29,7 +29,7 @@ jobs:
 
     - run: echo hello > path/to/artifact/world.txt
 
-    - uses: https://code.forgejo.org/forgejo/upload-artifact@v4
+    - uses: https://data.forgejo.org/forgejo/upload-artifact@v4
       with:
         name: my-artifact
         path: path/to/artifact/world.txt
@@ -40,7 +40,7 @@ jobs:
     steps:
     - run: "! test -f world.txt"
 
-    - uses: https://code.forgejo.org/forgejo/download-artifact@v4
+    - uses: https://data.forgejo.org/forgejo/download-artifact@v4
       with:
         name: my-artifact
 

actions/example-automerge/.forgejo/workflows/test.yml

@@ -0,0 +1,13 @@
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+      options: "--volume /srv/example:/srv/example"
+
+    steps:
+      - run: |
+          ${{ vars.SCRIPT }}

actions/example-automerge/run.sh

@@ -0,0 +1,108 @@
+TMPDIR=$(mktemp -d)
+
+trap "rm -fr $TMPDIR" EXIT
+
+source $EXAMPLE_DIR/../../lib/lib.sh
+
+api=$url/api/v1
+repo=root/example-automerge
+export d=/srv/example/automerge
+
+function reset_automerge_pr() {
+    #
+    # repository with a pull_request event workflow that always succeeds
+    #
+    mkdir -p $d
+
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repo >&/dev/null || true
+    forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repo/actions/variables/SCRIPT >&/dev/null || true
+    forgejo-curl.sh api_json -X POST --data-raw '{"value":"true"}' $api/repos/$repo/actions/variables/SCRIPT
+
+    (
+        cd $d
+        rm -fr example-automerge
+        git clone $url/$repo
+        cd example-automerge
+        git checkout -b other
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-pr-branch
+        echo other >>README
+        git add .
+        git commit -m 'other change'
+        git push --force -u origin other
+    )
+
+    #
+    # make sure the runner won't race with the sequence that follows
+    #
+    forgejo-runner.sh teardown
+    #
+    # create a PR and schedule it for automerge when the workflow succeeds
+    #
+    api_pr_delete_all $api $repo
+    forgejo-curl.sh api_json --data-raw '{"title":"PR title","base":"main","head":"other"}' $api/repos/$repo/pulls >$TMPDIR/pr.json
+    local pr=$(jq -r .number <$TMPDIR/pr.json)
+    forgejo-curl.sh api_json --data-raw '{"Do":"merge","merge_when_checks_succeed":true}' $api/repos/$repo/pulls/$pr/merge
+    if api_pr_is_merged $api $repo $pr; then
+        echo pull request already merged although it should not be
+        return 1
+    fi
+}
+
+function verify_automerge_on_status_success() {
+    reset_automerge_pr
+    local pr=$(jq -r .number <$TMPDIR/pr.json)
+    #
+    # run the workflow
+    #
+    forgejo-runner.sh run
+    local sha=$(api_branch_tip $api $repo other)
+    api_pr_wait_success $api $repo $sha
+    #
+    # verify the PR was automerged
+    #
+    if ! retry api_pr_is_merged $api $repo $pr; then
+        echo pull request is not automerged as expected
+        return 1
+    fi
+}
+
+function verify_automerge_on_reviewer_approval() {
+    reset_automerge_pr
+    local pr=$(jq -r .number <$TMPDIR/pr.json)
+    #
+    # require at least one review for a PR to be merged
+    #
+    api_branch_protect $api $repo main
+    #
+    # run the workflow
+    #
+    forgejo-runner.sh run
+    local sha=$(api_branch_tip $api $repo other)
+    api_pr_wait_success $api $repo $sha
+    #
+    # approve the PR
+    #
+    local username=user1
+    api_user_create $api $username $username@example.com
+    api_user_make_admin $api $username
+    user_login $username
+    DOT=$API_TMPDIR/$username api_pr_approve $api $repo $pr
+    #
+    # verify the PR was automerged
+    #
+    if ! retry api_pr_is_merged $api $repo $pr; then
+        echo pull request is not automerged as expected
+        return 1
+    fi
+}
+
+function main() {
+    verify_automerge_on_status_success
+    verify_automerge_on_reviewer_approval
+}
+
+main

actions/example-automerge/setup.sh

@@ -0,0 +1 @@
+mkdir -p /srv/example/automerge

actions/example-cache-proxy/getter/.forgejo/workflows/get.yml

@@ -0,0 +1,25 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: thecoolsecretcachekey
+
+      - name: verify something
+        run: |
+          set -x
+          test SOMETHING = $(cat /usr/local/bin/something)
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep.outputs.cache-hit }}" = true

actions/example-cache-proxy/run.sh

@@ -0,0 +1,22 @@
+source $EXAMPLE_DIR/../../lib/lib.sh
+
+api=$url/api/v1
+repostorer=root/example-cache-proxy-storer
+repogetter=root/example-cache-proxy-getter
+
+function main() {
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repostorer >&/dev/null || true
+    forgejo-curl.sh api_json -X DELETE $api/repos/$repogetter >&/dev/null || true
+
+    forgejo-test-helper.sh push_workflow actions/example-$example/storer $url root example-$example-storer setup-forgejo $token
+    local shastorer=$(forgejo-test-helper.sh branch_tip $url $repostorer main)
+
+    forgejo-test-helper.sh wait_success $url $repostorer $shastorer
+
+    forgejo-test-helper.sh push_workflow actions/example-$example/getter $url root example-$example-getter setup-forgejo $token
+    local shagetter=$(forgejo-test-helper.sh branch_tip $url $repogetter main)
+    
+    forgejo-test-helper.sh wait_failure $url $repogetter $shagetter
+}
+
+main

actions/example-cache-proxy/runner-config.yaml

@@ -0,0 +1,29 @@
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cache-proxy/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-cache-proxy/storer/.forgejo/workflows/store.yml

@@ -0,0 +1,17 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: create something
+        run: echo SOMETHING > /usr/local/bin/something
+
+      - name: cache save
+        uses: https://data.forgejo.org/actions/cache/save@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: thecoolsecretcachekey

actions/example-cache-proxy/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-cache-pull-request/.forgejo/workflows/test.yml

@@ -0,0 +1,96 @@
+on:
+  pull_request:
+    types:
+      - opened
+      - closed
+
+jobs:
+  save-cache:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep1
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey-${{ forge.event.pull_request.head.repo.full_name }}
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep1.outputs.cache-hit }}" != true
+
+      - name: create something
+        run: echo SOMETHING > /usr/local/bin/something
+
+      - name: cache save
+        uses: https://data.forgejo.org/actions/cache/save@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: ${{ steps.cachestep1.outputs.cache-primary-key }}
+
+  restore-cache:
+    runs-on: docker
+    needs: [save-cache]
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep2
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey-${{ forge.event.pull_request.head.repo.full_name }}
+
+      - name: verify something
+        run: |
+          set -x
+          test SOMETHING = $(cat /usr/local/bin/something)
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep2.outputs.cache-hit }}" = true
+
+  test:
+    runs-on: docker
+    needs: [restore-cache]
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+      options: "--volume /srv/example:/srv/example"
+
+    steps:
+      - name: setup
+        shell: bash
+        run: |
+          set -x
+          test $FORGEJO_TOKEN = ${{ env.FORGEJO_TOKEN }}
+          test $FORGEJO_TOKEN = ${{ forge.token }}
+          export DEBIAN_FRONTEND=noninteractive ; apt-get -qq update ; apt-get install -y -qq curl git >& /dev/null
+          curl -sS -o /usr/local/bin/forgejo-curl.sh https://code.forgejo.org/forgejo/forgejo-curl/raw/branch/main/forgejo-curl.sh && chmod +x /usr/local/bin/forgejo-curl.sh
+          forgejo-curl.sh --token "$FORGEJO_TOKEN" login $FORGEJO_SERVER_URL
+          forgejo-curl.sh api_json $FORGEJO_SERVER_URL/api/v1/user
+
+      - name: determine if the PR is from a fork
+        id: forked
+        run: |
+          set -x
+          if test ${{ forge.event.pull_request.base.repo.full_name }} = ${{ forge.event.pull_request.head.repo.full_name }} ; then
+            echo value=false >> $FORGEJO_OUTPUT
+          else
+            echo value=true >> $FORGEJO_OUTPUT
+          fi
+
+      - name: save event
+        run: |
+          set -x
+          d=/srv/example/cache-pull-request/contexts/${{ forgejo.event.pull_request.head.repo.owner.username }}/$FORGEJO_EVENT_NAME
+          mkdir -p $d
+          cat > $d/forgejo-${{ forgejo.event.action }} <<'EOF'
+          ${{ toJSON(forgejo) }}
+          EOF

actions/example-cache-pull-request/assert-contexts-closed.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -ex
+
+c=$d/contexts
+
+for user in cache-fork-org root; do
+    test -f $c/$user/pull_request/forgejo-closed
+done

actions/example-cache-pull-request/assert-contexts-opened.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+set -ex
+
+c=$d/contexts
+
+for user in cache-fork-org root; do
+    test -f $c/$user/pull_request/forgejo-opened
+done

actions/example-cache-pull-request/run.sh

@@ -0,0 +1,80 @@
+TMPDIR=$(mktemp -d)
+
+trap "rm -fr $TMPDIR" EXIT
+
+api=$url/api/v1
+export d=/srv/example/cache-pull-request
+
+function main() {
+    mkdir -p $d
+
+    #
+    # open a pull request
+    # - from the same repository
+    # - from a forked repository
+    #
+    forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+    forgejo-curl.sh api_json --data-raw '{"username":"cache-fork-org"}' $api/orgs
+    forgejo-curl.sh api_json --data-raw '{"organization":"cache-fork-org"}' $api/repos/root/example-cache-pull-request/forks
+
+    (
+        cd $d
+        git clone $url/cache-fork-org/example-cache-pull-request fork
+        cd fork
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-pr-branch
+        git add .
+        git commit -m 'fork change'
+        git push
+    )
+
+    forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR from fork","base":"main","head":"cache-fork-org:main"}' $api/repos/root/example-cache-pull-request/pulls
+
+    (
+        cd $d
+        git clone $url/root/example-cache-pull-request
+        cd example-cache-pull-request
+        git checkout -b other
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-forked-pr
+        git add .
+        git commit -m 'other change'
+        git push --force -u origin other
+    )
+
+    forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR same repo","base":"main","head":"other"}' $api/repos/root/example-cache-pull-request/pulls
+
+    export RETRY_DELAYS="10 20 60 60 60 60 60"
+
+    #
+    # wait for the opened event to succeed using the cache on all pull requests
+    #
+    if ! forgejo.sh retry $EXAMPLE_DIR/assert-contexts-opened.sh; then
+        echo "assert-contexts-opened.sh failed; printing related logs and information:"
+        find $d
+        sed -e 's/^/[RUNNER LOGS]/' <$FORGEJO_RUNNER_LOGS
+        return 1
+    fi
+
+    #
+    # merge all pull requests
+    #
+    forgejo-curl.sh api_json $api/repos/root/example-cache-pull-request/pulls | jq -r '.[] | .number' | while read pr; do
+        forgejo-curl.sh api_json --data-raw '{"Do":"merge"}' $api/repos/root/example-cache-pull-request/pulls/$pr/merge
+    done
+
+    #
+    # wait for the closed event to succeed using the cache on all pull requests
+    #
+    if ! forgejo.sh retry $EXAMPLE_DIR/assert-contexts-closed.sh; then
+        echo "assert-contexts-closed.sh failed; printing related logs and information:"
+        find $d
+        sed -e 's/^/[RUNNER LOGS]/' <$FORGEJO_RUNNER_LOGS
+        return 1
+    fi
+}
+
+main

actions/example-cache-pull-request/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cache-pull-request/setup.sh

@@ -0,0 +1,2 @@
+mkdir -p /srv/example/cache-pull-request
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-cache-pull-request/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-cache/.forgejo/workflows/test.yml

@@ -0,0 +1,54 @@
+on: [push]
+
+jobs:
+  save-cache:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep1
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep1.outputs.cache-hit }}" != true
+
+      - name: create something
+        run: echo SOMETHING > /usr/local/bin/something
+
+      - name: cache save
+        uses: https://data.forgejo.org/actions/cache/save@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: ${{ steps.cachestep1.outputs.cache-primary-key }}
+
+  restore-cache:
+    runs-on: docker
+    needs: [save-cache]
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - name: cache restore
+        id: cachestep2
+        uses: https://data.forgejo.org/actions/cache/restore@v4
+        with:
+          path: |
+            /usr/local/bin/something
+          key: cachekey
+
+      - name: verify something
+        run: |
+          set -x
+          test SOMETHING = $(cat /usr/local/bin/something)
+
+      - name: cache hit
+        run: |
+          set -x
+          test "${{ steps.cachestep2.outputs.cache-hit }}" = true

actions/example-cache/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cache/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-cache/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-config-options/.forgejo/workflows/test.yml

@@ -0,0 +1,26 @@
+on: [push]
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+        options: "--hostname customname"
+    steps:
+    - run: |
+            test -f /srv/example-config-options-volume-valid
+    - run: |
+            ! test -w /srv/example-config-options-volume-valid
+    - run: |
+            ! test -f /srv/example-config-options-volume-invalid
+    - run: |
+            set -x
+            test "$FROB" = "NITZ"
+    - run: |
+            set -x
+            test "$VAR_FROM_ENV_FILE" = "VALUE_FROM_ENV_FILE"
+    - run: |
+            set -x
+            test "$VAR_FROM_ENV_IN_CONFIG" = "VALUE_FROM_ENV_IN_CONFIG"
+    - run: |
+            set -x
+            test "$(cat /etc/hostname)" = customname

actions/example-config-options/env_file

@@ -0,0 +1 @@
+VAR_FROM_ENV_FILE=VALUE_FROM_ENV_FILE

actions/example-config-options/runner-config.yaml

@@ -0,0 +1,33 @@
+
+log:
+  level: debug
+  job_level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  envs:
+      VAR_FROM_ENV_IN_CONFIG: VALUE_FROM_ENV_IN_CONFIG
+  env_file: env_file
+  timeout: 3h
+  insecure: true
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: ""
+  privileged: false
+  options: "--volume /srv/example-config-options-volume-valid:/srv/example-config-options-volume-valid:ro --volume /srv/example-config-options-volume-invalid:/srv/example-config-options-volume-invalid --env FROB=NITZ"
+  workdir_parent:
+  valid_volumes: ["/srv/example-config-options-volume-valid"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-config-options/setup.sh

@@ -0,0 +1,6 @@
+>/srv/example-config-options-volume-valid
+>/srv/example-config-options-volume-invalid
+TMPDIR=$(mktemp -d)
+cp $EXAMPLE_DIR/runner-config.yaml $EXAMPLE_DIR/env_file $TMPDIR
+sed -i -e "s|env_file:.*|env_file: $TMPDIR/env_file|" $TMPDIR/runner-config.yaml
+FORGEJO_RUNNER_CONFIG=$TMPDIR/runner-config.yaml forgejo-runner.sh reload

actions/example-config-options/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-container/.forgejo/workflows/test.yml

@@ -3,6 +3,6 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: alpine:3.19
+      image: data.forgejo.org/oci/alpine:3.23
     steps:
       - run: grep Alpine /etc/os-release

actions/example-context/.forgejo/workflows/test.yml

@@ -4,7 +4,7 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       volumes:
         - /srv/example:/srv/example
     steps:
@@ -15,174 +15,240 @@ jobs:
           test "$CI" = true
           test "$CI" = "${{ env.CI }}"
 
-      - name: GITHUB_ACTION
+      - name: FORGEJO_ACTION
         run: |
           set -x
-          echo "$GITHUB_ACTION" | grep -E '^[0-9]+$'
-          test "$GITHUB_ACTION" = "${{ env.GITHUB_ACTION }}"
-          test "$GITHUB_ACTION" = "${{ github.ACTION }}"
+          echo "$FORGEJO_ACTION" | grep -E '^[0-9]+$'
+          test "$FORGEJO_ACTION" = "${{ env.FORGEJO_ACTION }}"
+          test "$FORGEJO_ACTION" = "${{ github.ACTION }}"
+          test "$FORGEJO_ACTION" = "${{ forge.ACTION }}"
+          test "$FORGEJO_ACTION" = "${{ forgejo.ACTION }}"
+          test "$FORGEJO_ACTION" = "$GITHUB_ACTION"
 
       # See also actions/example-local-action/.forgejo/local-action/action.yml
-      - name: GITHUB_ACTION_PATH
+      - name: FORGEJO_ACTION_PATH
         run: |
           set -x
-          test -z "$GITHUB_ACTION_PATH"
-          test "$GITHUB_ACTION_PATH" = "${{ env.GITHUB_ACTION_PATH }}"
-          test "$GITHUB_ACTION_PATH" = "${{ github.ACTION_PATH }}"
+          test -z "$FORGEJO_ACTION_PATH"
+          test "$FORGEJO_ACTION_PATH" = "${{ env.FORGEJO_ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "${{ github.ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "${{ forge.ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "${{ forgejo.ACTION_PATH }}"
+          test "$FORGEJO_ACTION_PATH" = "$GITHUB_ACTION_PATH"
 
       - name: when running an action
-        if: ${{ env.GITHUB_ACTIONS }}
+        if: ${{ env.FORGEJO_ACTIONS }}
         uses: SELF@main
         with:
           input-one: "otherone"
 
-      - name: GITHUB_ACTION_REPOSITORY
-        run: test -f /srv/example/example-context/GITHUB_ACTION_REPOSITORY
+      - name: FORGEJO_ACTION_REPOSITORY
+        run: test -f /srv/example/example-context/FORGEJO_ACTION_REPOSITORY
 
-      - name: GITHUB_ACTION_PATH
-        run: test -f /srv/example/example-context/GITHUB_ACTION_PATH
+      - name: FORGEJO_ACTION_PATH
+        run: test -f /srv/example/example-context/FORGEJO_ACTION_PATH
 
-      - name: GITHUB_ACTIONS
+      - name: FORGEJO_ACTIONS
         run: |
           set -x
-          test "$GITHUB_ACTIONS" = true
-          test "$GITHUB_ACTIONS" = "${{ env.GITHUB_ACTIONS }}"
+          test "$FORGEJO_ACTIONS" = true
+          test "$FORGEJO_ACTIONS" = "${{ env.FORGEJO_ACTIONS }}"
+          test "$FORGEJO_ACTIONS" = "$GITHUB_ACTIONS"
 
-      - name: GITHUB_ACTOR
+      - name: FORGEJO_ACTOR
         run: |
           set -x
-          test "$GITHUB_ACTOR"
-          test "$GITHUB_ACTOR" = "${{ env.GITHUB_ACTOR }}"
-          test "$GITHUB_ACTOR" = "${{ github.ACTOR }}"
+          test "$FORGEJO_ACTOR"
+          test "$FORGEJO_ACTOR" = "${{ env.FORGEJO_ACTOR }}"
+          test "$FORGEJO_ACTOR" = "${{ github.ACTOR }}"
+          test "$FORGEJO_ACTOR" = "${{ forge.ACTOR }}"
+          test "$FORGEJO_ACTOR" = "${{ forgejo.ACTOR }}"
+          test "$FORGEJO_ACTOR" = "$GITHUB_ACTOR"
 
-      - name: GITHUB_API_URL
+      - name: FORGEJO_API_URL
         shell: bash
         run: |
           set -x
-          [[ "$GITHUB_API_URL" =~ /api/v1$ ]]
-          test "$GITHUB_API_URL" = "${{ env.GITHUB_API_URL }}"
-          test "$GITHUB_API_URL" = "${{ github.API_URL }}"
+          [[ "$FORGEJO_API_URL" =~ /api/v1$ ]]
+          test "$FORGEJO_API_URL" = "${{ env.FORGEJO_API_URL }}"
+          test "$FORGEJO_API_URL" = "${{ github.API_URL }}"
+          test "$FORGEJO_API_URL" = "${{ forge.API_URL }}"
+          test "$FORGEJO_API_URL" = "${{ forgejo.API_URL }}"
+          test "$FORGEJO_API_URL" = "$GITHUB_API_URL"
 
       # See also actions/example-pull-request/.forgejo/workflows/test.yml
-      - name: GITHUB_BASE_REF
+      - name: FORGEJO_BASE_REF
         run: |
           set -x
-          test -z "$GITHUB_BASE_REF"
-          test "$GITHUB_BASE_REF" = "${{ env.GITHUB_BASE_REF }}"
-          test "$GITHUB_BASE_REF" = "${{ github.BASE_REF }}"
+          test -z "$FORGEJO_BASE_REF"
+          test "$FORGEJO_BASE_REF" = "${{ env.FORGEJO_BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "${{ github.BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "${{ forge.BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "${{ forgejo.BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = "$GITHUB_BASE_REF"
 
       # See also actions/example-pull-request/.forgejo/workflows/test.yml
-      - name: GITHUB_HEAD_REF
+      - name: FORGEJO_HEAD_REF
         run: |
           set -x
-          test -z "$GITHUB_HEAD_REF"
-          test "$GITHUB_HEAD_REF" = "${{ env.GITHUB_HEAD_REF }}"
-          test "$GITHUB_HEAD_REF" = "${{ github.HEAD_REF }}"
+          test -z "$FORGEJO_HEAD_REF"
+          test "$FORGEJO_HEAD_REF" = "${{ env.FORGEJO_HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ github.HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ forge.HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ forgejo.HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "$GITHUB_HEAD_REF"
 
-      - name: GITHUB_ENV
+      - name: FORGEJO_ENV
         run: |
           set -x
-          test -f "$GITHUB_ENV"
-          test "$GITHUB_ENV" = "${{ env.GITHUB_ENV }}"
+          test -f "$FORGEJO_ENV"
+          test "$FORGEJO_ENV" = "${{ env.FORGEJO_ENV }}"
+          test "$FORGEJO_ENV" = "$GITHUB_ENV"
 
-      - name: GITHUB_EVENT_NAME
+      - name: FORGEJO_EVENT_NAME
         run: |
           set -x
-          test "$GITHUB_EVENT_NAME" = push
-          test "$GITHUB_EVENT_NAME" = "${{ env.GITHUB_EVENT_NAME }}"
-          test "$GITHUB_EVENT_NAME" = "${{ github.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = push
+          test "$FORGEJO_EVENT_NAME" = "${{ env.FORGEJO_EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "${{ github.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "${{ forge.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "${{ forgejo.EVENT_NAME }}"
+          test "$FORGEJO_EVENT_NAME" = "$GITHUB_EVENT_NAME"
 
-      - name: GITHUB_JOB
+      - name: FORGEJO_JOB
         run: |
           set -x
-          test "$GITHUB_JOB" = test
-          test "$GITHUB_JOB" = "${{ env.GITHUB_JOB }}"
-          test "$GITHUB_JOB" = "${{ github.JOB }}"
+          test "$FORGEJO_JOB" = test
+          test "$FORGEJO_JOB" = "${{ env.FORGEJO_JOB }}"
+          test "$FORGEJO_JOB" = "${{ github.JOB }}"
+          test "$FORGEJO_JOB" = "${{ forge.JOB }}"
+          test "$FORGEJO_JOB" = "${{ forgejo.JOB }}"
+          test "$FORGEJO_JOB" = "$GITHUB_JOB"
 
-      - name: GITHUB_OUTPUT
+      - name: FORGEJO_OUTPUT
         run: |
           set -x
-          test -f "$GITHUB_OUTPUT"
-          test "$GITHUB_OUTPUT" = "${{ env.GITHUB_OUTPUT }}"
+          test -f "$FORGEJO_OUTPUT"
+          test "$FORGEJO_OUTPUT" = "${{ env.FORGEJO_OUTPUT }}"
+          test "$FORGEJO_OUTPUT" = "$GITHUB_OUTPUT"
 
-      - name: GITHUB_PATH
+      - name: FORGEJO_PATH
         run: |
           set -x
-          test -f "$GITHUB_PATH"
-          test "$GITHUB_PATH" = "${{ env.GITHUB_PATH }}"
+          test -f "$FORGEJO_PATH"
+          test "$FORGEJO_PATH" = "${{ env.FORGEJO_PATH }}"
+          test "$FORGEJO_PATH" = "$GITHUB_PATH"
 
-      - name: GITHUB_REF
+      - name: FORGEJO_REF
         shell: bash
         run: |
           set -x
-          [[ "$GITHUB_REF" =~ ^refs/ ]]
-          test "$GITHUB_REF" = "${{ env.GITHUB_REF }}"
-          test "$GITHUB_REF" = "${{ github.REF }}"
+          [[ "$FORGEJO_REF" =~ ^refs/ ]]
+          test "$FORGEJO_REF" = "${{ env.FORGEJO_REF }}"
+          test "$FORGEJO_REF" = "${{ github.REF }}"
+          test "$FORGEJO_REF" = "${{ forge.REF }}"
+          test "$FORGEJO_REF" = "${{ forgejo.REF }}"
+          test "$FORGEJO_REF" = "$GITHUB_REF"
 
-      - name: GITHUB_REF_NAME
+      - name: FORGEJO_REF_NAME
         shell: bash
         run: |
           set -x
-          ! [[ "$GITHUB_REF_NAME" =~ ^refs/ ]]
-          test "$GITHUB_REF_NAME" = "${{ env.GITHUB_REF_NAME }}"
-          test "$GITHUB_REF_NAME" = "${{ github.REF_NAME }}"
+          ! [[ "$FORGEJO_REF_NAME" =~ ^refs/ ]]
+          test "$FORGEJO_REF_NAME" = "${{ env.FORGEJO_REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "${{ github.REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "${{ forge.REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "${{ forgejo.REF_NAME }}"
+          test "$FORGEJO_REF_NAME" = "$GITHUB_REF_NAME"
 
-      - name: GITHUB_REPOSITORY
+      - name: FORGEJO_REPOSITORY
         run: |
           set -x
-          test "$GITHUB_REPOSITORY" = root/example-context
-          test "$GITHUB_REPOSITORY" = "${{ env.GITHUB_REPOSITORY }}"
-          test "$GITHUB_REPOSITORY" = "${{ github.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = root/example-context
+          test "$FORGEJO_REPOSITORY" = "${{ env.FORGEJO_REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "${{ github.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "${{ forge.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "${{ forgejo.REPOSITORY }}"
+          test "$FORGEJO_REPOSITORY" = "$GITHUB_REPOSITORY"
 
-      - name: GITHUB_REPOSITORY_OWNER
+      - name: FORGEJO_REPOSITORY_OWNER
         run: |
           set -x
-          test "$GITHUB_REPOSITORY_OWNER" = root
-          test "$GITHUB_REPOSITORY_OWNER" = "${{ env.GITHUB_REPOSITORY_OWNER }}"
-          test "$GITHUB_REPOSITORY_OWNER" = "${{ github.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = root
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ env.FORGEJO_REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ github.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ forge.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "${{ forgejo.REPOSITORY_OWNER }}"
+          test "$FORGEJO_REPOSITORY_OWNER" = "$GITHUB_REPOSITORY_OWNER"
 
-      - name: GITHUB_RUN_NUMBER
+      - name: FORGEJO_RUN_NUMBER
         run: |
           set -x
-          echo "$GITHUB_RUN_NUMBER" | grep -E '^[0-9]+$'
-          test "$GITHUB_RUN_NUMBER" = "${{ env.GITHUB_RUN_NUMBER }}"
-          test "$GITHUB_RUN_NUMBER" = "${{ github.RUN_NUMBER }}"
+          echo "$FORGEJO_RUN_NUMBER" | grep -E '^[0-9]+$'
+          test "$FORGEJO_RUN_NUMBER" = "${{ env.FORGEJO_RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "${{ github.RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "${{ forge.RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "${{ forgejo.RUN_NUMBER }}"
+          test "$FORGEJO_RUN_NUMBER" = "$GITHUB_RUN_NUMBER"
 
-      - name: GITHUB_SERVER_URL
+      - name: FORGEJO_RUN_ID
+        run: |
+          set -x
+          echo "$FORGEJO_RUN_ID" | grep -E '^[0-9]+$'
+          test "$FORGEJO_RUN_ID" = "${{ env.FORGEJO_RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "${{ github.RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "${{ forge.RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "${{ forgejo.RUN_ID }}"
+          test "$FORGEJO_RUN_ID" = "$GITHUB_RUN_ID"
+
+      - name: FORGEJO_SERVER_URL
         shell: bash
         run: |
           set -x
-          [[ "$GITHUB_SERVER_URL" =~ ^http ]]
-          test "$GITHUB_SERVER_URL" = "${{ env.GITHUB_SERVER_URL }}"
-          test "$GITHUB_SERVER_URL" = "${{ github.SERVER_URL }}"
+          [[ "$FORGEJO_SERVER_URL" =~ ^http ]]
+          test "$FORGEJO_SERVER_URL" = "${{ env.FORGEJO_SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "${{ github.SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "${{ forge.SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "${{ forgejo.SERVER_URL }}"
+          test "$FORGEJO_SERVER_URL" = "$GITHUB_SERVER_URL"
 
-      - name: GITHUB_SHA
+      - name: FORGEJO_SHA
         run: |
           set -x
-          test "$GITHUB_SHA"
-          test "$GITHUB_SHA" = "${{ env.GITHUB_SHA }}"
-          test "$GITHUB_SHA" = "${{ github.SHA }}"
+          test "$FORGEJO_SHA"
+          test "$FORGEJO_SHA" = "${{ env.FORGEJO_SHA }}"
+          test "$FORGEJO_SHA" = "${{ github.SHA }}"
+          test "$FORGEJO_SHA" = "${{ forge.SHA }}"
+          test "$FORGEJO_SHA" = "${{ forgejo.SHA }}"
+          test "$FORGEJO_SHA" = "$GITHUB_SHA"
 
-      - name: GITHUB_STEP_SUMMARY
+      - name: FORGEJO_STEP_SUMMARY
         run: |
           set -x
-          test -f "$GITHUB_STEP_SUMMARY"
-          test "$GITHUB_STEP_SUMMARY" = "${{ env.GITHUB_STEP_SUMMARY }}"
+          test -f "$FORGEJO_STEP_SUMMARY"
+          test "$FORGEJO_STEP_SUMMARY" = "${{ env.FORGEJO_STEP_SUMMARY }}"
+          test "$FORGEJO_STEP_SUMMARY" = "$GITHUB_STEP_SUMMARY"
 
       # See also actions/example-pull-request/.forgejo/workflows/test.yml
-      - name: GITHUB_TOKEN
+      - name: FORGEJO_TOKEN
         run: |
           set -x
-          test "$GITHUB_TOKEN"
-          test "$GITHUB_TOKEN" = "${{ env.GITHUB_TOKEN }}"
-          test "$GITHUB_TOKEN" = "${{ github.TOKEN }}"
+          test "$FORGEJO_TOKEN"
+          test "$FORGEJO_TOKEN" = "${{ env.FORGEJO_TOKEN }}"
+          test "$FORGEJO_TOKEN" = "${{ github.TOKEN }}"
+          test "$FORGEJO_TOKEN" = "${{ forge.TOKEN }}"
+          test "$FORGEJO_TOKEN" = "${{ forgejo.TOKEN }}"
+          test "$FORGEJO_TOKEN" = "$GITHUB_TOKEN"
 
-      - name: GITHUB_WORKSPACE
+      - name: FORGEJO_WORKSPACE
         run: |
           set -x
-          test -d "$GITHUB_WORKSPACE"
-          test "$GITHUB_WORKSPACE" = "${{ env.GITHUB_WORKSPACE }}"
-          test "$GITHUB_WORKSPACE" = "${{ github.WORKSPACE }}"
+          test -d "$FORGEJO_WORKSPACE"
+          test "$FORGEJO_WORKSPACE" = "${{ env.FORGEJO_WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "${{ github.WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "${{ forge.WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "${{ forgejo.WORKSPACE }}"
+          test "$FORGEJO_WORKSPACE" = "$GITHUB_WORKSPACE"
 
       - name: RUNNER_ARCH
         run: |
@@ -194,11 +260,10 @@ jobs:
           set -x
           test "$RUNNER_OS" = Linux
 
-      # runner 3.3.0 $RUNNER_TOOL_CACHE is not an existing directory
-      # - name: RUNNER_TOOL_CACHE
-      #   run: |
-      #     set -x
-      #     test -d "$RUNNER_TOOL_CACHE"
+      - name: RUNNER_TOOL_CACHE
+        run: |
+          set -x
+          test "$RUNNER_TOOL_CACHE"
 
       - name: RUNNER_TEMP
         run: |

actions/example-context/action-for-context/action.yml

@@ -6,18 +6,27 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - name: GITHUB_ACTION_REPOSITORY
+    - name: FORGEJO_ACTION_REPOSITORY
       run: |
         set -x
-        test "$GITHUB_ACTION_REPOSITORY" = root/action-for-context
-        test "$GITHUB_ACTION_REPOSITORY" = "${{ env.GITHUB_ACTION_REPOSITORY }}"
-        test "$GITHUB_ACTION_REPOSITORY" = "${{ github.ACTION_REPOSITORY }}"
-        touch /srv/example/example-context/GITHUB_ACTION_REPOSITORY
+        test "$FORGEJO_ACTION_REPOSITORY" = root/action-for-context
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ env.FORGEJO_ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ github.ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ forge.ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "${{ forgejo.ACTION_REPOSITORY }}"
+        test "$FORGEJO_ACTION_REPOSITORY" = "$GITHUB_ACTION_REPOSITORY"
+        touch /srv/example/example-context/FORGEJO_ACTION_REPOSITORY
 
-    - name: GITHUB_ACTION_PATH
+    - name: FORGEJO_ACTION_PATH
       shell: bash
       run: |
         set -x
-        [[ "$GITHUB_ACTION_PATH" =~ action-for-context@main$ ]]
-        test "$GITHUB_ACTION_PATH" = "${{ github.ACTION_PATH }}"
-        touch /srv/example/example-context/GITHUB_ACTION_PATH
+        # prior to Forgejo runner 8.0.0 the action path is built out of the file path.
+        # with Forgejo runner 8.0.0 and above is it a 64 character hash string
+        # e.g. /var/run/act/actions/1b/5c1802fa47e35716c2a0977bc907049d31aef29191cba400011c0b38b52d12
+        [[ "$FORGEJO_ACTION_PATH" =~ action-for-context@main$ ]] || [[ "$FORGEJO_ACTION_PATH" =~ /[0-9a-f]{2}/[0-9a-f]{62}$ ]]
+        test "$FORGEJO_ACTION_PATH" = "${{ github.ACTION_PATH }}"
+        test "$FORGEJO_ACTION_PATH" = "${{ forge.ACTION_PATH }}"
+        test "$FORGEJO_ACTION_PATH" = "${{ forgejo.ACTION_PATH }}"
+        test "$FORGEJO_ACTION_PATH" = "$GITHUB_ACTION_PATH"
+        touch /srv/example/example-context/FORGEJO_ACTION_PATH

actions/example-create-runner-file/.forgejo/workflows/test.yaml

@@ -0,0 +1,9 @@
+on:
+  push:
+
+jobs:
+  test:
+    runs-on: create-runner-file
+    steps:
+      - run: |
+          echo "OK"

actions/example-create-runner-file/run.sh

@@ -0,0 +1,40 @@
+source "lib/lib.sh"
+
+api="$url/api/v1"
+
+function main() {
+    local repo
+    repo="root/example-$example"
+
+    secret="$(openssl rand -hex 20)"
+    runner_name="runner-$(openssl rand -hex 5)"
+
+    create_offline_registration_token "$runner_name" root "$secret"
+
+    # Changing to $DIR is necessary so that `.runner` gets created there. Otherwise, `forgejo-runner` would not pick it up.
+    pushd "$DIR" || exit 1
+    ./forgejo-runner -c "$EXAMPLE_DIR/runner-config.yaml" create-runner-file --instance "http://$IP:3000" --name "$runner_name" --secret "$secret" --connect
+    popd || exit 1
+
+    FORGEJO_RUNNER_CONFIG="$EXAMPLE_DIR/runner-config.yaml" forgejo-runner.sh reload
+
+    label_count=$(jq '.labels | length ' "$DIR/.runner")
+    if [[ "$label_count" != "1" ]] ; then
+      echo "Unexpected number of labels in .runner file: $label_count instead of 1" >&2
+      exit 1
+    fi
+
+    runner_label=$(jq -r '.labels[0]' "$DIR/.runner")
+    if [[ "$runner_label" != "create-runner-file:docker://code.forgejo.org/oci/node:24-trixie" ]] ; then
+      echo "Unexpected runner label: '$runner_label' instead of create-runner-file:docker://code.forgejo.org/oci/node:24-trixie" >&2
+      exit 1
+    fi
+
+    forgejo-test-helper.sh push_workflow "actions/example-$example" "$url" root "example-$example" setup-forgejo "$token"
+
+    local sha
+    sha="$(forgejo-test-helper.sh branch_tip "$url" "$repo" main)"
+    forgejo-test-helper.sh wait_success "$url" "$repo" "$sha"
+}
+
+main

actions/example-create-runner-file/runner-config.yaml

@@ -0,0 +1,31 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+    - "create-runner-file:docker://code.forgejo.org/oci/node:24-trixie"
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-cron/.forgejo/workflows/test.yml

@@ -6,17 +6,17 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example:/srv/example"
 
     steps:
-      - run: |
-          touch /srv/example/cron-volume/DONE
-
       - name: save context
         run: |
-          d=/srv/example/cron/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/cron/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}
           EOF
+
+      - run: |
+          touch /srv/example/cron-volume/DONE

actions/example-cron/run.sh

@@ -7,7 +7,7 @@ forgejo-test-helper.sh push_workflow actions/example-$example $url root example-
 # See https://codeberg.org/forgejo/forgejo/pulls/1941 for more information
 #
 function verify_ref() {
-    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db  'select ref from action_schedule')
+    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db 'select ref from action_schedule')
     test "${ref##*/}" = "main"
 }
 verify_ref
@@ -16,12 +16,12 @@ forgejo-curl.sh api_json --data '{"new_branch_name":"zzzz"}' $api/repos/root/exa
 verify_ref
 
 # cron runs once per minute, give it three minutes max before declaring failure
-if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/cron-volume/DONE ; then
+if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/cron-volume/DONE; then
     cat $FORGEJO_RUNNER_LOGS
     false
 fi
 
 c=/srv/example/cron/contexts/schedule/github
 cat $c
-test "schedule" = "$(jq -r .event_name < $c)"
-test "schedule" = "$(jq -r .event.action < $c)"
+test "schedule" = "$(jq -r .event_name <$c)"
+test "schedule" = "$(jq -r .event.action <$c)"

actions/example-docker-action/.forgejo/workflows/test.yml

@@ -9,11 +9,11 @@ jobs:
       #
       - uses: https://code.forgejo.org/forgejo/test-setup-forgejo-docker@main
         with:
-          args: ${{ github.workspace }}/SOMEFILE
+          args: ${{ forgejo.workspace }}/SOMEFILE
       #
       # ... which then also exists in the job workspace
       # because both docker containers are automatically
       # sharing the volume that contains it.
       #
       - run: |
-          test -f ${{ github.workspace }}/SOMEFILE
+          test -f ${{ forgejo.workspace }}/SOMEFILE

actions/example-expression/.forgejo/workflows/test.yml

@@ -23,7 +23,7 @@ jobs:
         if: ${{ env.KEY1 == 'nogood' }}
       - name: if does not skip
         id: conditional
-        run: echo 'check=good' >> $GITHUB_OUTPUT
+        run: echo 'check=good' >> $FORGEJO_OUTPUT
         if: env.KEY1 == 'value1'
       - name: verify if did not skip
         run: test ${{ steps.conditional.outputs.check }} = good
@@ -98,10 +98,11 @@ jobs:
           set -x
           test "${{ fromJSON('["one","two"]')[0] }}" = 'one'
 
-      # As of act v1.13.0 this fails for real (before it pretended to work but did not)
-      # - name: hashFiles
-      #   run: |
-      #     set -x
-      #     hash="bd52020371c038c4ad38a8d2df05dfa1a220d40fbe1ae83b63d6010cb527e531"
-      #     test "${{ hashFiles('actions/example-expression/.forgejo/fileone.txt') }}" = $hash
-      #     test "${{ hashFiles('actions/example-expression/.forgejo/fileone.*') }}" = $hash
+      - uses: actions/checkout@v4
+
+      - name: hashFiles
+        run: |
+          set -x
+          hash="aea6ca2329c852f5b480ec35e1fe09d39a6bd1b50f4f9cc38fbd4fef870dc107"
+          test "${{ hashFiles('.forgejo/fileone.txt') }}" = $hash
+          test "${{ hashFiles('.forgejo/fileone.*') }}" = $hash

actions/example-force-rebuild/.forgejo/workflows/test.yml

@@ -0,0 +1,11 @@
+on: [push]
+
+jobs:
+  ls:
+    runs-on: docker
+    steps:
+      - uses: https://code.forgejo.org/forgejo/test-setup-forgejo-docker@main
+        with:
+          args: ${{ forgejo.workspace }}/SOMEFILE
+      - run: |
+          test -f ${{ forgejo.workspace }}/SOMEFILE

actions/example-force-rebuild/run.sh

@@ -0,0 +1,69 @@
+TMPDIR=$(mktemp -d)
+
+trap "rm -fr $TMPDIR" EXIT
+
+function setup_with_rebuild() {
+    FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config-with-rebuild.yml forgejo-runner.sh reload
+}
+
+function setup_without_rebuild() {
+    FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config-without-rebuild.yml forgejo-runner.sh reload
+}
+
+function run() {
+    local dir="$1"
+    local expected="$2"
+    local repo=root/example-$example
+    forgejo-test-helper.sh push_workflow $dir $url root example-$example setup-forgejo $token
+    sha=$(forgejo-test-helper.sh branch_tip $url $repo main)
+    forgejo-test-helper.sh wait_$expected $url $repo $sha
+}
+
+function get_remote_image() {
+    docker image ls --format='{{ .Repository }}' | grep '^runner-remote-docker-action'
+}
+
+function remove_remote_images() {
+    docker image ls --format='{{ .Repository }}' | grep '^runner-remote-docker-action' | while read image; do
+        docker rmi $image
+    done
+}
+
+function was_built() {
+    grep --quiet 'docker build -t runner-remote-docker-action' $FORGEJO_RUNNER_LOGS
+}
+
+function main() {
+    local dir=$TMPDIR/repository
+    cp -a $EXAMPLE_DIR $dir
+
+    remove_remote_images
+
+    :
+    : Run one
+    :
+    setup_without_rebuild
+    run $dir success
+    local image="$(get_remote_image)"
+    test "$image"
+    was_built
+
+    :
+    : Run two: verify the image was not rebuilt
+    :
+    setup_without_rebuild # resets the logs
+    run $dir success
+    test "$image" = "$(get_remote_image)"
+    ! was_built
+
+    :
+    : Run two: verify the image was rebuilt and
+    : the image name stayed the same
+    :
+    setup_with_rebuild
+    run $dir success
+    test "$image" = "$(get_remote_image)"
+    was_built
+}
+
+main

actions/example-force-rebuild/runner-config-with-rebuild.yml

@@ -0,0 +1,31 @@
+log:
+  level: trace
+  job_level: trace
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+  force_rebuild: true
+
+host:
+  workdir_parent:

actions/example-force-rebuild/runner-config-without-rebuild.yml

@@ -0,0 +1,31 @@
+log:
+  level: trace
+  job_level: trace
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+  force_rebuild: false
+
+host:
+  workdir_parent:

actions/example-force-rebuild/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-id-tokens/.forgejo/workflows/test.yml

@@ -0,0 +1,78 @@
+on: [push]
+
+env:
+    JWT_CLI_VERSION: 6.2.0 # renovate: datasource=github-releases depName=jwt-cli packageName=mike-engel/jwt-cli
+
+jobs:
+    generation-allowed:
+        enable-openid-connect: true
+        runs-on: docker
+        container:
+            image: data.forgejo.org/oci/ci:1
+        steps:
+            - run: curl -L -o jwt-linux.tar.gz https://github.com/mike-engel/jwt-cli/releases/download/${{ env.JWT_CLI_VERSION }}/jwt-linux-musl.tar.gz && tar -xvzf ./jwt-linux.tar.gz && chmod a+x ./jwt
+            - name: validate token generation works
+              run: |
+                  RAW_JWT=$(curl -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=exampleAudience" | jq -r ".value")
+                  if [[ -z "RAW_JWT" ]]; then
+                    echo "Error: RAW_JWT should be set"
+                    exit 1
+                  fi
+
+                  DECODED_JWT_BODY=$(echo $RAW_JWT | jq -R 'split(".") | .[1] | @base64d | fromjson')
+                  if [[ -z "$DECODED_JWT_BODY" ]]; then
+                    echo "Error: DECODED_JWT_BODY should be set"
+                    exit 1
+                  fi
+
+                  ISS=$(echo $DECODED_JWT_BODY | jq -r '.iss')
+                  if [[ -z "$ISS" ]]; then
+                    echo "Error: ISS should be set"
+                    exit 1
+                  fi
+
+                  curl "$ISS/.well-known/keys" > jwks.json
+                  JWKS=$(cat ./jwks.json)
+                  if [[ -z "$JWKS" ]]; then
+                    echo "Error: JWKS should be set"
+                    exit 1
+                  fi
+
+                  # Verify that the JWT decodes with the JWKS data
+                  ./jwt decode -S @./jwks.json -A RS256 $RAW_JWT || (echo "Error: failed signature validation" && exit 1)
+
+                  WORKFLOW=$(echo $DECODED_JWT_BODY | jq -r '.workflow')
+                  AUD=$(echo $DECODED_JWT_BODY | jq -r '.aud')
+                  EVENT_NAME=$(echo $DECODED_JWT_BODY | jq -r '.event_name')
+                  SUB=$(echo $DECODED_JWT_BODY | jq -r '.sub')
+                  if [[ "$WORKFLOW" != "test.yml" ]]; then
+                    echo "Error: WORKFLOW should be test.yml but is $WORKFLOW"
+                    exit 1
+                  fi
+                  if [[ "$AUD" != "exampleAudience" ]]; then
+                    echo "Error: AUD should be exampleAudience but is $AUD"
+                    exit 1
+                  fi
+                  if [[ "$EVENT_NAME" != "push" ]]; then
+                    echo "Error: EVENT_NAME should be push but is $EVENT_NAME"
+                    exit 1
+                  fi
+                  if [[ "$SUB" != "repo:root/example-id-tokens:ref:refs/heads/main" ]]; then
+                    echo "Error: SUB should be repo:root/example-id-tokens:ref:refs/heads/main but is $SUB"
+                    exit 1
+                  fi
+
+    generation-not-allowed:
+        enable-openid-connect: false
+        runs-on: docker
+        steps:
+            - name: check variables are unset
+              run: |
+                  if [[ -n "$ACTIONS_ID_TOKEN_REQUEST_TOKEN" ]]; then
+                    echo "Error: ACTIONS_ID_TOKEN_REQUEST_TOKEN should be unset"
+                    exit 1
+                  fi
+                  if [[ -n "$ACTIONS_ID_TOKEN_REQUEST_URL" ]]; then
+                    echo "Error: ACTIONS_ID_TOKEN_REQUEST_TOKEN should be unset"
+                    exit 1
+                  fi

actions/example-if-cancel/.forgejo/workflows/test.yml

@@ -1,9 +1,3 @@
-#
-# As of Forgejo v1.20 running this example would require using the web
-# endpoints because there is no API to do the same.
-#
-# It was manually tested to **not work** with Forgejo v1.21 & runner 3.0.1
-#
 on: [push]
 
 jobs:

actions/example-if/.forgejo/workflows/test.yml

@@ -8,7 +8,7 @@ jobs:
       - name: if true
         if: true
         id: if_true
-        run: echo 'check=good' >> $GITHUB_OUTPUT
+        run: echo 'check=good' >> $FORGEJO_OUTPUT
       - name: verify if true was run
         run: test ${{ steps.if_true.outputs.check }} = good
 

actions/example-local-action/.forgejo/local-action/action.yml

@@ -13,10 +13,10 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: GITHUB_ACTION_PATH
+    - name: FORGEJO_ACTION_PATH
       run: |
         set -x
-        test "$(basename $GITHUB_ACTION_PATH)" = local-action
-        test "$GITHUB_ACTION_PATH" = "${{ env.GITHUB_ACTION_PATH }}"
+        test -e "$FORGEJO_ACTION_PATH"
+        test "$FORGEJO_ACTION_PATH" = "${{ env.FORGEJO_ACTION_PATH }}"
 
-    - run: echo key=${{ inputs.input-two-required }} >> $GITHUB_OUTPUT
+    - run: echo key=${{ inputs.input-two-required }} >> $FORGEJO_OUTPUT

actions/example-lxc/.forgejo/workflows/test.yml

@@ -0,0 +1,16 @@
+on: [push]
+
+jobs:
+  job1:
+    runs-on: lxc
+    steps:
+      - uses: https://data.forgejo.org/actions/checkout@v4
+      - run: systemctl --no-pager list-units
+  job2:
+    runs-on: lxc
+    steps:
+      - run: echo OK2
+  job3:
+    runs-on: lxc
+    steps:
+      - run: echo OK3

actions/example-lxc/runner-config.yaml

@@ -0,0 +1,31 @@
+
+log:
+  level: debug
+  job_level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["lxc:lxc://debian:bookworm"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-lxc/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-lxc/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-matrix-dynamic/.forgejo/workflows/test.yml

@@ -0,0 +1,49 @@
+on: [push]
+jobs:
+  define-matrix:
+    runs-on: docker
+    outputs:
+      scalar-value: ${{ steps.define.outputs.scalar }}
+      array-value: ${{ steps.define.outputs.array }}
+      matrix-value: ${{ steps.define.outputs.matrix }}
+    steps:
+      - id: define
+        run: |
+          echo 'scalar=scalar value' >> "$FORGEJO_OUTPUT"
+          echo 'array=["value 1", "value 2"]' >> "$FORGEJO_OUTPUT"
+          echo 'matrix={"dimension-1": ["d1 v1", "d1 v2"], "dimension-2": ["d2 v1", "d2 v2"]}' >> "$GITHUB_OUTPUT"
+
+  scalar-job:
+    runs-on: docker
+    needs: define-matrix
+    strategy:
+      matrix:
+        scalar:
+          - "${{ needs.define-matrix.outputs.scalar-value }}"
+          - hard-coded value
+    steps:
+      - run: |
+          set -x
+          [ "${{ matrix.scalar }}" = "scalar value" ] || [ "${{ matrix.scalar }}" = "hard-coded value" ] || exit 1
+
+  array-job:
+    runs-on: docker
+    needs: define-matrix
+    strategy:
+      matrix:
+        array: ${{ fromJSON(needs.define-matrix.outputs.array-value) }}
+    steps:
+      - run: |
+          set -x
+          [ "${{ matrix.array }}" = "value 1" ] || [ "${{ matrix.array }}" = "value 2" ] || exit 1
+
+  matrix-job:
+    runs-on: docker
+    needs: define-matrix
+    strategy:
+      matrix: ${{ fromJSON(needs.define-matrix.outputs.matrix-value) }}
+    steps:
+      - run: |
+          set -x
+          [ "${{ matrix.dimension-1 }}" = "d1 v1" ] || [ "${{ matrix.dimension-1 }}" = "d1 v2" ] || exit 1
+          [ "${{ matrix.dimension-2 }}" = "d2 v1" ] || [ "${{ matrix.dimension-2 }}" = "d2 v2" ] || exit 1

actions/example-matrix-dynamic/run.sh

@@ -0,0 +1,10 @@
+forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+# Verify that the matrix in the job was expanded correctly by checking that
+# there are 9 completed jobs, by their commit statuses being present on the
+# main branch's HEAD.
+api=$url/api/v1
+sha=$(forgejo-curl.sh api_json $api/repos/root/example-matrix-dynamic/branches/main | jq -r ".commit.id")
+num_runs=$(forgejo-curl.sh api_json $api/repos/root/example-matrix-dynamic/commits/$sha/status | jq ".total_count")
+echo "Expecting 9 commit statuses, found $num_runs commit statuses"
+test $num_runs = 9

actions/example-matrix/.forgejo/workflows/test.yml

@@ -0,0 +1,12 @@
+on: [push]
+jobs:
+  test:
+    runs-on: docker
+    name: name-${{ matrix.version }}
+    strategy:
+      matrix:
+        version: [1.18, 1.19]
+    steps:
+      - run: |
+         set -x
+         test "${{ matrix.version }}"

actions/example-needs/.forgejo/workflows/test.yml

@@ -0,0 +1,19 @@
+on: [push]
+jobs:
+  job1:
+    runs-on: docker
+    outputs:
+        job1output: ${{ steps.step1.outputs.value }}
+    steps:
+      - id: step1
+        run: |
+          set -x
+          echo "value=value1" >> $FORGEJO_OUTPUT
+
+  job2:
+    needs: [job1]
+    runs-on: docker
+    steps:
+      - run: |
+          set -x
+          test "${{ needs.job1.outputs.job1output }}" = "value1"

actions/example-post-7-0-schedule/.forgejo/workflows/test.yml

@@ -6,18 +6,18 @@ jobs:
   test:
     runs-on: ${{ vars.TEST_SCHEDULE_RUNSON }}
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example:/srv/example"
 
     steps:
-      - run: |
-          echo "TEST_SCHEDULE_RUNSON=${{ vars.TEST_SCHEDULE_RUNSON }}"
-          touch /srv/example/post-7-0-schedule-volume/DONE
-
       - name: save context
         run: |
-          d=/srv/example/post-7-0-schedule/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/post-7-0-schedule/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}
-          EOF
+          EOF
+
+      - run: |
+          echo "TEST_SCHEDULE_RUNSON=${{ vars.TEST_SCHEDULE_RUNSON }}"
+          touch /srv/example/post-7-0-schedule-volume/DONE

actions/example-post-7-0-schedule/run.sh

@@ -10,7 +10,7 @@ forgejo-curl.sh web --form name=TEST_SCHEDULE_RUNSON --form data=docker http://$
 # See https://codeberg.org/forgejo/forgejo/pulls/1941 for more information
 #
 function verify_ref() {
-    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db  'select ref from action_schedule')
+    local ref=$(sqlite3 $DIR/forgejo-work-path/forgejo.db 'select ref from action_schedule')
     test "${ref##*/}" = "main"
 }
 verify_ref
@@ -19,12 +19,12 @@ forgejo-curl.sh api_json --data '{"new_branch_name":"zzzz"}' $api/repos/root/exa
 verify_ref
 
 # runs once per minute, give it three minutes max before declaring failure
-if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/post-7-0-schedule-volume/DONE ; then
+if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example/post-7-0-schedule-volume/DONE; then
     cat $FORGEJO_RUNNER_LOGS
     false
 fi
 
 c=/srv/example/post-7-0-schedule/contexts/schedule/github
 cat $c
-test "schedule" = "$(jq -r .event_name < $c)"
-test "schedule" = "$(jq -r .event.action < $c)"
+test "schedule" = "$(jq -r .event_name <$c)"
+test "schedule" = "$(jq -r .event.action <$c)"

actions/example-post-7-0-schedule/setup.sh

@@ -1 +1 @@
-mkdir -p /srv/example/post-7-0-schedule-volume
+mkdir -p /srv/example/post-7-0-schedule-volume

actions/example-private-workflow-call/.forgejo/workflows/reusable.yaml

@@ -0,0 +1,10 @@
+on:
+  workflow_call:
+
+jobs:
+  build:
+    runs-on: "docker"
+    container:
+      image: data.forgejo.org/oci/node:24-trixie
+    steps:
+      - run: echo 'OK'

actions/example-private-workflow-call/.forgejo/workflows/test.yaml

@@ -0,0 +1,11 @@
+on:
+  push:
+
+jobs:
+  test:
+    # `runs-on` disables workflow expansion. We want that in this case, because then Forgejo Runner has to authenticate
+    # itself to access the reusable workflow.
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:24-trixie
+    uses: ./.forgejo/workflows/reusable.yaml

actions/example-private-workflow-call/run.sh

@@ -0,0 +1,42 @@
+api="$url/api/v1"
+export d=/srv/example/private-workflow-call
+
+function main() {
+    mkdir -p "$d"
+
+    local repo
+    repo="root/example-$example"
+
+    forgejo-test-helper.sh push_workflow "actions/example-$example" "$url" root "example-$example" setup-forgejo "$token"
+
+    # push_workflow creates the repository and triggers a first workflow run. Wait for it to succeed. Ensures that the
+    # workflow is valid.
+    local sha
+    sha="$(forgejo-test-helper.sh branch_tip "$url" "$repo" main)"
+    forgejo-test-helper.sh wait_success "$url" "$repo" "$sha"
+
+    # Make the repository private. That is necessary to verify that Forgejo Runner includes the correct credentials when
+    # cloning the workflow.
+    forgejo-curl.sh api_json -X PATCH --data-raw '{"private":true}' "$api/repos/root/example-$example"
+
+    # Create a new commit that triggers a new workflow run that can be identified uniquely.
+    (
+        cd "$d" || exit 1
+        git clone "$url/root/example-$example"
+        cd "example-$example" || exit 1
+         git config user.email root@example.com
+        git config user.name username
+        echo "A new file" > test.txt
+        git add .
+        git commit -m 'Commit a new file'
+        git push
+    )
+
+    # Wait for the workflow pulled from the private repository to succeed.
+    local new_sha
+    new_sha="$(forgejo-test-helper.sh branch_tip "$url" "$repo" main)"
+    [[ "$new_sha" != "$sha" ]] || exit 1
+    forgejo-test-helper.sh wait_success "$url" "$repo" "$new_sha"
+}
+
+main

actions/example-private-workflow-call/setup.sh

@@ -0,0 +1 @@
+mkdir -p /srv/example/private-workflow-call

actions/example-pull-request/.forgejo/workflows/test.yml

@@ -9,7 +9,7 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       options: "--volume /srv/example:/srv/example"
 
     steps:
@@ -17,45 +17,45 @@ jobs:
         shell: bash
         run: |
           set -x
-          test $GITHUB_TOKEN = ${{ env.GITHUB_TOKEN }}
-          test $GITHUB_TOKEN = ${{ github.token }}
+          test $FORGEJO_TOKEN = ${{ env.FORGEJO_TOKEN }}
+          test $FORGEJO_TOKEN = ${{ forgejo.token }}
           export DEBIAN_FRONTEND=noninteractive ; apt-get -qq update ; apt-get install -y -qq curl git >& /dev/null
           curl -sS -o /usr/local/bin/forgejo-curl.sh https://code.forgejo.org/forgejo/forgejo-curl/raw/branch/main/forgejo-curl.sh && chmod +x /usr/local/bin/forgejo-curl.sh
-          forgejo-curl.sh --token "$GITHUB_TOKEN" login $GITHUB_SERVER_URL
-          forgejo-curl.sh api_json $GITHUB_SERVER_URL/api/v1/user
+          forgejo-curl.sh --token "$FORGEJO_TOKEN" login $FORGEJO_SERVER_URL
+          forgejo-curl.sh api_json $FORGEJO_SERVER_URL/api/v1/user
 
       - name: determine if the PR is from a fork
         id: forked
         run: |
-          if test ${{ github.event.pull_request.base.repo.full_name }} = ${{ github.event.pull_request.head.repo.full_name }} ; then
-            echo value=false >> $GITHUB_OUTPUT
+          if test ${{ forgejo.event.pull_request.base.repo.full_name }} = ${{ forge.event.pull_request.head.repo.full_name }} ; then
+            echo value=false >> $FORGEJO_OUTPUT
           else
-            echo value=true >> $GITHUB_OUTPUT
+            echo value=true >> $FORGEJO_OUTPUT
           fi
 
       # See also actions/example-context/.forgejo/workflows/test.yml
-      - name: env.GITHUB_BASE_REF
+      - name: env.FORGEJO_BASE_REF
         run: |
           set -x
-          test "$GITHUB_BASE_REF" = main
-          test "$GITHUB_BASE_REF" = "${{ env.GITHUB_BASE_REF }}"
+          test "$FORGEJO_BASE_REF" = main
+          test "$FORGEJO_BASE_REF" = "${{ env.FORGEJO_BASE_REF }}"
 
       # See also actions/example-context/.forgejo/workflows/test.yml
-      - name: env.GITHUB_HEAD_REF
+      - name: env.FORGEJO_HEAD_REF
         run: |
           set -x
           if ${{ steps.forked.outputs.value }} ; then
-              test "$GITHUB_HEAD_REF" = main
+              test "$FORGEJO_HEAD_REF" = main
           else
-              test "$GITHUB_HEAD_REF" = other
+              test "$FORGEJO_HEAD_REF" = other
           fi
-          test "$GITHUB_HEAD_REF" = "${{ env.GITHUB_HEAD_REF }}"
+          test "$FORGEJO_HEAD_REF" = "${{ env.FORGEJO_HEAD_REF }}"
 
       - name: secrets
         shell: bash
         run: |
           set -x
-          case $GITHUB_EVENT_NAME in
+          case $FORGEJO_EVENT_NAME in
             pull_request_target)
               #
               # all PRs: secrets
@@ -76,7 +76,7 @@ jobs:
               fi
               ;;
             *)
-              echo unexpected event $GITHUB_EVENT_NAME
+              echo unexpected event $FORGEJO_EVENT_NAME
               false
               ;;
           esac
@@ -95,9 +95,9 @@ jobs:
           #
           # create an issue
           #
-          base_repo=${{ github.event.pull_request.base.repo.full_name }}
-          forgejo-curl.sh api_json --data-raw '{"title":"ISSUE"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/issues
-          url=$(echo $GITHUB_SERVER_URL | sed -e "s|://|://$GITHUB_TOKEN@|")
+          base_repo=${{ forgejo.event.pull_request.base.repo.full_name }}
+          forgejo-curl.sh api_json --data-raw '{"title":"ISSUE"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/issues
+          url=$(echo $FORGEJO_SERVER_URL | sed -e "s|://|://$FORGEJO_TOKEN@|")
           git clone $url/$base_repo base
           branch=B$RANDOM
           (
@@ -108,7 +108,7 @@ jobs:
             echo CHANGE >> README
             git add .
             git commit -m 'change'
-            case $GITHUB_EVENT_NAME in
+            case $FORGEJO_EVENT_NAME in
               pull_request_target|pull_request)
                 #
                 # repository write scope via http git passthrough
@@ -117,15 +117,15 @@ jobs:
                 #
                 # repository write scope via the API
                 #
-                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"title":"PR","base":"main","head":"'$branch'"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/pulls
-                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"color":"#ffffff","name":"labelname"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/labels
+                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"title":"PR","base":"main","head":"'$branch'"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/pulls
+                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"color":"#ffffff","name":"labelname"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/labels
                 #
                 # See https://codeberg.org/forgejo/forgejo/issues/1525
                 #
-                ! forgejo-curl.sh api_json --data-raw '{"new_branch_name":"B'$RANDOM'"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/branches
+                ! forgejo-curl.sh api_json --data-raw '{"new_branch_name":"B'$RANDOM'"}' $FORGEJO_SERVER_URL/api/v1/repos/$base_repo/branches
                 ;;
               *)
-                echo unexpected event $GITHUB_EVENT_NAME
+                echo unexpected event $FORGEJO_EVENT_NAME
                 false
                 ;;
             esac
@@ -133,17 +133,17 @@ jobs:
 
       - name: save event
         run: |
-          d=/srv/example/pull-request/contexts/${{ github.event.pull_request.head.repo.owner.username }}/$GITHUB_EVENT_NAME
+          d=/srv/example/pull-request/contexts/${{ forgejo.event.pull_request.head.repo.owner.username }}/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}
           EOF
 
-      - uses: https://code.forgejo.org/actions/checkout@v4
+      - uses: https://data.forgejo.org/actions/checkout@v4
       - name: checkout the default branch if pull_request_target
         run: |
           set -x
-          case $GITHUB_EVENT_NAME in
+          case $FORGEJO_EVENT_NAME in
             pull_request_target)
               ! test -f file-unique-to-the-pr-branch
               ;;
@@ -151,7 +151,7 @@ jobs:
               test -f file-unique-to-the-pr-branch
               ;;
             *)
-              echo unexpected event $GITHUB_EVENT_NAME
+              echo unexpected event $FORGEJO_EVENT_NAME
               false
               ;;
           esac

actions/example-pull-request/assert-contexts.sh

@@ -4,8 +4,8 @@ set -ex
 
 c=$d/contexts
 
-test opened = "$(jq -r .event.action < $c/fork-org/pull_request/github)"
-test opened = "$(jq -r .event.action < $c/fork-org/pull_request_target/github)"
+test opened = "$(jq -r .event.action <$c/fork-org/pull_request/github)"
+test opened = "$(jq -r .event.action <$c/fork-org/pull_request_target/github)"
 
-test opened = "$(jq -r .event.action < $c/root/pull_request/github)"
-test opened = "$(jq -r .event.action < $c/root/pull_request_target/github)"
+test opened = "$(jq -r .event.action <$c/root/pull_request/github)"
+test opened = "$(jq -r .event.action <$c/root/pull_request_target/github)"

actions/example-pull-request/run.sh

@@ -12,45 +12,44 @@ function main() {
     forgejo-curl.sh api_json --data-raw '{"organization":"fork-org"}' $api/repos/root/example-pull-request/forks
     forgejo-curl.sh api_json -X PUT --data-raw '{"data":"AAAA"}' $api/repos/root/example-pull-request/actions/secrets/SECRET
 
-
     (
-	cd $d
-	git clone $url/fork-org/example-pull-request fork
-	cd fork
-	git config user.email root@example.com
-	git config user.name username
-	echo fork $PROOF >> README
-	touch file-unique-to-the-pr-branch
-	git add .
-	git commit -m 'fork change'
-	git push
+        cd $d
+        git clone $url/fork-org/example-pull-request fork
+        cd fork
+        git config user.email root@example.com
+        git config user.name username
+        echo fork $PROOF >>README
+        touch file-unique-to-the-pr-branch
+        git add .
+        git commit -m 'fork change'
+        git push
     )
 
     forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR from fork","base":"main","head":"fork-org:main"}' $api/repos/root/example-pull-request/pulls
 
     (
-	cd $d
-	git clone $url/root/example-pull-request
-	cd example-pull-request
-	git checkout -b other
-	git config user.email root@example.com
-	git config user.name username
-	touch file-unique-to-the-pr-branch
-	echo other $PROOF >> README
-	git add .
-	git commit -m 'other change'
-	git push --force -u origin other
+        cd $d
+        git clone $url/root/example-pull-request
+        cd example-pull-request
+        git checkout -b other
+        git config user.email root@example.com
+        git config user.name username
+        touch file-unique-to-the-pr-branch
+        echo other $PROOF >>README
+        git add .
+        git commit -m 'other change'
+        git push --force -u origin other
     )
 
     forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR same repo","base":"main","head":"other"}' $api/repos/root/example-pull-request/pulls
 
     export RETRY_DELAYS="60 60 60 60 60 60 60"
-    for assert in $EXAMPLE_DIR/assert-*.sh ; do
-	if ! forgejo.sh retry $assert ; then
-	    find $d
-	    sed -e 's/^/[RUNNER LOGS]/' < $FORGEJO_RUNNER_LOGS
-	    false
-	fi
+    for assert in $EXAMPLE_DIR/assert-*.sh; do
+        if ! forgejo.sh retry $assert; then
+            find $d
+            sed -e 's/^/[RUNNER LOGS]/' <$FORGEJO_RUNNER_LOGS
+            false
+        fi
     done
 }
 

actions/example-pull-request/setup.sh

@@ -1,2 +1 @@
 mkdir -p /srv/example/pull-request
-

actions/example-push-cancel/run.sh

@@ -11,7 +11,7 @@ forgejo-test-helper.sh wait_running $url $repo $sha
 #
 # push to the same branch
 #
-forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+forgejo-test-helper.sh push_workflow actions/example-echo $url root example-$example setup-forgejo $token
 #
 # wait for the workflow to be canceled as a result of the previous push
 #

actions/example-push/.forgejo/workflows/test.yml

@@ -9,14 +9,14 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       volumes:
         - /srv/example:/srv/example
     steps:
 
       - name: save event
         run: |
-          d=/srv/example/push/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/push/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}

actions/example-schedule-noncancel/.forgejo/workflows/schedule_continue.yml

@@ -0,0 +1,15 @@
+on:
+  schedule:
+    - cron: "* * * * *"
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/debian:trixie
+      volumes:
+        - /srv/example:/srv/example
+    steps:
+      - run: |
+          while ! [ -f /srv/example/schedule-noncancel/PUSHED ]; do
+              sleep 3
+          done

actions/example-schedule-noncancel/run.sh

@@ -0,0 +1,99 @@
+repo=root/example-$example
+#
+# delete the repository
+#
+api=$url/api/v1
+if forgejo-curl.sh api_json -X GET $api/repos/root/example-$example; then
+    forgejo-curl.sh api_json -X DELETE $api/repos/root/example-$example
+fi
+
+#
+# push the repository
+#
+forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+#
+# get the run id of the workflow that just started
+#
+getScheduleRun() {
+    rm -f $DIR/forgejo-work-path/forgejo.copy.db
+    cp $DIR/forgejo-work-path/forgejo.db $DIR/forgejo-work-path/forgejo.copy.db
+    sqlite3 $DIR/forgejo-work-path/forgejo.copy.db \
+        "pragma busy_timeout = 5000; \
+    select action_run.id \
+    from action_run \
+    inner join action_schedule on action_run.schedule_id = action_schedule.id \
+    inner join repository on action_schedule.repo_id = repository.id \
+    where repository.name = 'example-schedule-noncancel' \
+    order by action_run.created desc limit 1" | sed '2q;d'
+}
+
+run_id=$(getScheduleRun)
+while [ -z $run_id ]; do
+    echo waiting 5...
+    sleep 5
+    run_id=$(getScheduleRun)
+done
+
+echo Schedule run id: $run_id
+
+#
+# Wait for it to be started
+#
+checkStarted() {
+    rm -f $DIR/forgejo-work-path/forgejo.copy.db
+    cp $DIR/forgejo-work-path/forgejo.db $DIR/forgejo-work-path/forgejo.copy.db
+    sqlite3 $DIR/forgejo-work-path/forgejo.copy.db \
+        "pragma busy_timeout = 5000; \
+    select id \
+    from action_run \
+    where id = $run_id \
+    and started is not null" | sed '2q;d'
+}
+
+started_check=$(checkStarted)
+while [ -z $started_check ]; do
+    echo waiting 2...
+    sleep 2
+    started_check=$(checkStarted)
+done
+
+echo Run has started
+echo Push to repo again
+
+#
+# Push to the repo again
+#
+forgejo-test-helper.sh push_workflow actions/example-echo $url root example-$example setup-forgejo $token
+
+echo Signal to the workflow that the push has happened
+mkdir -p /srv/example/schedule-noncancel
+touch /srv/example/schedule-noncancel/PUSHED
+
+#
+# Wait for the workflow to finish anyway
+#
+echo Wait for workflow to finish
+
+checkFinished() {
+    rm -f $DIR/forgejo-work-path/forgejo.copy.db
+    cp $DIR/forgejo-work-path/forgejo.db $DIR/forgejo-work-path/forgejo.copy.db
+    sqlite3 $DIR/forgejo-work-path/forgejo.copy.db \
+        "pragma busy_timeout = 5000; \
+    select status \
+    from action_run \
+    where id = $run_id \
+    and (status != 6 and status != 5)" | sed '2q;d'
+}
+
+finished_status=$(checkFinished)
+while [ -z $finished_status ]; do
+    echo waiting 5...
+    sleep 5
+    finished_status=$(checkFinished)
+done
+
+echo Workflow finished.
+rm -f $DIR/forgejo-work-path/forgejo.copy.db
+
+test $finished_status = 1

actions/example-schedule-noncancel/teardown.sh

@@ -0,0 +1,4 @@
+#
+# this will effectively discard any linger workflow so they do not interfere with other tests
+#
+forgejo-runner.sh reload

actions/example-service/.forgejo/workflows/test.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: docker
     services:
       pgsql:
-        image: code.forgejo.org/oci/postgres:15
+        image: data.forgejo.org/oci/postgres:15
         env:
           POSTGRES_DB: test
           POSTGRES_PASSWORD: postgres
@@ -23,11 +23,11 @@ jobs:
   simple:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
 
     services:
       pgsql:
-        image: code.forgejo.org/oci/postgres:15
+        image: data.forgejo.org/oci/postgres:15
         env:
           POSTGRES_DB: test
           POSTGRES_PASSWORD: postgres
@@ -43,7 +43,7 @@ jobs:
     needs: [simple]
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid --volume /srv/example-service-volume-invalid:/srv/example-service-volume-invalid"
 
     steps:
@@ -58,12 +58,12 @@ jobs:
     needs: [volume-on-step]
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/debian:bookworm
+      image: data.forgejo.org/oci/debian:trixie
       options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid"
 
     services:
       myservice:
-        image: code.forgejo.org/oci/debian:bookworm
+        image: data.forgejo.org/oci/debian:trixie
         options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid"
         cmd: ["bash", "-c", "echo -n SUCCESS > /srv/example-service-volume-valid ; sleep infinity"]
 

actions/example-service/runner-config.yaml

@@ -1,6 +1,6 @@
 
 log:
-  level: info
+  level: debug
 
 runner:
   file: .runner

actions/example-service/setup.sh

@@ -1,3 +1,3 @@
-> /srv/example-service-volume-valid
-> /srv/example-service-volume-invalid
+>/srv/example-service-volume-valid
+>/srv/example-service-volume-invalid
 FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-shell/.forgejo/workflows/test.yml

@@ -0,0 +1,87 @@
+on: [push]
+
+env:
+    ASSERT_SHELL: 'set -x ; readlink /proc/$$/exe ; readlink /proc/$$/exe | grep '
+
+jobs:
+  default:
+    # docker:docker://code.forgejo.org/oci/node:22-bookworm
+    runs-on: docker
+    steps:
+      - name: default is bash
+        run: |
+            ${{ env.ASSERT_SHELL }} /bash
+
+  sh-fallback:
+    needs: [default]
+    # alpine:docker://code.forgejo.org/oci/alpine:latest
+    runs-on: alpine
+    steps:
+      - name: default is bash but with a fallback to sh in case it does not exist
+        run: |
+            ${{ env.ASSERT_SHELL }} /busybox
+
+  sh-fallback-with-container:
+    needs: [sh-fallback]
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/alpine:latest
+    steps:
+      - name: default is bash but with a fallback to sh in case it does not exist
+        run: |
+            ${{ env.ASSERT_SHELL }} /busybox
+
+  defaults-run:
+    needs: [sh-fallback-with-container]
+    # alpine:docker://code.forgejo.org/oci/alpine:latest
+    runs-on: alpine
+    defaults:
+        run:
+            shell: sh
+    steps:
+      - name: default is sh which is an alias for busybox in alpine
+        run: |
+            ${{ env.ASSERT_SHELL }} /busybox
+
+  python:
+    needs: [alpine]
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/python:slim
+    steps:
+      - name: python => python {0}
+        shell: python
+        run: |
+            print("something")
+
+  other:
+    needs: [python]
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:22-bookworm
+    steps:
+      - name: default is bash
+        run: |
+            ${{ env.ASSERT_SHELL }} /bash
+
+      - name: bash => bash --noprofile --norc -e -o pipefail {0}
+        shell: bash
+        run: |
+            ${{ env.ASSERT_SHELL }} /bash
+            shopt -o
+            shopt -o | grep --quiet 'pipefail.*on'
+
+      - name: sh => sh -e {0}
+        shell: sh
+        run: |
+            ${{ env.ASSERT_SHELL }} /dash
+
+      - name: node => node {0}
+        shell: node
+        run: |
+            console.log("something")
+
+      - name: dash -e {0}
+        shell: dash -e {0}
+        run: |
+            ${{ env.ASSERT_SHELL }} /dash

actions/example-shell/runner-config.yaml

@@ -0,0 +1,32 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels:
+      - docker:docker://code.forgejo.org/oci/node:22-bookworm
+      - alpine:docker://code.forgejo.org/oci/alpine:latest
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: ""
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: []
+  docker_host: ""
+
+host:
+  workdir_parent:

actions/example-shell/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-shell/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-tag/.forgejo/workflows/test.yml

@@ -7,14 +7,14 @@ jobs:
   test:
     runs-on: docker
     container:
-      image: code.forgejo.org/oci/node:20-bookworm
+      image: data.forgejo.org/oci/node:20-bookworm
       volumes:
         - /srv/example:/srv/example
     steps:
 
       - name: save event
         run: |
-          d=/srv/example/tag/contexts/$GITHUB_EVENT_NAME
+          d=/srv/example/tag/contexts/$FORGEJO_EVENT_NAME
           mkdir -p $d
           cat > $d/github <<'EOF'
           ${{ toJSON(github) }}

actions/example-with-docker-host/.forgejo/workflows/test.yml

@@ -0,0 +1,10 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/docker:28-cli
+    steps:
+      - run: ls -l /var/run/docker.sock
+      - run: docker ps

actions/example-with-docker-host/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: "unix:///var/run/docker.sock"
+
+host:
+  workdir_parent:

actions/example-with-docker-host/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-with-docker-host/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-with-docker-socket/.forgejo/workflows/test.yml

@@ -0,0 +1,10 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/docker:28-cli
+    steps:
+      - run: ls -l /var/run/docker.sock
+      - run: docker ps

actions/example-with-docker-socket/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: "automount"
+
+host:
+  workdir_parent:

actions/example-with-docker-socket/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-with-docker-socket/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-with-docker-tcp/.forgejo/workflows/test.yml

@@ -0,0 +1,11 @@
+on: [push]
+
+jobs:
+  build:
+    runs-on: docker
+    container:
+      image: data.forgejo.org/oci/node:20-bookworm
+    steps:
+      - run: |
+          ! test -e /var/run/docker.sock
+          ! env | grep DOCKER_HOST

actions/example-with-docker-tcp/runner-config.yaml

@@ -0,0 +1,30 @@
+
+log:
+  level: debug
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:20-bookworm"]
+
+cache:
+  enabled: true
+  dir: "/srv/example/cache"
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example"]
+  docker_host: "tcp://127.0.0.1:2375"
+
+host:
+  workdir_parent:

actions/example-with-docker-tcp/setup.sh

@@ -0,0 +1 @@
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload

actions/example-with-docker-tcp/teardown.sh

@@ -0,0 +1 @@
+forgejo-runner.sh reload

actions/example-without-docker-socket/.forgejo/workflows/test.yml

@@ -0,0 +1,6 @@
+on: [push]
+jobs:
+  test:
+    runs-on: docker
+    steps:
+      - run: "! test -e /var/run/docker.sock"

actions/example-workflow-call-expansion/.forgejo/workflows/reusable-layer-1.yml

@@ -0,0 +1,74 @@
+on:
+  workflow_call:
+    inputs:
+      input1:
+        required: true
+        type: string
+      input3:
+        required: true
+        type: string
+    outputs:
+      output1:
+        value: ${{ jobs.callee-1.outputs.job-output }}
+      output2:
+        value: ${{ jobs.callee-2.outputs.job-output }}
+      output3:
+        value: ${{ jobs.layer-2.outputs.output3 }}
+      output4:
+        value: ${{ jobs.layer-2.outputs.output4 }}
+
+jobs:
+  callee-1:
+    runs-on: docker
+    outputs:
+      job-output: callee-1-output
+    container:
+      image: data.forgejo.org/oci/node:22-bookworm
+      volumes:
+        - /srv/example:/srv/example
+    steps:
+      - name: verify workflow inputs
+        run: |
+          set -x
+          test "top-level-input1" = "${{ inputs.input1 }}"
+          test "dynamic output" = "${{ inputs.input3 }}"
+      - name: verify workflow secrets
+        run: |
+          set -x
+          test "AAAA" = "${{ secrets.secret1 }}"
+          test "BBBB1234" = "${{ secrets.secret2 }}"
+          test "" = "${{ secrets.secret3 }}" # wasn't specified to the workflow, should be absent
+      - name: indicate callee-1 hit
+        run: touch /srv/example/callee-1
+
+  layer-2:
+    needs: [callee-1]
+    uses: ./.forgejo/workflows/reusable-layer-2.yml
+    with:
+      input1: ${{ inputs.input1 }}
+      input2: mid-level-input2
+      input3: ${{ inputs.input3 }}
+      input4: ${{ needs.callee-1.outputs.job-output }}
+    secrets: inherit
+
+  callee-2:
+    needs: [callee-1, layer-2]
+    runs-on: docker
+    outputs:
+      job-output: callee-2-output
+    container:
+      image: data.forgejo.org/oci/node:22-bookworm
+      volumes:
+        - /srv/example:/srv/example
+    steps:
+      - name: verify callee-1 completed
+        run: |
+          set -x
+          test -f /srv/example/callee-1
+      - name: verify layer-2 completed
+        run: |
+          set -x
+          test -f /srv/example/callee-3
+          test -f /srv/example/callee-4
+      - name: indicate callee-2 hit
+        run: touch /srv/example/callee-2