fix(ci): Forgejo release workflow fails — third-party actions not available on runner #134

New issue

Open

opened 2026-07-07 23:02:07 -07:00 by pyr0ball · 0 comments

pyr0ball commented

2026-07-07 23:02:07 -07:00

Owner

Problem

The .forgejo/workflows/release.yml workflow fails immediately (~4 seconds) when triggered by a v* tag push. The runner picks up the job but cannot execute third-party actions:

orhun/git-cliff-action@v3
docker/setup-qemu-action@v3
docker/setup-buildx-action@v3
docker/login-action@v3
docker/build-push-action@v6

The CI workflow (ci.yml) succeeds because it only uses actions/checkout@v4 and actions/setup-python@v5, which appear to be available.

Context

Forgejo version: 9.0.3
Runner: self-hosted on Heimdall (ubuntu-latest label)
Tag that triggered: v0.9.8 (run IDs 202, 204 on Forgejo)
Workaround used for v0.9.8: built images locally and pushed to GHCR manually; created Forgejo release via API

Possible causes

Runner is configured with ACTIONS_RUNNER_SKIP_CHECKOUT=true or no external action fetch allowed
Runner has no internet access to github.com for action downloads
Runner needs --config-file to point at a local action mirror (Gitea/Forgejo supports [actions] DEFAULT_ACTIONS_URL)
Required secrets (FORGEJO_RELEASE_TOKEN, GH_GHCR_TOKEN, FORGEJO_CF_ORCH_TOKEN) were missing at first trigger — these are now set at org scope, but the action-fetch failure happens before secret injection anyway

Fix options

Option A — Configure Forgejo to fetch actions from GitHub (simplest)
In app.ini under [actions]:

DEFAULT_ACTIONS_URL = https://github.com

Requires runner to have outbound access to github.com. Verify with: curl -I https://github.com/orhun/git-cliff-action from the runner host.

Option B — Mirror required actions locally
Mirror each action repo into git.opensourcesolarpunk.com/actions/ org:

actions/checkout
orhun/git-cliff-action
docker/setup-qemu-action
docker/setup-buildx-action
docker/login-action
docker/build-push-action

Then update app.ini:

DEFAULT_ACTIONS_URL = https://git.opensourcesolarpunk.com

Option C — Replace third-party actions with inline shell steps
Rewrite release.yml using run: steps instead of uses: for everything except checkout:

Replace git-cliff-action with pip install git-cliff && git cliff --latest
Replace docker actions with direct docker buildx shell commands
Replace Forgejo release creation with the existing curl pattern already at the bottom

Option C is the most self-contained and removes the external action dependency entirely.

Recommended approach

Option A first (5-minute config change). If the runner has no GitHub access, fall back to Option C (rewrite with inline steps).

SSRF fix for wizard endpoints: #133
v0.9.8 release was published manually as a workaround

## Problem The `.forgejo/workflows/release.yml` workflow fails immediately (~4 seconds) when triggered by a `v*` tag push. The runner picks up the job but cannot execute third-party actions: - `orhun/git-cliff-action@v3` - `docker/setup-qemu-action@v3` - `docker/setup-buildx-action@v3` - `docker/login-action@v3` - `docker/build-push-action@v6` The CI workflow (`ci.yml`) succeeds because it only uses `actions/checkout@v4` and `actions/setup-python@v5`, which appear to be available. ## Context - Forgejo version: 9.0.3 - Runner: self-hosted on Heimdall (`ubuntu-latest` label) - Tag that triggered: `v0.9.8` (run IDs 202, 204 on Forgejo) - Workaround used for v0.9.8: built images locally and pushed to GHCR manually; created Forgejo release via API ## Possible causes 1. Runner is configured with `ACTIONS_RUNNER_SKIP_CHECKOUT=true` or no external action fetch allowed 2. Runner has no internet access to `github.com` for action downloads 3. Runner needs `--config-file` to point at a local action mirror (Gitea/Forgejo supports `[actions] DEFAULT_ACTIONS_URL`) 4. Required secrets (`FORGEJO_RELEASE_TOKEN`, `GH_GHCR_TOKEN`, `FORGEJO_CF_ORCH_TOKEN`) were missing at first trigger — these are now set at org scope, but the action-fetch failure happens before secret injection anyway ## Fix options **Option A — Configure Forgejo to fetch actions from GitHub (simplest)** In `app.ini` under `[actions]`: ```ini DEFAULT_ACTIONS_URL = https://github.com ``` Requires runner to have outbound access to `github.com`. Verify with: `curl -I https://github.com/orhun/git-cliff-action` from the runner host. **Option B — Mirror required actions locally** Mirror each action repo into `git.opensourcesolarpunk.com/actions/` org: - `actions/checkout` - `orhun/git-cliff-action` - `docker/setup-qemu-action` - `docker/setup-buildx-action` - `docker/login-action` - `docker/build-push-action` Then update `app.ini`: ```ini DEFAULT_ACTIONS_URL = https://git.opensourcesolarpunk.com ``` **Option C — Replace third-party actions with inline shell steps** Rewrite `release.yml` using `run:` steps instead of `uses:` for everything except `checkout`: - Replace `git-cliff-action` with `pip install git-cliff && git cliff --latest` - Replace docker actions with direct `docker buildx` shell commands - Replace Forgejo release creation with the existing `curl` pattern already at the bottom Option C is the most self-contained and removes the external action dependency entirely. ## Recommended approach Option A first (5-minute config change). If the runner has no GitHub access, fall back to Option C (rewrite with inline steps). ## Related - SSRF fix for wizard endpoints: #133 - v0.9.8 release was published manually as a workaround