workflows

Forgejo Actions workflows shared by the home-lab stacks. A stack calls one with a short workflow of its own instead of carrying a copy.

Workflow	Does	Called by
.forgejo/workflows/release-label.yml	Checks that a pull request has exactly one release label; reports release / label (pull_request), which merging requires	Every stack's .forgejo/workflows/release-label.yml, on pull requests
.forgejo/workflows/release-tag.yml	After a merge, tags the next release	Every stack's .forgejo/workflows/release-tag.yml, on pushes to main
.forgejo/workflows/ci.yml	This repository's own check: the workflows parse and their shell steps pass shellcheck	—

How releases work: docs/deployments.md in home-lab/infrastructure.

Calling them

Every stack has two callers, both named release, so the called jobs are reported as release / label and release / tag. Copy them from onboarding/templates in home-lab/infrastructure.

.forgejo/workflows/release-label.yml:

name: release

on:
  pull_request:
    types: [opened, reopened, synchronize, labeled, unlabeled]

jobs:
  # No runs-on: Forgejo then runs the called job as a job of this run,
  # reported as `release / label`.
  check-label:
    uses: public/workflows/.forgejo/workflows/release-label.yml@v2.0.0
    with:
      repository: ${{ github.repository }}
      pull_request: ${{ github.event.pull_request.number }}
      labels: ${{ join(github.event.pull_request.labels.*.name, ',') }}

.forgejo/workflows/release-tag.yml:

name: release

on:
  push:
    branches: [main]

jobs:
  # No runs-on: Forgejo then runs the called job as a job of this run.
  tag-release:
    uses: public/workflows/.forgejo/workflows/release-tag.yml@v2.0.0
    with:
      repository: ${{ github.repository }}
      sha: ${{ github.sha }}
    secrets: inherit

What Forgejo 17 does with called workflows, found out in progress:

• No if:, neither in the caller nor in the called jobs. Forgejo skips a called workflow whose calling job has an if:, even one that is true, and conditions on github.event_name inside called jobs were false on a pull request too. Hence one caller per trigger instead of conditions.
• Inputs may be expressions (${{ github.repository }}); they are evaluated in the caller. The called jobs rely only on their inputs, and print what Forgejo hands them besides (step Context).
• A skipped job counts as passed for branch protection. If the label check of a pull request ever shows skipped, anything can be merged: fix the caller.

secrets: inherit hands the tag job RELEASE_TOKEN from the organisation.

Why this repository is public

Forgejo only runs a workflow from another repository if that repository is public, and in practice its owner too. The workflows hold no secrets: those stay in the callers' Actions settings.

That's why it lives in the organisation public and not in home-lab: packages take the visibility of their owner, so a public home-lab would publish every stack's images. Keep public to this repository, and never publish packages here.

Changing a workflow

Callers pin a version, so a change reaches no stack until it is released:

1. Change it in a pull request; ci / check (pull_request) must pass.
2. Tag a release on main, signed: git tag -s v2.1.0 -m v2.1.0 && git push origin v2.1.0. A change callers must adapt to (inputs, files) is a new major version.
3. Renovate updates the reference in every stack (labelled release/none, since nothing on capri changes), or update it by hand.

Whoever can change a released tag here decides how every stack is released, so tags v* are protected like in the stacks, but only you may create them (not release-bot). Released tags are never moved.

Setup

The repository is set up by hand, as it is not a stack:

• public/workflows, public, SHA-256, in the public organisation public.
• Settings → Repository: fast-forward merges only, like the stacks.
• Settings → Tags: v* protected, only rngcntr.
• Settings → Branches: main without pushes, requiring ci / check (pull_request).
• renovate has write access, for updates of the actions and images the workflows use, and public/* is in autodiscoverFilter in rngcntr/renovate's config.js.