Port caddy-shortcuts daily cron from GHA to Forgejo Actions #118

New issue

Closed

opened 2026-05-25 05:15:45 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-05-25 05:15:45 +00:00

Owner

Final workflow in the GHA→Forgejo migration push following #115.

The GHA version used GH GraphQL createCommitOnBranch so commits would be auto-signed by GitHub's web-flow key (required by the GH repo ruleset for signed commits). Forgejo has no equivalent path. We trade the signature badge for not coupling to GitHub's API.

New workflow uses the auto-injected Forgejo secrets.GITHUB_TOKEN for the git push back to the Forgejo repo, and a separately-configured Forgejo Actions secret GH_PAT (synced from SSM /github/pat) for the script's reads against sibling GH repos.

Known trade-off: runner-side commits land on Forgejo only. GH catches up on Kai's next manual push via the local fan-out remote. If this proves annoying, switch on a server-side Forgejo→GH push-mirror later.

Final workflow in the GHA→Forgejo migration push following #115. The GHA version used GH GraphQL `createCommitOnBranch` so commits would be auto-signed by GitHub's web-flow key (required by the GH repo ruleset for signed commits). Forgejo has no equivalent path. We trade the signature badge for not coupling to GitHub's API. New workflow uses the auto-injected Forgejo `secrets.GITHUB_TOKEN` for the `git push` back to the Forgejo repo, and a separately-configured Forgejo Actions secret `GH_PAT` (synced from SSM `/github/pat`) for the script's reads against sibling GH repos. Known trade-off: runner-side commits land on Forgejo only. GH catches up on Kai's next manual push via the local fan-out remote. If this proves annoying, switch on a server-side Forgejo→GH push-mirror later.

coilysiren commented

2026-05-25 05:19:03 +00:00

Author

Owner

Revised: zero GitHub coupling. The script now reads sibling coily.yaml from forgejo.coilysiren.me via the Forgejo API. The auto-injected GITHUB_TOKEN is a Forgejo-issued token in this context (runs-on: docker on the in-cluster runners), used for both the sibling reads and the commit-back push. No GH PAT involved. The GH_PAT Forgejo Actions secret created earlier has been deleted.

Revised: zero GitHub coupling. The script now reads sibling coily.yaml from `forgejo.coilysiren.me` via the Forgejo API. The auto-injected `GITHUB_TOKEN` is a Forgejo-issued token in this context (`runs-on: docker` on the in-cluster runners), used for both the sibling reads and the commit-back push. No GH PAT involved. The `GH_PAT` Forgejo Actions secret created earlier has been deleted.

coilysiren referenced this issue from a commit

2026-05-25 05:19:17 +00:00

feat(ci): port caddy-shortcuts to Forgejo Actions, drop GitHub coupling (closes https://forgejo.coilysiren.me/coilysiren/infrastructure/issues/118)

coilysiren closed this issue

2026-05-25 05:19:17 +00:00

coilysiren referenced this issue

2026-05-25 05:26:41 +00:00

caddy-shortcuts: regression after Forgejo port nuked 4 sites #120

coilysiren referenced this issue

2026-05-25 05:30:21 +00:00

caddy-shortcuts: render shortcuts from private Forgejo sibling repos #121