Connple Forgejo Actions

Public, versioned Actions shared by Connple repositories. Product repositories describe only their checks, Docker context or target, and runtime smoke test. This repository owns Docker tools, BuildKit caches, release gates, short-lived Forgejo authentication, registry naming, metadata, immutable publication, and monotonic promotion.

Consumers use the mutable major tag after its immutable audit tag has passed this repository's CI:

- uses: https://code.connple.com/connple-actions/forgejo-actions/setup-ci@v1

v1 is moved manually. No workflow in this repository creates Forgejo Release records or consumes organization secrets.

Actions

setup-ci

Restores or installs Docker CLI 29.7.2 and Compose 5.5.0 for Linux AMD64. Downloads are checksum verified, and the cached binaries are added to the current job's path. With an Authorized Integration audience, it also writes a short-lived package-read credential to the runner's npm configuration and outputs the masked token for a BuildKit secret.

oci-image

Builds one conventional linux/amd64 image, owns its exact-commit BuildKit cache, and validates the common OCI labels. name is omitted for a single-image repository and names a nested image in a multi-image repository. In CD, publish: true validates the tag, main ancestry and exact CI run, issues a short-lived package-write token, and publishes the immutable version.

- id: image
  uses: https://code.connple.com/connple-actions/forgejo-actions/oci-image@v1
  with:
    name: api
    context: apps/api
    target: app
    audience: ${{ vars.CD_AUDIENCE }}
    publish: true

oci-promote

Accepts only an Authorized Integration audience and, for a multi-image repository, image names. It revalidates every immutable image and every current alias before mutation. Missing or lower latest aliases advance image by image, higher versions remain unchanged, and a same-version different-digest alias is rejected.

npm-package

Validates the release gate, rebuilds and verifies the repository package, issues a short-lived package-write token, publishes a missing immutable version under a temporary dist-tag, checks the remote tarball checksum, advances latest monotonically, and removes the temporary tag. An existing version is reusable only when its tarball bytes are identical.

These four directories are the complete public Action surface.

Development

bun install --frozen-lockfile
bun run check

Source lives under src; generated Node 20 bundles under each Action's dist directory are committed and checked for drift by CI.