Reusable Forgejo Actions Workflows

We've been working on some reusable workflows for self-hosted Forgejo runners. Please feel free to use some of these to get rolling 💙

• Docker Build and Push
• Publish Helm Charts
• Python Publish
• Renovate
• Check PR Labels
• Bump Semver After PR

Tip

Our recommended process for working with Helm repos:

1. Push your changes to a new branch as usual but do NOT manually edit the version field of your Chart.yaml.

2. Add a label to your branch indicating the type of semver bump needed. This should be enforced and validated by Check PR Labels.

3. When the PR is merged the Bump Semver After PR workflow will handle updating the Chart.yaml file and re-generating the docs.

4. After Bump Semver After PR has pushed it's changes to the main branch Publish Helm Charts will be triggered and create your releases and push your built charts to the specified registries.

Docker Build and Push

This workflow will build multi-arch images using Buildx and push them to Harbor and/or DockerHub. It expects to have SSH access to an ARM64 buildx agent.

We utilize local clones of the following official docker actions for this workflow:

• metadata-action
• setup-buildx-action
• login-action
• push-action

name: Build Firefox Kiosk Image
on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'Image Tag'
        required: true
        type: string
        default: "latest"

jobs:
  firefox-kiosk:
    uses: oeng/reusable-workflows/.forgejo/workflows/docker-build-and-push.yaml@main
    with:
      tag: ${{ inputs.tag }}
      path: "./firefox/"
      image: "firefox-kiosk"
      platforms: "linux/amd64,linux/arm64"
      docker_registry: "deserializeme"
      harbor_registry: "oeng"
    secrets:
      dockerhub_username: ${{ secrets.DOCKER_USER }}
      dockerhub_token: ${{ secrets.DOCKER_TOKEN }}
      harbor_username: ${{ secrets.HARBOR_USER }}
      harbor_token: ${{ secrets.HARBOR_TOKEN }}
      arm_runner_ip: ${{ secrets.ARM_RUNNER_IP }}

Publish Helm Charts

This workflow will generate a new release on Forgejo & Codeberg for your helm-chart based on the Version field in the Chart.yaml. It can also build and publish your helm chart to Codeberg, Forgejo, or a Harbor instance.

Tip

You'll need to have the following packages installed on your runner:

• wget
• git
• yq
• curl
• helm
• ct chart-testing
• jq

name: Release Charts

on:
  push:
    branches:
      - main
    paths:
      - 'charts/kubevirt-vm/Chart.yaml'
  workflow_dispatch:

jobs:
  # Push chart to Harbor via authenticated service account
  push-to-harbor:
    uses: oeng/reusable-workflows/.forgejo/workflows/publish-charts.yaml@main
    with:
      harbor_url: harbor.open.engineering
      harbor_project: charts
      force: false
      chart_dir: charts
      chart: kubevirt-vm
      release: false
    secrets:
      harbor_user: ${{ secrets.HARBOR_USER }}
      harbor_token: ${{ secrets.HARBOR_TOKEN }}

  # Push chart to Forgejo and also generate a new release
  push-to-forgejo-and-create-release:
    uses: oeng/reusable-workflows/.forgejo/workflows/publish-charts.yaml@main
    with:
      forgejo_url: https://git.open.engineering
      owner: oengwritefreely-helm-chart

      repo: kubevirt-community-stack
      force: false
      chart_dir: charts
      chart: kubevirt-vm
      release: true
    secrets:
      forgejo_api_token: ${{ secrets.FORGE_TOKEN }}

  # Push chart to Codeberg
  push-to-codeberg:
    uses: oeng/reusable-workflows/.forgejo/workflows/publish-charts.yaml@main
    with:
      owner: oeng
      repo: kubevirt-community-stack
      force: false
      chart_dir: charts
      chart: kubevirt-vm
      codeberg: true
      release: false
    secrets:
      codeberg_token: ${{ secrets.CODEBERG_TOKEN }}

Python Publish

This currently can build and release a python poetry project to pypi.org and then publish a release including the wheel to your forgejo repo's releases.

Tip

You'll need to have poetry already installed on your runner.

---
name: Python package build and publish
on:
  push:
    branches:
      - main
    paths:
      - pyproject.toml

  workflow_dispatch:

jobs:
  build-and-publish:
    uses: oeng/reusable-workflows/.forgejo/workflows/python-publish.yaml@main
    with:
      # the url of your self-hosted forgejo instance
      forgejo_url: https://git.open.engineering
      # your repo's owner here
      owner: oeng
      # your repo's short name here (without the owner)
      repo: smol-k8s-lab
      force: false
      release: true
      # set this to false if you don't want to create a release on codeberg
      codeberg: true
    # you'll need to create these either at the repo or org level
    secrets:
      forgejo_api_token: ${{ secrets.FORGE_TOKEN }}
      codeberg_token: ${{ secrets.CODEBERG_TOKEN }}
      # we recommend generating a token per project
      pypi_token: ${{ secrets.PYPI_TOKEN }}

Renovate

This action runs self-hosted Renovate using the official renovatebot/github-action.

name: Renovate
on:
  workflow_dispatch:
  schedule:
  # This should be every hour
  - cron: '55 * * * *'
  push:
    branches:
      - main
    paths:
      - ".github/renovate-config.json"
      - ".github/workflows/renovate.yml"
      - "renovate.json"
      - "scripts/**"
jobs:
  renovate:
    uses: oeng/reusable-workflows/.forgejo/workflows/renovate.yaml@main
    secrets: inherit

Check PR Labels

This action will validate if a PR has been labeled with one of the following labels: major, minor, patch.

Tip

You'll need to have the following packages installed on your runner:

• wget
• jq

name: Check PR Labels

on:
  pull_request:
    types: [opened, synchronize, edited, labeled]

permissions:
  contents: read

jobs:
  check-pr-labels:
    uses: oeng/reusable-workflows/.forgejo/workflows/check-pr-labels.yaml@main
    with:
      default_patch: false
      skip_checks: ""

Bump Semver After PR Merge

This workflow will update the Chart.yaml of a help chart with a new semver derived from the labels assigned to the PR. It will also regenerate the README using helm-docs.

The updated files will then be committed and pushed to the main branch.

Tip

You'll need to have the following packages installed on your runner:

• wget
• yq
• jq
• git
• helm-docs

name: bump-semver-after-pr.yaml
on:
  pull_request:
    types: [closed]
    branches:
      - main
permissions:
  contents: read
jobs:
  bump-semver:
    if: forgejo.event.pull_request.merged == true
    uses: oeng/reusable-workflows/.forgejo/workflows/bump-semver-after-pr.yaml@main
    with:
      default_patch: false
      skip_checks: ""
      chart: ./charts/generic-app
    secrets:
      pat_for_checkout: ${{ secrets.PAT_FOR_CHECKOUT }}