forgejo-ci — shared CI for git.simkinetic.tech

Shared composite actions consumed by the repos on this instance. This repo must stay public (it lives under the public OpenResearch org for exactly that reason): the runner fetches it anonymously. It contains no secrets and no tokens — ever.

The one rule that matters: full-URL uses:

steps:
  - uses: https://git.simkinetic.tech/OpenResearch/forgejo-ci/checkout@v1
  - uses: https://git.simkinetic.tech/OpenResearch/forgejo-ci/reuse-lint@v1

Empirical facts, measured on this instance (Forgejo 16.0.2, forgejo-runner 12.1.0, 2026-08-05):

• Bare OpenResearch/forgejo-ci/<action>@ref does NOT work. Forgejo resolves the short form against DEFAULT_ACTIONS_URL (code.forgejo.org / github mirrors), not against this instance. The job dies at scheduling: a 0-second failure with no logs.
• Cross-repo reusable workflows (workflow_call) do NOT execute here. They expand (the job entry appears) but fail at scheduling every time. Composite actions are the sharing mechanism — do not add .forgejo/workflows/*.yml with on: workflow_call to this repo.
• actions/checkout@v4 is a node action. It only runs in containers that have node (e.g. the runner's default node:22-bookworm). In a python:* container it dies with exec: "node": not found — use this repo's bash-only checkout action instead.
• Expressions in runs-on: are not evaluated by this runner generation — runner labels must be literal strings in the caller.
• Triggers: on: [push] fires reliably on pushing a fresh branch. workflow_dispatch only works for workflows registered from the caller repo's default branch; re-pushes to an existing branch are unreliable. To prove a workflow, push a fresh branch.

Runners (this instance, 2026-08-05)

label	machine	notes
Internal	boltzmann	capital I, case-sensitive; default job container node:22-bookworm; no docker client in-container
ludwig	boltzmann (dind)	container: image: docker:cli + DOCKER_HOST injected by runner config

Actions

action	what it does	job requirements
checkout	plain-git, token-authed, shallow checkout of GITHUB_SHA; bash-only, no node	container with git + bash (python:3.13-bookworm yes, *-slim no)
reuse-lint	REUSE compliance lint over the checked-out tree	python3 (venv bootstrapped via apt if missing)
pytest-cpu	pip deps + meson-python build (-Dgpu-backend=none) + pytest -m "not gpu"	Debian-based python container (apt build deps)
python-wheel	build a wheel (+optional sdist) via meson-python, smoke-import it	Debian-based python container / GPU box toolchain

Every action documents its inputs and the exact local-reproduction commands in its own action.yml header. The caller always does the checkout first; actions operate on the working tree.

Versioning

Callers pin the v1 tag, never @main. While the consumer count is one repo (day zero), v1 is a moving tag; once a second repo consumes these actions, v1 freezes and breaking input changes bump to v2.

examples/

examples/smoke-action is the historical probe that first proved cross-repo composite-action execution on this instance (gpu-be-mom run #68, 2026-08-05). Kept as the minimal reference for adding a new action.