ci: add Forgejo Actions PR workflow with Go cache #143

Merged

goern merged 1 commit from refs/pull/143/head into main

2026-05-24 07:35:47 +00:00

goern commented

2026-05-24 07:26:32 +00:00

(Migrated from codeberg.org)

Summary

Step 2 of CI hardening (see beads forgejo-mcp-9n2). Adds .forgejo/workflows/ci.yml mirroring the Tekton go-ci task gates on Codeberg's codeberg-small runners with actions/setup-go's built-in module + build cache.

Why a second CI surface

Cross-run cache: Tekton uses an ephemeral PVC; nothing carries over between PipelineRuns. actions/setup-go caches ~/go/pkg/mod and the build cache keyed on go.sum, so steady-state PRs hit the cache and finish quickly.
Contributor visibility: Forgejo Actions status checks render natively inside the PR UI. Tekton/PaC posts a comment but isn't first-class.
No new external infra: runs on existing Codeberg runners.

Per forgejo-mcp-td8, we run both CIs in parallel for ~2 weeks, then pick a canonical PR gate and retire the other.

Steps mirrored from go-ci

Step	Same as Tekton?
build (`make build`)	yes
`go vet ./...`	yes
`gofmt -l`	yes
`go mod tidy` drift	yes
`golangci-lint` (warn-only via `continue-on-error: true`)	yes
`go test -race -shuffle=on -count=1 ./...`	yes
`govulncheck ./...`	yes

Design notes

concurrency.cancel-in-progress: true for ci-${{ workflow }}-${{ ref }} — superseded pushes auto-cancel.
permissions: contents: read only; no token escalation.
GOTOOLCHAIN=local at env level — prevents silent toolchain upgrades that would diverge from go.mod.
timeout-minutes: 15 for cold cache. Cache hit should land <5min per acceptance criterion.
golangci-lint pinned to v1.64 (matches Tekton task pin).

Test plan

First run on this PR completes (cold cache; ~slow expected)
Subsequent run on this PR hits cache; finishes <5min
All gates pass (lint warn-only, others enforcing)
Status check renders inside Codeberg PR UI
No collision with the Tekton PaC pipeline (both fire independently)

Follow-ups

After 2 weeks: forgejo-mcp-td8 — decide canonical PR gate, drop the loser.
After baseline cleanup: flip continue-on-error: false on the lint step.

Refs forgejo-mcp-9n2.

## Summary Step 2 of CI hardening (see beads `forgejo-mcp-9n2`). Adds `.forgejo/workflows/ci.yml` mirroring the Tekton `go-ci` task gates on Codeberg's `codeberg-small` runners with `actions/setup-go`'s built-in module + build cache. ## Why a second CI surface - **Cross-run cache**: Tekton uses an ephemeral PVC; nothing carries over between PipelineRuns. `actions/setup-go` caches `~/go/pkg/mod` and the build cache keyed on `go.sum`, so steady-state PRs hit the cache and finish quickly. - **Contributor visibility**: Forgejo Actions status checks render natively inside the PR UI. Tekton/PaC posts a comment but isn't first-class. - **No new external infra**: runs on existing Codeberg runners. Per `forgejo-mcp-td8`, we run both CIs in parallel for ~2 weeks, then pick a canonical PR gate and retire the other. ## Steps mirrored from go-ci | Step | Same as Tekton? | |---|---| | build (`make build`) | yes | | `go vet ./...` | yes | | `gofmt -l` | yes | | `go mod tidy` drift | yes | | `golangci-lint` (warn-only via `continue-on-error: true`) | yes | | `go test -race -shuffle=on -count=1 ./...` | yes | | `govulncheck ./...` | yes | ## Design notes - `concurrency.cancel-in-progress: true` for `ci-${{ workflow }}-${{ ref }}` — superseded pushes auto-cancel. - `permissions: contents: read` only; no token escalation. - `GOTOOLCHAIN=local` at env level — prevents silent toolchain upgrades that would diverge from `go.mod`. - `timeout-minutes: 15` for cold cache. Cache hit should land <5min per acceptance criterion. - golangci-lint pinned to `v1.64` (matches Tekton task pin). ## Test plan - [x] First run on this PR completes (cold cache; ~slow expected) - [ ] Subsequent run on this PR hits cache; finishes <5min - [x] All gates pass (lint warn-only, others enforcing) - [x] Status check renders inside Codeberg PR UI - [x] No collision with the Tekton PaC pipeline (both fire independently) ## Follow-ups - After 2 weeks: `forgejo-mcp-td8` — decide canonical PR gate, drop the loser. - After baseline cleanup: flip `continue-on-error: false` on the lint step. Refs forgejo-mcp-9n2.

op1st-gitops commented

2026-05-24 07:26:35 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-q77tf is running.

Starting Pipelinerun on-pull-request-q77tf in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-q77tf -f

op1st Pipelines as Code/on-pull-request-q77tf is running. Starting Pipelinerun <b>[on-pull-request-q77tf](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-q77tf)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-q77tf) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-q77tf -f</code>

op1st-gitops commented

2026-05-24 07:26:35 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-qwkjd is running.

Starting Pipelinerun code-scans-qwkjd in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-qwkjd -f

op1st Pipelines as Code/code-scans-qwkjd is running. Starting Pipelinerun <b>[code-scans-qwkjd](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qwkjd)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qwkjd) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-qwkjd -f</code>

op1st-gitops commented

2026-05-24 07:26:58 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-qwkjd has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: code-scans-qwkjd

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	fetch-source
Succeeded	8 seconds	gitleaks-version
Succeeded	10 seconds	gitleaks

op1st Pipelines as Code/code-scans-qwkjd has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qwkjd">code-scans-qwkjd</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qwkjd/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>8 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qwkjd/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-qwkjd/logs/gitleaks) </td></tr> </table>

op1st-gitops commented

2026-05-24 07:28:39 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-q77tf has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: on-pull-request-q77tf

Task Statuses:

Status	Duration	Name
Succeeded	9 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-q77tf has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-q77tf">on-pull-request-q77tf</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-q77tf/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-q77tf/logs/build-and-test) </td></tr> </table>