Replace Woodpecker docs pipeline with Forgejo Actions #35
Loading…
Reference in a new issue
No description provided.
Delete branch "refs/pull/35/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Replaces the Woodpecker docs pipeline with an equivalent Forgejo Actions workflow. Uses git-pages/action@v2 to upload directly to grebedoc.dev, removing the webhook dependency. forge.token handles both the pages branch push and grebedoc authentication via the existing DNS allowlist record.
Closes #34
.forgejo/workflows/docs.ymlline 19✅ Fixed in commit
32a3cf3— replacedcurl -LsSf https://astral.sh/uv/install.sh | shwithpip install uv. This eliminates the curl-pipe risk and uses PyPI's HTTPS + package hash verification instead. The "Add uv to PATH" step was also removed (pip installs to the system PATH onubuntu-latestdirectly)..forgejo/workflows/docs.ymlline 39✅ Fixed in commit
32a3cf3—${{ github.ref_name }}is now passed through anenv:block asTAG_NAMEand referenced as"$TAG_NAME"(quoted) in the shell command. This separates Actions expression evaluation from shell execution, eliminating the injection surface..forgejo/workflows/docs.ymlline 19✅ Already fixed in commit
32a3cf3— replacedcurl -LsSf https://astral.sh/uv/install.sh | shwithpip install uv. The "Add uv to PATH" step was also removed as pip installs directly to the system PATH..forgejo/workflows/docs.ymlline 39✅ Already fixed in commit
32a3cf3—${{ github.ref_name }}is now passed through anenv:block asTAG_NAMEand referenced as"$TAG_NAME"(quoted) in the shell command, separating Actions expression evaluation from shell execution..forgejo/workflows/docs.ymlline 36🔴 Acknowledged but not actioned. This is the standard pattern for token-authenticated git pushes in Forgejo/GitHub Actions CI. The token is not hardcoded — it is injected at runtime via the
env:block (FORGEJO_TOKEN: ${{ forge.token }}), so it does not appear in the workflow file itself. Forgejo Actions masks values that originate from the token context in log output. A credential-helper approach would eliminate the process-listing exposure but adds meaningful complexity for a singlegit remote set-url+git pushoperation; the risk/benefit tradeoff favours keeping the current pattern here..forgejo/workflows/docs.ymlline 36🔴 Not actioned —
forge.tokenis intentional. Thegit-pages/actionREADME (codeberg.org/git-pages/action) explicitly uses${{ forge.token }}in its example workflows; this is Forgejo Actions' built-in repository token, analogous to${{ github.token }}in GitHub Actions. It does not require a named secret. If it fails to resolve on the first real tag push, the fallback is straightforward: add the PAT as a named secret and switch to${{ secrets.CODEBERG_TOKEN }}..forgejo/workflows/docs.ymlline 52🔴 Same reasoning as the Configure git step above —
forge.tokenis the correct Forgejo Actions built-in token per the git-pages/action documentation. Both uses are consistent and intentional. Will verify on first live run.