giovannino/forgejo-mcp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
forgejo-mcp/openspec/changes/forgejo-action-code-review/spikes/c5-cross-repo-workflow-call
History
Exact
Christoph Görn 48809bd3a5
 docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 
Adversarial review surfaced 9 critiques: 7 patched, 1 resolved by spike,
1 deferred. Most damaging: --comment/--dry-run flag inversion and
fabricated dedup SHA-trailer mechanism — both indicated the change was
written against the dep change's design rather than the shipped skill
artifact.

Artifacts:
- new design.md with 12 decisions (D2 no-PR-head-checkout, D6 dedup,
  D7 ephemeral token, D9 dist split, D10 failure matrix, D11 skill
  invocation prompt, D12 --allowedTools whitelist) and Risks
- new battle-test.md with critique inventory, dispositions, patches
- proposal.md: corrected cost range, flag, --allowedTools detail
- spec.md: 9 patches — split copy-paste vs uses: paths, no PR-head
  checkout, dedup contract, allowed-tools restriction, max_turns soft
  cap, PR# pass requirement

C4 spike (2026-05-13) validated D2+D7 on Codeberg Forgejo v11.x.
Ephemeral GITEA_TOKEN + permissions: pull-requests: write permits
create_pull_review on fork PR; pull_request_target executes BASE
workflow file (display label pull_request is cosmetic). Spike
artifacts retained for reproducibility.

C5 spike (cross-repo workflow_call) scaffolded but deferred; tracked
in forgejo-mcp-33k. Cleanup of Codeberg test repos tracked in
forgejo-mcp-p0y.
2026-05-13 08:34:17 +02:00
..
spike-consumer/.forgejo/workflows docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 2026-05-13 08:34:17 +02:00
spike-lib/.forgejo/workflows docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 2026-05-13 08:34:17 +02:00
README.md docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike 2026-05-13 08:34:17 +02:00

README.md

C5 spike — cross-repo workflow_call on Forgejo Actions

Question

Does Codeberg's Forgejo (currently v11.x) support cross-repo workflow_call with uses: <owner>/<repo>/.forgejo/workflows/<file>.yml@<tag> syntax, the way GitHub Actions does? Specifically:

  1. Does Forgejo resolve the called workflow at the pinned tag?
  2. Does secrets: inherit (or explicit secrets: mapping) propagate caller secrets to the called workflow?
  3. Does the called workflow receive the caller's github.event context (so triggers like pull_request see PR data)?

Method

  1. Create library repo on Codeberg, e.g. goern/c5-spike-lib.
  2. Push spike-lib/.forgejo/workflows/reusable.yml into it.
  3. Create a tag v0.0.1 on the library repo's default branch.
  4. Set repo secret SPIKE_SECRET on goern/c5-spike-lib (any throwaway value, e.g. library-side-secret).
  5. Create consumer repo on Codeberg, e.g. goern/c5-spike-consumer.
  6. Push spike-consumer/.forgejo/workflows/caller.yml into it (the file references goern/c5-spike-lib@v0.0.1; edit the uses: line to match the library you created).
  7. Set repo secret SPIKE_SECRET on goern/c5-spike-consumer (any throwaway value, e.g. consumer-side-secret).
  8. Trigger the caller in two ways and observe behavior:
    • Push trigger: push a commit to the consumer's main branch. Observe whether the caller workflow runs and reaches the library.
    • PR trigger: open a PR on the consumer repo. Observe whether the called workflow sees the PR event context.
  9. Record what the called workflow prints for:
    • inputs.who (should be "consumer")
    • github.event_name, github.repository, github.ref
    • PR number and base ref (PR trigger only)
    • SPIKE_SECRET length

Recorded outcomes

Outcome Implication for design D9
All three properties work (resolution, secrets, event context) Keep D9 Path B as recommended; remove "pending C5 spike" markers in design.md D9 and spec.md scenarios
Resolution works but secrets: inherit (or mapping) does not propagate Document that consumers must duplicate secrets into the library repo, or fall back to copy-paste (Path A)
Resolution works but event context is caller's repo not the consumer's PR Document that fork-PR review logic must be careful about which github.repository is in scope; this may break the action's PR-number passing
Resolution fails (Forgejo does not support cross-repo uses:) Collapse D9 to copy-paste only (Path A); update spec scenarios

State that will be created

  • Two repos under goern/ (recommend deleting after spike)
  • One tag on the library repo
  • A handful of workflow run records on both repos
  • Two repo secrets (throwaway values — do not reuse production secrets)

Time budget

~30 minutes total: scaffold (10), trigger (5), observe + record (15).

What I cannot do from this session

  • Setting repo secrets via API requires user authentication; user must do this manually via Codeberg web UI or via forgejo-mcp (if it exposes a secret-create tool — check mcp__codeberg__* tool list).