morri/_forgejo-templates

Reusable Forgejo Actions workflows (compatible with GitHub Actions semantics) for all production-deployed repos under morri/* on git.buengener-solution.de.

Public or private?

This is the public flavour. It contains no secrets, no repo-internal details, only generic enterprise patterns (concurrency, SHA-pinned actions, smoke tests, image scanning). Any caller repo can uses: these without extra auth setup.

For organisation-internal helpers that require private Forgejo access (prisma-deploy.yml with DB credentials, token audit), see the companion repo morri/_forgejo-templates-private (planned, Phase 0b).

Reusable workflows

File	Purpose	Current / planned callers
python-ci.yml	Python repos: lint, compile, import smoke, tests	krb_tetraguard, freelancer-automation
node-ci.yml	Node/Next.js repos: lint, typecheck, tests, build	buengener-*, buengener-portal, KiDara-frontend
docker-deploy.yml	Docker container on host runner: build, scan, deploy, smoke, rollback	buengener-software, buengener-solution, buengener-portal
static-ftp-deploy.yml	Static site via lftp/FTPS to Hostinger	hotel-obermaubach, bsv-kreuzau
trivy-scan.yml	Standalone Trivy image scanner (CRITICAL blocks, HIGH report-only)	any image-build pipeline

How to use

In the caller's .forgejo/workflows/<name>.yml:

on:
  push:
    branches: [main]
  workflow_dispatch:

concurrency:
  group: deploy-prod-${{ github.repository }}
  cancel-in-progress: false

jobs:
  deploy:
    uses: morri/_forgejo-templates/.forgejo/workflows/docker-deploy.yml@v1
    with:
      image-name: 'buengener-website'
      deploy-dir: '/opt/buengener-website'
      container-network: 'matrix_default'
      health-url: 'https://buengener-software.de'
      build-args: 'AUTH_SECRET'
    secrets:
      DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
      AUTH_SECRET: ${{ secrets.AUTH_SECRET }}
      SESSION_SECRET: ${{ secrets.SESSION_SECRET }}
      WEBHOOK_URL: ${{ secrets.ALERT_WEBHOOK }}

Version pinning:

• Pin to a specific tag (@v1.2.0) for production deploy workflows — strict, no surprises.
• Pin to a major tag (@v1) for CI-only workflows where auto-minor updates are welcome.
• Never pin to @main or @master in a caller.

Action versioning

All third-party Actions are SHA-pinned. The mapping SHA → semver is tracked in ACTION_VERSIONS.md. To bump an Action:

1. Check upstream for a new release: git ls-remote https://github.com/OWNER/REPO refs/tags/vX.Y.Z
2. Update the SHA in the workflow file (both the uses: and ACTION_VERSIONS.md)
3. Bump the templates-repo tag (v1.x.y) and push
4. Update all callers' pinned versions

Automation helper: ./scripts/update-action-shas.sh rewrites the inline SHA comments across all workflow files in one pass.

Caller prerequisites

• Forgejo 15.0.3+ on the instance (this is the version running on git.buengener-solution.de — supports workflow_call).
• The runner labels referenced by the reusable (vps-runner, docker, kidara) must exist on the caller's runner. See 04-System/forgejo-setup.md in the morri-vault for the current runner topology.
• All secrets referenced by the reusable must be configured in the caller's repo settings (Forgejo → Repo → Settings → Secrets).

Changelog

CHANGELOG.md will be created on first release. Until then, see commit history.