Establish versioned workflows reusable across organizations

kiyi commented

2026-09-03 21:26:36 -05:00

Member

Provide reusable Forgejo Actions for personal repositories and any organization, with no Homelab-specific cluster, registry, domain or secret names in generic jobs.

Acceptance:

Versioned workflow_call interfaces and caller examples cover generic repositories and optional UDS delivery.
Resolve library distribution: Forgejo 16 documents cross-repository reusable workflows as public-only. Current library is Internal; test a public sanitized library/mirror or reviewed vendored copies without exposing privileged credentials to PRs. Do not assume an organization token fixes workflow expansion.
Pin consumers to reviewed commits and document upgrades/versioning.
Record an available Linux CI runner and pinned scanner toolchain; execute one Homelab and one personal/other-organization consumer. Existing Linux runner can be used before Kubernetes migration in #2.
Prove caller checkout identity, PR isolation and missing-tool failures; record run links.

Depends on secret scanning #1 and broader security baseline. This issue tracks activation; the initial scaffold alone does not complete it.

Reference: https://forgejo.org/docs/latest/user/actions/reference/#jobsjob_iduses

Provide reusable Forgejo Actions for personal repositories and any organization, with no Homelab-specific cluster, registry, domain or secret names in generic jobs. Acceptance: - [x] Versioned workflow_call interfaces and caller examples cover generic repositories and optional UDS delivery. - [x] Resolve library distribution: Forgejo 16 documents cross-repository reusable workflows as public-only. Current library is Internal; test a public sanitized library/mirror or reviewed vendored copies without exposing privileged credentials to PRs. Do not assume an organization token fixes workflow expansion. - [x] Pin consumers to reviewed commits and document upgrades/versioning. - [x] Record an available Linux CI runner and pinned scanner toolchain; execute one Homelab and one personal/other-organization consumer. Existing Linux runner can be used before Kubernetes migration in #2. - [x] Prove caller checkout identity, PR isolation and missing-tool failures; record run links. Depends on secret scanning #1 and broader security baseline. This issue tracks activation; the initial scaffold alone does not complete it. Reference: https://forgejo.org/docs/latest/user/actions/reference/#jobsjob_iduses

kiyi added this to the Homelab Roadmap project

2026-09-03 21:27:30 -05:00

kiyi referenced this issue

2026-09-03 21:30:21 -05:00

Implement the standard security scan baseline #4

kiyi referenced this issue

2026-09-03 21:31:00 -05:00

Implement build-once artifact publishing and controlled promotion #5

kiyi commented

2026-09-03 21:33:27 -05:00

Author

Member

Owner approved public distribution of this workflow library. The repository is already configured public but appears Internal under the organization visibility. Resolve organization visibility while keeping other intended-private repositories explicitly Private, or use a separate public library owner; then verify anonymous access. kiyi cannot access repository settings. The scaffold uses direct commit-pinned calls, with vendoring documented as a fallback.

kiyi referenced this issue from a pull request that will close it,

2026-09-03 21:40:01 -05:00

feat(ci): scaffold reusable security and delivery workflows #6

kiyi referenced this issue

2026-09-03 21:40:24 -05:00

Add secret scanning for commits and Forgejo Actions #1

kiyi commented

2026-09-03 21:40:30 -05:00

Author

Member

Scaffold PR #6 is open. Follow-up visibility discussion includes signed-in-only (Limited) organization visibility as an option. Do not treat browser access as proof reusable workflow expansion works: validate the chosen setting with a second-namespace consumer. The example currently uses vendored local calls; the adoption guide also supplies direct commit-pinned calls for public distribution. No settings were changed by kiyi.

gitchegumi closed this issue

2026-09-03 21:42:11 -05:00

kiyi referenced this issue

2026-09-03 22:38:25 -05:00

feat(security): add reusable fail-closed scans and mitigations #7

kiyi commented

2026-09-04 12:57:48 -05:00

Author

Member

Checklist reconciled with the implemented work. Checked the versioned workflow interfaces/caller examples and commit-pinned consumers/upgrade documentation (PRs #6, #7, #8 and Homelab/bundles#3).

The remaining acceptance items require execution evidence: library expansion under the chosen visibility, successful consumers in Homelab and another namespace, and caller identity/PR-isolation checks with run links. The existing runner is linked and has picked up jobs, and local toolchain tests have passed, but those facts do not complete the full cross-organization acceptance items.

Reopening this activation issue because it was closed with the initial scaffold while these checks remain outstanding. Going forward I will update checklist items alongside implementation and validation, and distinguish completed code from live acceptance.

Checklist reconciled with the implemented work. Checked the versioned workflow interfaces/caller examples and commit-pinned consumers/upgrade documentation (PRs #6, #7, #8 and Homelab/bundles#3). The remaining acceptance items require execution evidence: library expansion under the chosen visibility, successful consumers in Homelab and another namespace, and caller identity/PR-isolation checks with run links. The existing runner is linked and has picked up jobs, and local toolchain tests have passed, but those facts do not complete the full cross-organization acceptance items. Reopening this activation issue because it was closed with the initial scaffold while these checks remain outstanding. Going forward I will update checklist items alongside implementation and validation, and distinguish completed code from live acceptance.

kiyi reopened this issue

2026-09-04 12:57:48 -05:00

kiyi referenced this issue

2026-09-04 14:39:01 -05:00

fix(ci): use safe inputs and versioned workflow releases #9

kiyi commented

2026-09-04 14:41:32 -05:00

Author

Member

Compatibility follow-up: bundles consumer run https://git.gitchegumi.com/Homelab/bundles/actions/runs/4 demonstrated that Forgejo expanded the hyphenated runner-label input to an empty runs-on label. PR #9 renames every reusable input to underscore identifiers and adds a regression test.

The hosted library check passed on the ci runner: https://git.gitchegumi.com/Homelab/workflows/actions/runs/25 (tool setup, 28 unit/contract tests, scaffold validation, and full integration suite).

The two execution acceptance items remain open. After PR #9 is approved and merged, update Homelab/bundles PR #3 to the merge commit and new input names, then record its successful consumer run. A personal or other-organization consumer and the caller identity/PR-isolation run evidence will still be required before closing this issue.

Compatibility follow-up: bundles consumer run https://git.gitchegumi.com/Homelab/bundles/actions/runs/4 demonstrated that Forgejo expanded the hyphenated runner-label input to an empty runs-on label. PR #9 renames every reusable input to underscore identifiers and adds a regression test. The hosted library check passed on the ci runner: https://git.gitchegumi.com/Homelab/workflows/actions/runs/25 (tool setup, 28 unit/contract tests, scaffold validation, and full integration suite). The two execution acceptance items remain open. After PR #9 is approved and merged, update Homelab/bundles PR #3 to the merge commit and new input names, then record its successful consumer run. A personal or other-organization consumer and the caller identity/PR-isolation run evidence will still be required before closing this issue.

kiyi referenced this issue

2026-09-04 14:48:08 -05:00

fix(ci): use safe inputs and versioned workflow releases #9

kiyi commented

2026-09-04 14:48:24 -05:00

Author

Member

Versioning decision updated: consumers will reference immutable semantic release tags such as v1.0.0 rather than raw commit hashes. PR #9 now validates vMAJOR.MINOR.PATCH, documents the release protocol, and resolves the selected tag to a commit SHA only inside generated provenance receipts. After merge, publish v1.0.0 and update Homelab/bundles PR #3 to that tag before rerunning consumer acceptance.

kiyi referenced this issue

2026-09-04 15:22:32 -05:00

fix(ci): use static runner role labels #10

kiyi commented

2026-09-04 15:22:52 -05:00

Author

Member

Consumer runs #5 and #6 in Homelab/bundles both waited for a runner with an empty label. Run #6 passed literal ci values from the caller, which isolates the failure to Forgejo 16.0.3 resolving inputs inside a reusable workflow's runs-on field.

PR #10 moves runner selection into the workflow library with static ci roles for scan/build/publish and deploy for cluster delivery. It retains the v1 input fields for compatibility and adds a contract test that rejects dynamic reusable-workflow runner expressions.

After PR #10 is approved and merged, publish v1.0.1, update Homelab/bundles PR #3 to v1.0.1, and record its first successful consumer run. The personal/other-organization consumer and caller identity/PR isolation evidence remain open.

Consumer runs #5 and #6 in Homelab/bundles both waited for a runner with an empty label. Run #6 passed literal ci values from the caller, which isolates the failure to Forgejo 16.0.3 resolving inputs inside a reusable workflow's runs-on field. PR #10 moves runner selection into the workflow library with static ci roles for scan/build/publish and deploy for cluster delivery. It retains the v1 input fields for compatibility and adds a contract test that rejects dynamic reusable-workflow runner expressions. After PR #10 is approved and merged, publish v1.0.1, update Homelab/bundles PR #3 to v1.0.1, and record its first successful consumer run. The personal/other-organization consumer and caller identity/PR isolation evidence remain open.

kiyi referenced this issue

2026-09-04 15:38:28 -05:00

feat(ci): automate workflow releases #11

kiyi commented

2026-09-04 15:41:28 -05:00

Author

Member

#11 adds the manual release path requested for this library. It only runs through workflow_dispatch on the ci role, requires a main dispatch whose checkout matches current origin/main, rejects malformed or existing semantic tags, creates the Forgejo release and tag through the repository-scoped workflow token, and verifies the tag resolves to the reviewed main commit.

Hosted validation passed in run 31: tool setup, all 33 unit/contract tests, scaffold validation, and the full integration suite.

Because this is a new backward-compatible capability, the next release is v1.1.0 under the documented semantic versioning policy. After #11 is approved and merged, run Publish workflow release for v1.1.0, then update Homelab/bundles PR #3 and record its consumer run.

[#11](https://git.gitchegumi.com/Homelab/workflows/pulls/11) adds the manual release path requested for this library. It only runs through `workflow_dispatch` on the `ci` role, requires a `main` dispatch whose checkout matches current `origin/main`, rejects malformed or existing semantic tags, creates the Forgejo release and tag through the repository-scoped workflow token, and verifies the tag resolves to the reviewed `main` commit. Hosted validation passed in [run 31](https://git.gitchegumi.com/Homelab/workflows/actions/runs/31): tool setup, all 33 unit/contract tests, scaffold validation, and the full integration suite. Because this is a new backward-compatible capability, the next release is `v1.1.0` under the documented semantic versioning policy. After [#11](https://git.gitchegumi.com/Homelab/workflows/pulls/11) is approved and merged, run **Publish workflow release** for `v1.1.0`, then update [Homelab/bundles PR #3](https://git.gitchegumi.com/Homelab/bundles/pulls/3) and record its consumer run.

kiyi commented

2026-09-04 16:08:49 -05:00

Author

Member

Homelab consumer acceptance is now proven. Bundles consumer run 9 expanded the v1.1.0 security workflow, selected the static ci runner role, completed successfully, and retained the security-reports artifact.

The empty-label failures in runs 5–8 had two causes: dynamic runs-on inputs are unreliable on Forgejo 16.0.3, and a full https://... reusable-workflow URL is treated as a remote-instance call, which disables workflow expansion. Homelab/bundles PR #3 now uses the same-instance Homelab/workflows/...@v1.1.0 syntax, retains the required v1 compatibility inputs, and leaves scheduling to the library's static roles.

The combined acceptance checkbox remains open until a personal or other-organization consumer also passes. Caller identity/PR-isolation evidence remains open as tracked.

Homelab consumer acceptance is now proven. [Bundles consumer run 9](https://git.gitchegumi.com/Homelab/bundles/actions/runs/9/jobs/1) expanded the `v1.1.0` security workflow, selected the static `ci` runner role, completed successfully, and retained the `security-reports` artifact. The empty-label failures in runs 5–8 had two causes: dynamic `runs-on` inputs are unreliable on Forgejo 16.0.3, and a full `https://...` reusable-workflow URL is treated as a remote-instance call, which disables workflow expansion. [Homelab/bundles PR #3](https://git.gitchegumi.com/Homelab/bundles/pulls/3) now uses the same-instance `Homelab/workflows/...@v1.1.0` syntax, retains the required v1 compatibility inputs, and leaves scheduling to the library's static roles. The combined acceptance checkbox remains open until a personal or other-organization consumer also passes. Caller identity/PR-isolation evidence remains open as tracked.

kiyi referenced this issue

2026-09-04 16:35:31 -05:00

fix(ci): add trusted repository self-scan #12

kiyi commented

2026-09-04 16:36:16 -05:00

Author

Member

PR #12 adds another live same-instance caller and confirms that pull-request workflow expansion produces the released security jobs. The existing Homelab/bundles run 9 remains the completed Homelab consumer evidence.

The cross-organization checkbox remains open because the current runner registration is scoped to Homelab; a personal or other-organization consumer cannot execute until a suitable runner is registered or runner scope changes. That is an activation constraint, not a reason to pause the security and delivery implementation.

PR #12 adds another live same-instance caller and confirms that pull-request workflow expansion produces the released security jobs. The existing Homelab/bundles run 9 remains the completed Homelab consumer evidence. The cross-organization checkbox remains open because the current runner registration is scoped to Homelab; a personal or other-organization consumer cannot execute until a suitable runner is registered or runner scope changes. That is an activation constraint, not a reason to pause the security and delivery implementation.

kiyi referenced this issue

2026-09-04 23:45:46 -05:00

Implement the standard security scan baseline #4

kiyi commented

2026-09-04 23:46:33 -05:00

Author

Member

Release/adoption update: v1.2.1 is published, including the occurrence-specific IaC mitigation fix in #15. Consumers now use matching uses and library_ref pins: this repository (#16), Homelab/bundles#6 (all four template callers), and Homelab/platform#21 are merged.

Live evidence includes workflows PR scan 59, workflows main scan 61, main library tests 62, and bundles PR scan 16. These confirm released same-instance reuse on the existing ci runner.

No additional compound acceptance boxes are checked: a personal/other-organization consumer still needs a runner that can execute it, and caller-identity/PR-isolation/missing-tool evidence still needs the dedicated activation checks. Existing app repositories generated from the template require their own version adoption.

Release/adoption update: v1.2.1 is published, including the occurrence-specific IaC mitigation fix in #15. Consumers now use matching `uses` and `library_ref` pins: this repository (#16), Homelab/bundles#6 (all four template callers), and Homelab/platform#21 are merged. Live evidence includes [workflows PR scan 59](https://git.gitchegumi.com/Homelab/workflows/actions/runs/59), [workflows main scan 61](https://git.gitchegumi.com/Homelab/workflows/actions/runs/61), [main library tests 62](https://git.gitchegumi.com/Homelab/workflows/actions/runs/62), and [bundles PR scan 16](https://git.gitchegumi.com/Homelab/bundles/actions/runs/16). These confirm released same-instance reuse on the existing ci runner. No additional compound acceptance boxes are checked: a personal/other-organization consumer still needs a runner that can execute it, and caller-identity/PR-isolation/missing-tool evidence still needs the dedicated activation checks. Existing app repositories generated from the template require their own version adoption.

kiyi commented

2026-09-05 00:09:13 -05:00

Author

Member

The runner-scope blocker is resolved. The owner registered the runner at instance scope, and TradeGumi/CTI_Scripts PR #223 expanded and executed the v1.2.1 reusable gate in run 1. The runner used v13.0.0 and the ci Docker image.

Live checkout evidence confirms the caller repository TradeGumi/CTI_Scripts at 50cc27be02196215ad0e6a2093cef24419dc13c1, with Homelab/workflows checked out separately at release commit 62ddd420fb. The sanitized report artifact uploaded successfully.

The consumer did not pass: 104 blocking report entries, 0 mitigations and 2 scanner errors (Trivy IaC missing positive StartLine metadata; Semgrep exit 3). Detailed sanitized categories are recorded on the consumer PR. Cross-organization dispatch/execution and caller identity are now demonstrated; a clean consumer result and the dedicated PR-isolation/missing-tool tests remain outstanding, so the compound acceptance boxes remain open.

Owner decision: keep voa, ci and deploy labels available on the shared instance runner for now. Separate CI/deployment scope and ephemeral per-job runners are deferred to the Kubernetes runner migration in #2. Labels alone do not establish credential isolation.

The runner-scope blocker is resolved. The owner registered the runner at instance scope, and [TradeGumi/CTI_Scripts PR #223](https://git.gitchegumi.com/TradeGumi/CTI_Scripts/pulls/223) expanded and executed the v1.2.1 reusable gate in [run 1](https://git.gitchegumi.com/TradeGumi/CTI_Scripts/actions/runs/1/jobs/1). The runner used v13.0.0 and the ci Docker image. Live checkout evidence confirms the caller repository TradeGumi/CTI_Scripts at 50cc27be02196215ad0e6a2093cef24419dc13c1, with Homelab/workflows checked out separately at release commit 62ddd420fbebc3eb05405fa9dcf553f538377557. The sanitized report artifact uploaded successfully. The consumer did not pass: 104 blocking report entries, 0 mitigations and 2 scanner errors (Trivy IaC missing positive StartLine metadata; Semgrep exit 3). Detailed sanitized categories are recorded on the consumer PR. Cross-organization dispatch/execution and caller identity are now demonstrated; a clean consumer result and the dedicated PR-isolation/missing-tool tests remain outstanding, so the compound acceptance boxes remain open. Owner decision: keep voa, ci and deploy labels available on the shared instance runner for now. Separate CI/deployment scope and ephemeral per-job runners are deferred to the Kubernetes runner migration in #2. Labels alone do not establish credential isolation.

kiyi commented

2026-09-05 00:13:27 -05:00

Author

Member

Scope correction: the cross-organization execution criterion is complete and is now checked. TradeGumi/CTI_Scripts run 1 proves workflow expansion, instance-runner pickup, the pinned toolchain, separate caller/library checkouts and retained reports outside Homelab. Requiring CTI_Scripts to have a clean security scan added a condition that this activation criterion does not require.

The owner explicitly confirmed that CTI_Scripts findings and scanner-error remediation are outside the current task. The recorded failed scan remains accurate, but it does not invalidate the cross-organization execution evidence. This issue is now 4/5; the remaining compound item concerns PR isolation and missing-tool tests, with caller checkout identity already demonstrated.

Scope correction: the cross-organization execution criterion is complete and is now checked. TradeGumi/CTI_Scripts run 1 proves workflow expansion, instance-runner pickup, the pinned toolchain, separate caller/library checkouts and retained reports outside Homelab. Requiring CTI_Scripts to have a clean security scan added a condition that this activation criterion does not require. The owner explicitly confirmed that CTI_Scripts findings and scanner-error remediation are outside the current task. The recorded failed scan remains accurate, but it does not invalidate the cross-organization execution evidence. This issue is now 4/5; the remaining compound item concerns PR isolation and missing-tool tests, with caller checkout identity already demonstrated.

kiyi referenced this issue

2026-09-05 00:22:42 -05:00

test(ci): exercise released gates on live pull requests #17

kiyi commented

2026-09-05 00:25:23 -05:00

Author

Member

The remaining activation criterion is verified by live acceptance run 63 in #17: all 12 cases passed against the unchanged v1.2.1 release. Checklist: 5/5.

Evidence includes matching PR checkout SHA and the pinned library SHA, no persisted local Git authentication, no privileged secret references in the released scan workflows, and no delivery-credential values present under the tested names in the live PR job environment. All five released build/publish/deploy guard commands rejected the actual pull_request event both with the PR ref and with a main-ref claim. Structural checks confirm those guards precede steps that inject privileged credentials. The released secret gate failed when Gitleaks was removed from PATH and when its version was mismatched.

This completes the workflow-level acceptance scope alongside the previously proven cross-organization execution. It does not assert malicious-author trust approval behavior, general fork secret isolation, or isolation between shared runner hosts. The agreed split into ephemeral CI/deploy runners remains deferred to the Kubernetes migration in #2. No CTI_Scripts remediation or deployment was performed. #17 retains the suite and sanitized evidence for review.

The remaining activation criterion is verified by [live acceptance run 63](https://git.gitchegumi.com/Homelab/workflows/actions/runs/63/jobs/0) in #17: all 12 cases passed against the unchanged v1.2.1 release. Checklist: 5/5. Evidence includes matching PR checkout SHA and the pinned library SHA, no persisted local Git authentication, no privileged secret references in the released scan workflows, and no delivery-credential values present under the tested names in the live PR job environment. All five released build/publish/deploy guard commands rejected the actual pull_request event both with the PR ref and with a main-ref claim. Structural checks confirm those guards precede steps that inject privileged credentials. The released secret gate failed when Gitleaks was removed from PATH and when its version was mismatched. This completes the workflow-level acceptance scope alongside the previously proven cross-organization execution. It does not assert malicious-author trust approval behavior, general fork secret isolation, or isolation between shared runner hosts. The agreed split into ephemeral CI/deploy runners remains deferred to the Kubernetes migration in #2. No CTI_Scripts remediation or deployment was performed. #17 retains the suite and sanitized evidence for review.

kiyi referenced this issue

2026-09-05 00:28:16 -05:00

test(ci): exercise released gates on live pull requests #17