shared-actions

This directory is a working clone of the Forgejo repo agent-skills/shared-actions. Skill workflows pin a reviewed release here by URL:

uses: http://forgejo:3030/agent-skills/shared-actions/register-skill@v1.3.2

Edit → test → git commit → git push → create a reviewed version tag. Skill repositories must pin a version tag instead of following mutable main.

Actions

• register-skill/action.yaml — enforces the exact skill-contract.json, runs the repository package gate, carries the token-free package.json runtimeAuth declaration into Registry metadata, uploads the zip to the current tag's Forgejo release, and registers the public release asset URL as artifact_url. SkillHub returns that same value to clients as download_url.
• Auth uses SKILL_REGISTRY_TOKEN_TEST / SKILL_REGISTRY_TOKEN_PRD (skreg_*) for /ecom/skills/register-by-slug, and FORGEJO_TOKEN for creating releases and uploading release assets on https://code.yuanwei-lnc.com.
• The runner fetches actions and calls Forgejo through http://forgejo:3030; public release URLs remain on https://code.yuanwei-lnc.com. These are separate inputs by design.

Release flow

skillctl release -> workflow_dispatch(main + exact SHA + version)
                 -> CI validates machine contract and pinned auth-runtime commit
                 -> CI creates tag/release -> uploads artifact -> Registry

raw git tag push -> no workflow trigger -> no release asset -> no Registry write

Tag push is intentionally not a workflow trigger. A pre-existing raw tag is rejected rather than being converted into a release later. The auth runtime is fetched by the exact commit recorded in the canonical machine contract. Registry writes include a provenance attestation binding workflow event, repository, version, source commit, contract hash, shared-action version, and auth-runtime commit. Registry-token requests without that attestation fail closed.

• Test versions such as v1.2.3-rc.1 or v1.2.3-test.1 register to the test registry using the SKILL_API_BASE_TEST organization variable.
• Stable versions such as v1.2.3 register to the prd registry using the SKILL_API_BASE_PRD organization variable.
• The registry API base must be an internal Kong gateway address reachable from the Forgejo runner, for example http://192.168.1.108:8100 for test/staging and http://192.168.1.186:8100 for prd. Do not use public app/web ingress domains for CI registration.
• The skill zip is environment-neutral. The environment only controls which registry API receives the download_url.

Skill repo workflow

Each real skill repo keeps only a thin Forgejo workflow:

- name: Prepare Skill release runtime
  # The job itself uses container.image: oven/bun:1.3.5.
  shell: bash
  run: |
    set -euo pipefail
    apt-get update >/dev/null
    apt-get install -y --no-install-recommends git python3 zip ca-certificates >/dev/null

- name: Checkout
  shell: bash
  env:
    FORGEJO_TOKEN: ${{ secrets.FORGEJO_TOKEN }}
  run: |
    set -euo pipefail
    git init "$GITHUB_WORKSPACE"
    git -C "$GITHUB_WORKSPACE" remote add origin "http://forgejo:3030/${GITHUB_REPOSITORY}.git"
    git -C "$GITHUB_WORKSPACE" -c "http.extraHeader=Authorization: token ${FORGEJO_TOKEN}" fetch --depth 1 origin "${GITHUB_REF}"
    git -C "$GITHUB_WORKSPACE" checkout --force FETCH_HEAD

- uses: http://forgejo:3030/agent-skills/shared-actions/register-skill@v1.3.2
  with:
    version: ${{ inputs.version }}
    registry_token_test: ${{ secrets.SKILL_REGISTRY_TOKEN_TEST }}
    registry_token_prd: ${{ secrets.SKILL_REGISTRY_TOKEN_PRD }}
    test_api_base: ${{ vars.SKILL_API_BASE_TEST }}
    prd_api_base: ${{ vars.SKILL_API_BASE_PRD }}
    forgejo_token: ${{ secrets.FORGEJO_TOKEN }}
    forgejo_api_base_url: http://forgejo:3030

Do not use actions/checkout@v4 here. The Forgejo runner must use its internal http://forgejo:3030 service for Git, actions, and API calls; only the release asset returned to clients uses https://code.yuanwei-lnc.com.

Deployment checklist

1. Configure organization secrets on agent-skills:
   • FORGEJO_TOKEN
   • SKILL_REGISTRY_TOKEN_TEST
   • SKILL_REGISTRY_TOKEN_PRD
2. Configure organization variables on agent-skills:
   • SKILL_API_BASE_TEST=http://192.168.1.108:8100
   • SKILL_API_BASE_PRD=http://192.168.1.186:8100
3. Push skill repo code to main.
4. Run skillctl release v1.2.3-test.1 /path/to/skill; do not push a tag.
5. Confirm the action logs contain Registered successfully and Download URL: https://code.yuanwei-lnc.com/...zip.
6. Confirm the skill management UI shows the new test version.
7. After testing the self-contained zip, push the stable tag v1.2.3 to register the same release shape to prd.

If runner capacity is low, trigger skills in small batches. Skip template-skill during normal verification because it is only a template repo.

Repository boundary

shared-actions is an independent Forgejo repository. A monorepo may expose it as a Git submodule for discovery, but must never track its descendants as normal files. This keeps ownership, review, tags, and rollback unambiguous.