hello

Example Forgejo repository for the public runner. It builds a small Go program, tests it, and on a version tag publishes release binaries, a container image, and a Go module.

Push this directory as its own repository. Workflows live in .forgejo/workflows and run on the runner label ubuntu-latest.

What runs

CI runs on branch pushes and pull requests. A version tag runs Release instead.

• Test on Go 1.26 and 1.27, with the race detector, go vet, and a coverage artifact.
• Build a snapshot binary and upload it.
• Build the container image and run hello version inside it. The runner mounts the guest Docker socket into the job, so this uses the guest's dockerd. The job itself is not privileged.

Release runs when a tag matching v* is pushed, for example v1.2.3 or v1.2.3-rc.1.

• Cross-compile linux, darwin, and windows binaries, write SHA256SUMS, and attach them to a Forgejo release. A tag that contains - is marked as a pre-release. Running the workflow again replaces that release.
• Write the release body from commits since the previous tag, or from the whole history for the first tag. Commits are grouped by conventional commit type. feat is Features, fix is Bug fixes, and docs, perf, refactor, test, build, ci, chore, and revert each get a section. Any other type: is grouped under that type. A subject with no type is listed under Other changes. A ! after the type, or a BREAKING CHANGE: footer, is also listed under Breaking changes.
• Push git.klopfis.sudo-i.net/kk/hello:<tag> and, for a final tag, :latest. The image label org.opencontainers.image.source links the package to this repository.
• Publish the module to the Forgejo Go registry. The module path is git.klopfis.sudo-i.net/kk/hello. Publish rewrites it to the repository that ran the workflow.

Package publish

The automatic workflow token creates the release. It cannot push packages. The image and the Go module authenticate with an Authorized Integration JWT. This needs Forgejo 16 or newer.

In your user settings, open Authorized Integrations and create a Forgejo Actions (Local) integration:

• Source repository: this repository.
• Workflow file: release.yml.
• Git reference: refs/tags/v*.
• Events: push, and workflow_dispatch if you run Release by hand on a tag.
• Capability: write:package.

The user who owns the integration must be allowed to publish packages for the repository owner. Save the integration, then copy its generated Audience into the repository variable PACKAGE_AUDIENCE. The audience is not a secret. Without that variable the release is still created, and the image and module steps skip the publish.

Install

After v1.2.3 is published:

docker pull git.klopfis.sudo-i.net/kk/hello:v1.2.3

GOPRIVATE=git.klopfis.sudo-i.net
GOPROXY=https://git.klopfis.sudo-i.net/api/packages/kk/go,https://proxy.golang.org,direct
go install git.klopfis.sudo-i.net/kk/hello@v1.2.3

A published module version cannot be uploaded again. Delete it in the package settings before publishing the same tag a second time. The workflow treats that conflict as already published.

Local

go test ./...
sh scripts/release-notes_test.sh
go build -o dist/hello ./cmd/hello
docker build -t hello:dev .
docker run --rm hello:dev greet Ada
sh scripts/release-notes.sh v1.2.3 dist/notes.md

hello serve listens on :8080 and answers /, /healthz, and /version.