ci: move publish/sign workflows from Forgejo to GitHub Actions - #3772
Merged
Conversation
Land the release publisher on GitHub ARC (serviceradar-signing) so v* tags no longer depend on Forgejo. Catalog and security jobs talk to the GitHub Releases API. Wasm upload signing can use in-cluster OpenBao Transit. Do not recreate BuildBuddy/Bazel-owned suites as Actions: main.yml, rust-musl.yml, rust-tests-addon-interop.yml, banner-grab-large.yml. Signed-off-by: Michael Freeman <mfreeman451@gmail.com>
There was a problem hiding this comment.
Pull request overview
This PR migrates the publish/sign release pipeline from Forgejo Actions to GitHub Actions (ARC runners), updating release publishing to use the GitHub Releases API and moving Wasm upload signing to OpenBao Transit-backed signing instead of long-lived CI secrets.
Changes:
- Ported release, native-addons, wasm-plugins, and security publishing workflows to
.github/workflows/with ARC runner labels (serviceradar-signing,arc-runner-set). - Updated release tooling/scripts to support GitHub Releases API semantics (draft visibility, uploads API), and refreshed the associated contract tests.
- Added/rolled forward first-party Wasm upload signing key support (v2) and wired Transit signing into the Wasm signing toolchain/config.
Reviewed changes
Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| scripts/upload-forgejo-release-asset.sh | Release asset upload helper updated to support GitHub Releases API semantics. |
| scripts/test-release-publish-contracts.sh | Contract test updated to assert GitHub workflow/API behavior and updated image spec counts. |
| scripts/test-publish-external-wasm-plugin-release.py | External Wasm plugin release contract test updated for GitHub Releases API endpoints. |
| scripts/test-external-wasm-plugin-release-workflow.sh | Workflow contract assertions updated for .github/workflows/external-wasm-plugin.yml. |
| scripts/publish-external-wasm-plugin-release.sh | External plugin release publishing updated from Forgejo to GitHub API + uploads API. |
| scripts/ci/prepare-openbao-cosign-env.sh | Updated OpenBao auth role and added Transit upload-signing env defaults/unsets. |
| scripts/BUILD.bazel | Bazel sh_test inputs updated from .forgejo/workflows/* to .github/workflows/*. |
| RELEASE.md | Release guide updated to reference GitHub Releases and Transit-preferred upload signing. |
| helm/serviceradar/values-demo.yaml | Demo overlay updated to trust both v1 and v2 first-party upload signing keys. |
| first_party_plugin_cosign_key_consistency_test.py | Consistency test extended to validate v2 (Transit) key matches Helm + Elixir config. |
| elixir/web-ng/config/config.exs | Web-NG plugin verification config updated to include v2 trusted upload key. |
| docs/SBOM.md | SBOM docs updated to reference GitHub Actions workflow locations. |
| docs/RELEASE_PUBLISHING.md | Release publishing docs updated to reflect GitHub Actions/ARC-based publisher. |
| build/wasm_plugins/upload_signature_tool.go | Wasm upload signature tool extended to sign via OpenBao/Vault Transit and fetch public key. |
| build/wasm_plugins/upload_signature_tool_test.go | Added test coverage for Transit-backed signing + verification. |
| build/release/publish_packages.go | Release publishing client updated for GitHub API behavior (draft discovery, auth/accept headers, uploads). |
| BUILD.bazel | Exported workflow files updated to .github/workflows/*. |
| .github/workflows/wasm-plugins.yml | GitHub Actions workflow for publishing Wasm plugins and release import index. |
| .github/workflows/source-security.yml | Source SBOM/security workflow updated to wait for and upload assets to GitHub Releases. |
| .github/workflows/release.yml | Main release workflow migrated to GitHub Releases API and ARC runner environment. |
| .github/workflows/publish-oci.yml | OCI publish workflow migrated to ARC runner and updated environment wiring. |
| .github/workflows/palisade-publish.yml | Palisade Hex publish workflow moved to ARC runner and GitHub wording/permissions. |
| .github/workflows/native-addons.yml | Native add-on publish workflow migrated to GitHub API and shared asset uploader helper. |
| .github/workflows/inspect-oidc.yml | OIDC inspection workflow migrated to ARC runner and GitHub wording/permissions. |
| .github/workflows/image-security.yml | Image security workflow updated to wait for and upload assets to GitHub Releases. |
| .github/workflows/external-wasm-plugin.yml | External Wasm plugin build/publish workflow updated for GitHub and OpenBao role. |
| .forgejo/workflows/README.md | Added notice documenting Forgejo workflows as leftovers-only. |
| .forgejo/README.md | Added notice documenting Forgejo publisher retirement and GitHub Actions replacement. |
Suppressed comments (4)
.github/workflows/wasm-plugins.yml:37
- This workflow uses
${GITHUB_TOKEN}for GitHub Releases API calls, but the job env only setsGH_TOKEN. GitHub Actions does not automatically export${{ github.token }}into aGITHUB_TOKENenvironment variable, so the "Upload import index release asset" step will fail theMissing GITHUB_TOKEN.check and any subsequentcurlcalls.
.github/workflows/inspect-oidc.yml:18 - This workflow only needs repo read access for
actions/checkout; it does not write to repo contents. Grantingcontents: writeunnecessarily broadens the token’s permissions for an OIDC inspection job.
.github/workflows/palisade-publish.yml:36 - This workflow publishes to hex.pm and does not perform any GitHub write operations (no releases, tags, or pushes).
contents: writeis not required and unnecessarily increases token scope.
.github/workflows/publish-oci.yml:25 - This workflow signs/pushes images to Harbor and does not call the GitHub API to mutate repository contents.
contents: writeis unnecessary and increases the blast radius of${{ github.token }}if a step is compromised.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+698
to
+701
| func (c *githubClient) isGitHub() bool { | ||
| host := strings.ToLower(c.baseURL) | ||
| return strings.Contains(host, "api.github.com") || strings.Contains(host, "github.com") | ||
| } |
Comment on lines
+27
to
+39
| if [[ -n "${GITHUB_API_URL:-}" || -z "${FORGEJO_URL:-}" || "${FORGEJO_URL}" == *github.com* ]]; then | ||
| api_base="${GITHUB_API_URL:-https://api.github.com}" | ||
| repo="${GITHUB_REPOSITORY:-carverauto/serviceradar}" | ||
| auth_header="Authorization: Bearer ${token}" | ||
| accept_header="Accept: application/vnd.github+json" | ||
| release_url="${api_base}/repos/${repo}/releases/tags/${tag}" | ||
| releases_url="${api_base}/repos/${repo}/releases?per_page=100" | ||
| release_by_id() { echo "${api_base}/repos/${repo}/releases/${1}"; } | ||
| asset_delete() { echo "${api_base}/repos/${repo}/releases/assets/${1}"; } | ||
| asset_upload() { | ||
| echo "https://uploads.github.com/repos/${repo}/releases/${1}/assets?name=${asset_name}" | ||
| } | ||
| github_upload=true |
This was referenced Aug 18, 2026
Merged
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
IMPORTANT: Please sign the Developer Certificate of Origin
Signed-off-by: Michael Freeman mfreeman451@gmail.com
Describe your changes
Move the publish/sign Forgejo workflows to
.github/workflows/so GitHub ARC (serviceradar-signing) is the release publisher. Catalog and security jobs use the GitHub Releases API. Wasm upload signing can use in-cluster OpenBao Transit (no laptop port-forward).This does not recreate BuildBuddy / Bazel-owned suites as GitHub Actions:
main.ymlrust-musl.ymlrust-tests-addon-interop.ymlbanner-grab-large.ymlLint/check workflows already on GitHub (
elixir-*,golangci-lint,helm-lint,secret-scan,web-ng-lint,rust-checks.yml) are left alone.Issue ticket number and link
n/a — Forgejo publisher retirement
Code checklist before requesting a review
Focused contracts ran: external Wasm release workflow, GitHub release publisher mock, first-party upload-key consistency, release publish contracts.
make testwas not re-run for the whole repo on this isolated branch.