forgejo-actions

Reusable Forgejo Actions for CI. Org-agnostic and account-agnostic by design: nothing here encodes any specific account, organization, or infrastructure — pass everything in as inputs.

aws-sts-assumerole

Assumes an AWS IAM role using the job's own Forgejo OIDC ID token (sts:AssumeRoleWithWebIdentity) and exports standard AWS environment variables for the remaining steps of the job:

• AWS_ACCESS_KEY_ID
• AWS_SECRET_ACCESS_KEY
• AWS_SESSION_TOKEN
• AWS_REGION (only if the aws-region input is set)

Short-lived credentials only — no static keys, nothing stored in CI configuration.

Requirements

• A Forgejo instance with Actions OIDC support (see the Forgejo docs, "Actions | Security OpenID Connect").

• The calling job/workflow must opt in:

  enable-openid-connect: true
  

  Note: this is the Forgejo key. GitHub's permissions: id-token: write does not exist on Forgejo.

• The job image only needs python3 (curl/jq/awscli/boto3 are not required: AssumeRoleWithWebIdentity is an unsigned STS API, so the action calls it directly with the standard library).

AWS-side prerequisites

1. An IAM OIDC identity provider for your Forgejo instance. The provider URL must match the iss claim of the tokens, i.e. https://<your-forgejo-host>/api/actions. With the AWS CLI:

   aws iam create-open-id-connect-provider \
     --url https://<your-forgejo-host>/api/actions \
     --client-id-list sts.amazonaws.com
   

   (--thumbprint-list is optional; IAM fetches the top intermediate CA thumbprint of the endpoint certificate when omitted.)

2. An IAM role whose trust policy allows sts:AssumeRoleWithWebIdentity from that provider. Validate at least the aud, iss and sub claims. For example:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Principal": {
           "Federated": "arn:aws:iam::<account-id>:oidc-provider/<your-forgejo-host>/api/actions"
         },
         "Action": "sts:AssumeRoleWithWebIdentity",
         "Condition": {
           "StringEquals": {
             "<your-forgejo-host>/api/actions:aud": "sts.amazonaws.com"
           },
           "StringLike": {
             "<your-forgejo-host>/api/actions:sub": "repo:<owner>/<repo>:ref:refs/heads/main"
           }
         }
       }
     ]
   }
   

   The Forgejo sub claim has the form repo:<owner>/<repo>:ref:refs/heads/<branch> (or repo:<owner>/<repo>:pull_request for pull-request events). When consuming tokens, also consider the ref_protected, repository, workflow and actor claims for tighter scoping.

Usage

on: [push]

jobs:
  deploy:
    runs-on: ubuntu-latest
    enable-openid-connect: true   # Forgejo-specific opt-in
    steps:
      - name: Assume role
        uses: <your-forgejo-host>/<owner>/forgejo-actions@v1
        with:
          role-to-assume: arn:aws:iam::<account-id>:role/<role>
          aws-region: eu-west-1
          # optional:
          # session-tags: team=ci,env=dev
          # duration-seconds: 3600
          # role-session-name: my-custom-session

      - name: Use AWS
        run: aws sts get-caller-identity

Inputs

Input	Required	Default	Description
role-to-assume	yes	—	ARN of the IAM role to assume
audience	no	sts.amazonaws.com	aud claim requested on the OIDC token
role-session-name	no	forgejo-${{ github.run_id }}	STS session name (CloudTrail audit key)
duration-seconds	no	3600	Session duration in seconds
aws-region	no	(empty)	Exported as AWS_REGION
session-tags	no	(empty)	Comma-separated Key=Value STS session tags (requires the role trust policy to allow sts:TagSession)

Notes

• The job's OIDC token is masked in logs, as are the resulting STS credentials.
• pull_request events from forked repositories cannot obtain OIDC tokens (Forgejo disables this automatically).
• Tokens expire after [actions].ID_TOKEN_EXPIRATION_TIME (Forgejo default: 1 hour); the action exchanges them immediately for STS credentials.

License

Apache-2.0