Canonical shell-only composite actions: deploy-pages, docker-publish, forgejo-release

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -0,0 +1,84 @@
+# ci-actions
+
+Canonical, self-contained CI building blocks shared across the repos on this
+Forgejo instance. Every action is a **composite action implemented in plain
+shell** — none of them fetch or run a third-party marketplace action, so the
+runner only ever executes code from this repo.
+
+## Why
+
+The publishing steps across the repos were copy-pasted variants of two things:
+copying a built site into the `/pages` mount, and building + pushing a Docker
+image to the Forgejo registry (plus the occasional release upload). These
+actions are the single, vetted implementation of each.
+
+## How repos reference these
+
+Because this Forgejo instance is served under a `/git/` sub-path,
+`DEFAULT_ACTIONS_URL` points at `code.forgejo.org` (so bare `actions/checkout`
+keeps working). To pull an action from *this* instance, reference it by the
+runner-internal URL:
+
+```yaml
+- uses: http://forgejo:3000/andras/ci-actions/docker-publish@main
+```
+
+The runner (which can reach `forgejo:3000`) fetches it; nothing external is
+involved. Pin `@main` for instant propagation, or a tag for stability.
+
+## Actions
+
+### `deploy-pages`
+rsync a built directory into `/pages/<target>`.
+
+```yaml
+- uses: http://forgejo:3000/andras/ci-actions/deploy-pages@main
+  if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+  with:
+    source: dist/        # contents are synced
+    target: photos       # -> /pages/photos
+    # delete: "true"     # default; set "false" to keep extra files
+```
+
+### `docker-publish`
+Build and push an image to the Forgejo container registry. Computes tags from
+the git ref: `sha-<short>` always, `latest` on the default branch, and
+`vX.Y.Z` / `X.Y.Z` / `X.Y` / `X` on semver tags.
+
+```yaml
+- uses: http://forgejo:3000/andras/ci-actions/docker-publish@main
+  with:
+    context: ./backend          # default "."
+    # dockerfile: path/Dockerfile
+    # image-suffix: -server     # -> <host>/<owner>/<repo>-server
+    # build-args: |
+    #   BASE_HREF=/towers/
+    push: ${{ github.event_name != 'pull_request' }}
+    token: ${{ secrets.FORGEJO_PACKAGE_TOKEN }}
+```
+
+Notes:
+- Single-architecture build (no buildx multi-arch / registry buildcache).
+- An idempotent `docker` CLI install runs if the runner image lacks it.
+
+### `forgejo-release`
+Create a release via the Forgejo API and upload assets.
+
+```yaml
+# Moving "latest" prerelease on default-branch pushes:
+- uses: http://forgejo:3000/andras/ci-actions/forgejo-release@main
+  if: github.ref == 'refs/heads/master'
+  with:
+    token: ${{ secrets.FORGEJO_PACKAGE_TOKEN }}
+    files: dist/release
+    tag: latest
+    prerelease: "true"
+    override: "true"
+
+# Stable release on a tag push (tag defaults to the pushed ref):
+- uses: http://forgejo:3000/andras/ci-actions/forgejo-release@main
+  if: startsWith(github.ref, 'refs/tags/')
+  with:
+    token: ${{ secrets.FORGEJO_PACKAGE_TOKEN }}
+    files: dist/release
+```