upload-package

Forgejo Actions for uploading to and deleting from a generic package registry, and authenticating with a job-scoped JWT obtained via OIDC (ACTIONS_ID_TOKEN_REQUEST_URL / ACTIONS_ID_TOKEN_REQUEST_TOKEN). See Forgejo Authorized Integrations.

Three actions, referenced independently:

• upload/ — uploads a local file.
• delete/ — deletes a remote package file.
• token/ — retrieves the JWT itself, for cases like docker login that need the raw token rather than a package upload/delete.

The actions require that the workflow has enable-openid-connect: true set.

Upload

permissions:
  id-token: write

steps:
  - uses: actions/checkout@v4
  - name: Upload theme package
    uses: https://git.hanse.de/hanse/upload-package/upload@v1
    with:
      audience: u:2:50bef203-4429-4694-83b3-a9b4ad683d20
      owner: vvm
      package-name: vvm-theme
      version: latest
      file-path: vvm-theme.zip

Inputs

Input	Required	Default	Description
server-url	no	GITHUB_SERVER_URL	Base URL of the Forgejo/Gitea instance
audience	yes		Audience passed to the OIDC ID token request, e.g. u:2:<uuid>
owner	yes		Package owner (user or org)
package-name	yes		Package name
package-type	no	generic	Package type path segment
version	no	latest	Package version
file-path	yes		Local file to upload
file-name	no	basename of file-path	Remote file name
content-type	no	application/octet-stream	Content-Type header sent with the upload

Outputs

Output	Description
package-url	Full URL of the uploaded package file

Delete

permissions:
  id-token: write

steps:
  - name: Delete previous theme package
    uses: https://git.hanse.de/hanse/upload-package/delete@v1
    with:
      audience: u:2:50bef203-4429-4694-83b3-a9b4ad683d20
      owner: vvm
      package-name: vvm-theme
      version: latest
      file-name: vvm-theme.zip

Inputs

Input	Required	Default	Description
server-url	no	GITHUB_SERVER_URL	Base URL of the Forgejo/Gitea instance
audience	yes		Audience passed to the OIDC ID token request
owner	yes		Package owner (user or org)
package-name	yes		Package name
package-type	no	generic	Package type path segment
version	no	latest	Package version
file-name	yes		Remote file name to delete
ignore-not-found	no	true	Treat a 404 response as success instead of failing the step

Outputs

Output	Description
deleted	"true" if a file was deleted, "false" if it didn't exist and ignore-not-found applied

Token

Use this when you need the raw JWT for something other than the generic package API, e.g. to call the Forgejo API directly with Authorization: bearer <token>.

permissions:
  id-token: write

steps:
  - name: Get registry token
    id: registry-token
    uses: https://git.hanse.de/hanse/upload-package/token@v1
    with:
      audience: u:2:50bef203-4429-4694-83b3-a9b4ad683d20
  - name: Call the Forgejo API with the token
    run: |
      curl -sS -H "Authorization: bearer ${{ steps.registry-token.outputs.token }}" \
        https://git.hanse.de/api/v1/user

docker login does not currently work with this token. Forgejo's container registry only advertises a Bearer challenge on /v2/, so docker login authenticates against /v2/token, not the registry API directly. That endpoint does not yet validate Authorized Integration JWTs — only real account credentials (password or personal access token) — so there is no way to docker login with an OIDC actions token today. See forgejo/forgejo#12573. Use a personal access token or deploy token stored as a secret for docker login instead; use upload/delete (or this token action against the API) for anything that goes through the generic package API, which already accepts the JWT directly.

Inputs

Input	Required	Default	Description
audience	yes		Audience passed to the OIDC ID token request, e.g. u:2:<uuid>

Outputs

Output	Description
token	The job JWT, usable as a bearer token for authenticating against the Forgejo API and generic package registry

Development

Source lives in src/; each action's dist/index.js is a committed esbuild bundle so consumers don't need an install step. After changing src/, rebuild all bundles:

npm install
npm run build

Commit the updated upload/dist/index.js, delete/dist/index.js, and token/dist/index.js along with your source changes.

Tests use Node's built-in test runner (no extra dependency). npm test rebuilds all bundles first, then runs unit tests for src/lib/ and integration tests that spawn the real bundled actions against a local mock registry:

npm test