feat(repo): prepare the move of the forge to a self-hosted Forgejo #568

2026-10-21T10:23:49Z

root commented

2026-10-21 10:23:49 +00:00

(Migrated from gitlab.core-project.space)

Summary

Everything Forgejo needs for switch day, merged ahead and inert on GitLab (spec #489, tickets #490–#497). #498–#500 are owner-run and stay open, so the spec does too.

.forgejo/
├── workflows/
│   ├── ci.yml              # plan → checks, front-test, e2e → build, preview, production, comment   (#491 #495 #497)
│   ├── preview-close.yml   # tears a preview down on close                                          (#495)
│   ├── preview-reap.yml    # nightly: keep exactly the open pull requests' previews                  (#495)
│   ├── audit.yml           # nightly + lockfile change                                               (#496)
│   ├── backup.yml          # nightly production database backup                                      (#496)
│   └── renovate.yml        # weekly, platform: forgejo, RENOVATE_TOKEN only here                     (#496)
└── scripts/                # changes, reuse-gate, deploy-target, run-comment, forgejo-api … + node --test suites
infra/forgejo/
├── vps/                    # Compose (Forgejo LTS + runner, capacity 1), Traefik, wizard, up.sh, nightly dump  (#490)
├── SWITCH-DAY.md           # every switch step with its check command, freeze (#498) to GitLab deletion (#500)
└── blocked-by-to-dependencies.mjs  # ## Blocked by → native dependencies, --dry-run, idempotent                (#494)
.claude/skills/forgejo-pr/  # was gitlab-mr; command /forgejo-pr; scripts/pr-status.sh was mr-status.sh       (#493)
docs/agents/, CLAUDE.md, forked skills, README  # glab → tea, "pull request", native dependencies              (#492)

flowchart LR
    plan --> checks & front-test & e2e
    checks & front-test & e2e --> build
    build --> preview[preview, same-repo PR]
    build --> production[production, main]
    preview --> comment[comment: one bot comment, trusted scripts from main]

The root test:infra task runs the infra/ and .forgejo/ suites under pnpm test; GitLab's checks job now runs it too until the switch.

Evidence

Before: no Forgejo workflow, server stack or converter; agents and the band speak glab.
After: the five gate commands green on every merge into this branch; test:infra suites pass (converter 10 cases, gate/deploy/comment scripts 52+ cases), forgejo-pr band tests 14/14 against a faked tea, actionlint and renovate-config-validator clean, docker compose config and shellcheck clean on infra/forgejo/vps/.
Not verifiable before switch day (listed in the checklist instead): HTTPS and SSH off, runner registration, status names matching branch protection, run-token permissions for reuse-gate and the reap, !cancelled()/needs.<job>.result support, push mirror, the dump reaching the backup target, Renovate opening pull requests.

Merge Danger

Door: two-way

GitLab ignores .forgejo/ and infra/forgejo/; reverting removes them. The agent docs, skills and the band switch to tea at merge, so until switch day agents read Forgejo instructions while the tracker is still GitLab.

Blast Radius: tooling

deploy/owner-setup.sh now writes Forgejo secrets, no longer GitLab variables.
GitLab's checks job also runs test:infra.
The repository is public on Forgejo: signed-out visitors read its code, issues and run logs.

Owner decisions

The repository is public, so pr-status.sh reads a failed job's log signed out (v15 has no log API). Registration stays off and new repositories stay private.
The repository moves under a new Forgejo organisation amaurycoudr so chess-bot can push images; the owner logs in under another name.
GitLab restarts behind Traefik (TLS passthrough) when Forgejo comes up and loses Let's Encrypt renewals in its last week.
The backup artifact asks for retention-days: 31, which Forgejo keeps 30 days. The audit and Renovate schedules stay as written.
The converter skips a blocker outside the project and keeps its section.
Forgejo's API cannot resolve review threads; the tracker doc leaves resolving to the owner.
Every job, gate included, keeps the host Docker socket, as on GitLab; a fork's pull request gets no secret and no deploy.

Proposed rule changes

CONTRIBUTING.md line 59: - `ci` — Forgejo Actions workflows (`.forgejo/`) and other CI plumbing
ESLint does not cover infra/ or .forgejo/scripts/; adding them is a lint-config change for its own PR.

Closes #490
Closes #491
Closes #492
Closes #493
Closes #494
Closes #495
Closes #496
Closes #497

## Summary Everything Forgejo needs for switch day, merged ahead and inert on GitLab (spec #489, tickets #490–#497). #498–#500 are owner-run and stay open, so the spec does too. ```text .forgejo/ ├── workflows/ │ ├── ci.yml # plan → checks, front-test, e2e → build, preview, production, comment (#491 #495 #497) │ ├── preview-close.yml # tears a preview down on close (#495) │ ├── preview-reap.yml # nightly: keep exactly the open pull requests' previews (#495) │ ├── audit.yml # nightly + lockfile change (#496) │ ├── backup.yml # nightly production database backup (#496) │ └── renovate.yml # weekly, platform: forgejo, RENOVATE_TOKEN only here (#496) └── scripts/ # changes, reuse-gate, deploy-target, run-comment, forgejo-api … + node --test suites infra/forgejo/ ├── vps/ # Compose (Forgejo LTS + runner, capacity 1), Traefik, wizard, up.sh, nightly dump (#490) ├── SWITCH-DAY.md # every switch step with its check command, freeze (#498) to GitLab deletion (#500) └── blocked-by-to-dependencies.mjs # ## Blocked by → native dependencies, --dry-run, idempotent (#494) .claude/skills/forgejo-pr/ # was gitlab-mr; command /forgejo-pr; scripts/pr-status.sh was mr-status.sh (#493) docs/agents/, CLAUDE.md, forked skills, README # glab → tea, "pull request", native dependencies (#492) ``` ```mermaid flowchart LR plan --> checks & front-test & e2e checks & front-test & e2e --> build build --> preview[preview, same-repo PR] build --> production[production, main] preview --> comment[comment: one bot comment, trusted scripts from main] ``` The root `test:infra` task runs the `infra/` and `.forgejo/` suites under `pnpm test`; GitLab's `checks` job now runs it too until the switch. ## Evidence - **Before:** no Forgejo workflow, server stack or converter; agents and the band speak `glab`. **After:** the five gate commands green on every merge into this branch; `test:infra` suites pass (converter 10 cases, gate/deploy/comment scripts 52+ cases), `forgejo-pr` band tests 14/14 against a faked `tea`, actionlint and `renovate-config-validator` clean, `docker compose config` and shellcheck clean on `infra/forgejo/vps/`. - Not verifiable before switch day (listed in the checklist instead): HTTPS and SSH off, runner registration, status names matching branch protection, run-token permissions for `reuse-gate` and the reap, `!cancelled()`/`needs.<job>.result` support, push mirror, the dump reaching the backup target, Renovate opening pull requests. ## Merge Danger **Door:** two-way GitLab ignores `.forgejo/` and `infra/forgejo/`; reverting removes them. The agent docs, skills and the band switch to `tea` at merge, so until switch day agents read Forgejo instructions while the tracker is still GitLab. **Blast Radius:** tooling - `deploy/owner-setup.sh` now writes Forgejo secrets, no longer GitLab variables. - GitLab's `checks` job also runs `test:infra`. - The repository is public on Forgejo: signed-out visitors read its code, issues and run logs. ### Owner decisions 1. The repository is public, so `pr-status.sh` reads a failed job's log signed out (v15 has no log API). Registration stays off and new repositories stay private. 2. The repository moves under a new Forgejo organisation `amaurycoudr` so `chess-bot` can push images; the owner logs in under another name. 3. GitLab restarts behind Traefik (TLS passthrough) when Forgejo comes up and loses Let's Encrypt renewals in its last week. 4. The backup artifact asks for `retention-days: 31`, which Forgejo keeps 30 days. The audit and Renovate schedules stay as written. 5. The converter skips a blocker outside the project and keeps its section. 6. Forgejo's API cannot resolve review threads; the tracker doc leaves resolving to the owner. 7. Every job, gate included, keeps the host Docker socket, as on GitLab; a fork's pull request gets no secret and no deploy. ## Proposed rule changes - `CONTRIBUTING.md` line 59: `` - `ci` — Forgejo Actions workflows (`.forgejo/`) and other CI plumbing `` - ESLint does not cover `infra/` or `.forgejo/scripts/`; adding them is a lint-config change for its own PR. Closes #490 Closes #491 Closes #492 Closes #493 Closes #494 Closes #495 Closes #496 Closes #497

root commented

2026-10-21 10:25:58 +00:00

(Migrated from gitlab.core-project.space)

added 4 commits

640dc222 - ci: run the gate on Forgejo Actions
8680cce1 - Merge branch 'spec/489-forgejo' into ticket/491-forgejo-gate
4c10cbc6 - ci: run the Forgejo gate scripts' tests in test:infra and in the checks job
0bd1f48e - chore(repo): merge #491 into the spec #489 branch

Compare with previous version

added 4 commits <ul><li>640dc222 - ci: run the gate on Forgejo Actions</li><li>8680cce1 - Merge branch 'spec/489-forgejo' into ticket/491-forgejo-gate</li><li>4c10cbc6 - ci: run the Forgejo gate scripts' tests in test:infra and in the checks job</li><li>0bd1f48e - chore(repo): merge #491 into the spec #489 branch</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=432&start_sha=cb4ac9b1752f1f3f7beb5cdd30a4cca4547ecf5a)

root commented

2026-10-21 10:29:22 +00:00

(Migrated from gitlab.core-project.space)

added 3 commits

a1ae5b99 - feat(repo): port the gitlab-mr plugin and mr-status.sh to Forgejo on tea
1c3ce7cd - Merge branch 'spec/489-forgejo' into ticket/493-forgejo-pr-plugin
8283b173 - fix(repo): name the forgejo-pr plugin's command /forgejo-pr, apart from the pr skill

Compare with previous version

added 3 commits <ul><li>a1ae5b99 - feat(repo): port the gitlab-mr plugin and mr-status.sh to Forgejo on tea</li><li>1c3ce7cd - Merge branch 'spec/489-forgejo' into ticket/493-forgejo-pr-plugin</li><li>8283b173 - fix(repo): name the forgejo-pr plugin's command /forgejo-pr, apart from the pr skill</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=436&start_sha=0bd1f48ed3aa8437476e1bac9a2f2f7733849115)

root commented

2026-10-21 10:33:54 +00:00

(Migrated from gitlab.core-project.space)

added 3 commits

c2ef5158 - ci: stand up the Forgejo stack and its switch-day checklist
07299c7e - Merge branch 'spec/489-forgejo' into ticket/490-forgejo-stack
50ad9f91 - docs(repo): run the Blocked-by converter with its own flags in the switch-day checklist

Compare with previous version

added 3 commits <ul><li>c2ef5158 - ci: stand up the Forgejo stack and its switch-day checklist</li><li>07299c7e - Merge branch 'spec/489-forgejo' into ticket/490-forgejo-stack</li><li>50ad9f91 - docs(repo): run the Blocked-by converter with its own flags in the switch-day checklist</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=438&start_sha=8283b1738f53adf6e4e0ec37a8bac0fe1a679b72)

root commented

2026-10-21 10:37:33 +00:00

(Migrated from gitlab.core-project.space)

added 3 commits

0a3bedae - ci: build the image and deploy previews and production from Forgejo
ee552c79 - Merge branch 'spec/489-forgejo' into ticket/495-forgejo-deploy
bbd4ec89 - ci: rely on the runner's mounted Docker socket in the image jobs

Compare with previous version

added 3 commits <ul><li>0a3bedae - ci: build the image and deploy previews and production from Forgejo</li><li>ee552c79 - Merge branch 'spec/489-forgejo' into ticket/495-forgejo-deploy</li><li>bbd4ec89 - ci: rely on the runner's mounted Docker socket in the image jobs</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=440&start_sha=50ad9f911f949f6b251c5a129502a76c3735a176)

root commented

2026-10-21 10:39:28 +00:00

(Migrated from gitlab.core-project.space)

added 2 commits

b84a28c1 - ci: schedule the audit, the production backup and Renovate on Forgejo
cad398ab - Merge branch 'spec/489-forgejo' into ticket/496-forgejo-schedules

Compare with previous version

added 2 commits <ul><li>b84a28c1 - ci: schedule the audit, the production backup and Renovate on Forgejo</li><li>cad398ab - Merge branch 'spec/489-forgejo' into ticket/496-forgejo-schedules</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=445&start_sha=bbd4ec89d525602e46dc3e3c29763e7343dff41f)

root commented

2026-10-21 10:45:32 +00:00

(Migrated from gitlab.core-project.space)

added 2 commits

9b8536f6 - ci: post one bot comment with failed tests, coverage and screenshots on Forgejo
5be71491 - Merge branch 'spec/489-forgejo' into ticket/497-bot-comment

Compare with previous version

added 2 commits <ul><li>9b8536f6 - ci: post one bot comment with failed tests, coverage and screenshots on Forgejo</li><li>5be71491 - Merge branch 'spec/489-forgejo' into ticket/497-bot-comment</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=447&start_sha=cad398ab45546794d69165c7e1168296a95154d5)

root commented

2026-10-21 11:06:58 +00:00

(Migrated from gitlab.core-project.space)

added 8 commits

672377cc - refactor(ci): share one Forgejo API client, gate job list and test fakes across the scripts
ca55d594 - fix(ci): tell a missing, unreadable and empty engine coverage report apart in the bot comment
5c10325c - fix(ci): drop the old screenshots before uploading the new ones, and size...
58a98677 - ci: hand production's app secrets only to the steps that read them
355ffb36 - ci: run the root's test:infra in GitLab's checks job until the switch
449414b5 - ci: carry the app's secrets to Forgejo on switch day, and set them there from owner-setup.sh
bea27eb5 - docs(repo): finish the switch-day checklist: GitLab's CI leaves on the day, #500's last steps
05636758 - docs(repo): describe Forgejo as the forge in the README and the report comments

Compare with previous version

added 8 commits <ul><li>672377cc - refactor(ci): share one Forgejo API client, gate job list and test fakes across the scripts</li><li>ca55d594 - fix(ci): tell a missing, unreadable and empty engine coverage report apart in the bot comment</li><li>5c10325c - fix(ci): drop the old screenshots before uploading the new ones, and size...</li><li>58a98677 - ci: hand production's app secrets only to the steps that read them</li><li>355ffb36 - ci: run the root's test:infra in GitLab's checks job until the switch</li><li>449414b5 - ci: carry the app's secrets to Forgejo on switch day, and set them there from owner-setup.sh</li><li>bea27eb5 - docs(repo): finish the switch-day checklist: GitLab's CI leaves on the day, #500's last steps</li><li>05636758 - docs(repo): describe Forgejo as the forge in the README and the report comments</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=457&start_sha=5be71491bc662bf406a1923c8383a095de90444e)

root commented

2026-10-21 11:07:29 +00:00

(Migrated from gitlab.core-project.space)

marked this merge request as ready

marked this merge request as **ready**

root commented

2026-10-21 11:07:29 +00:00

(Migrated from gitlab.core-project.space)

changed the description

project_1_bot_a8dd9262857d850eef8dca5206e61de5 commented

2026-10-21 12:18:28 +00:00

(Migrated from gitlab.core-project.space)

Screenshots

Before is production, after is this merge request's review app at 8f97515.

Desktop

Page	Before	After
Home
Local game
Room

Mobile

Page	Before	After
Home
Local game
Room

### Screenshots Before is production, after is this merge request's review app at 8f97515. #### Desktop | Page | Before | After | | --- | --- | --- | | Home | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/before/home-desktop.png" width="400"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/after/home-desktop.png" width="400"> | | Local game | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/before/local-desktop.png" width="400"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/after/local-desktop.png" width="400"> | | Room | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/before/room-desktop.png" width="400"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/after/room-desktop.png" width="400"> | #### Mobile | Page | Before | After | | --- | --- | --- | | Home | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/before/home-mobile.png" width="200"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/after/home-mobile.png" width="200"> | | Local game | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/before/local-mobile.png" width="200"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/after/local-mobile.png" width="200"> | | Room | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/before/room-mobile.png" width="200"> | <img src="https://gitlab.core-project.space/amaurycoudr/chess-project/-/jobs/2799/artifacts/raw/review-screenshots/after/room-mobile.png" width="200"> |

root commented

2026-10-21 13:14:37 +00:00

(Migrated from gitlab.core-project.space)

added 1 commit

8f975153 - ci: make chess-project public on Forgejo and keep the backup a full 30 days

Compare with previous version

added 1 commit <ul><li>8f975153 - ci: make chess-project public on Forgejo and keep the backup a full 30 days</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=472&start_sha=0563675890457f454f49a7d0caf53ec147a0102c)

root commented

2026-10-21 13:14:52 +00:00

(Migrated from gitlab.core-project.space)

changed the description

root commented

2026-10-22 09:46:36 +00:00

(Migrated from gitlab.core-project.space)

added 133 commits

8f975153...932386fb - 111 commits from branch main
932386fb...47eab0cf - 12 earlier commits
e5973877 - refactor(ci): share one Forgejo API client, gate job list and test fakes across the scripts
fda53859 - fix(ci): tell a missing, unreadable and empty engine coverage report apart in the bot comment
81400eca - fix(ci): drop the old screenshots before uploading the new ones, and size...
967bc4ec - ci: hand production's app secrets only to the steps that read them
f6decb2e - ci: run the root's test:infra in GitLab's checks job until the switch
a1733815 - ci: carry the app's secrets to Forgejo on switch day, and set them there from owner-setup.sh
888553fe - docs(repo): finish the switch-day checklist: GitLab's CI leaves on the day, #500's last steps
e752a33e - docs(repo): describe Forgejo as the forge in the README and the report comments
272d5d0f - ci: make chess-project public on Forgejo and keep the backup a full 30 days
806ed99c - ci: run the Forgejo front tests on one worker, as GitLab's now do

Compare with previous version

added 133 commits <ul><li>8f975153...932386fb - 111 commits from branch <code>main</code></li><li>932386fb...47eab0cf - 12 earlier commits</li><li>e5973877 - refactor(ci): share one Forgejo API client, gate job list and test fakes across the scripts</li><li>fda53859 - fix(ci): tell a missing, unreadable and empty engine coverage report apart in the bot comment</li><li>81400eca - fix(ci): drop the old screenshots before uploading the new ones, and size...</li><li>967bc4ec - ci: hand production's app secrets only to the steps that read them</li><li>f6decb2e - ci: run the root's test:infra in GitLab's checks job until the switch</li><li>a1733815 - ci: carry the app's secrets to Forgejo on switch day, and set them there from owner-setup.sh</li><li>888553fe - docs(repo): finish the switch-day checklist: GitLab's CI leaves on the day, #500's last steps</li><li>e752a33e - docs(repo): describe Forgejo as the forge in the README and the report comments</li><li>272d5d0f - ci: make chess-project public on Forgejo and keep the backup a full 30 days</li><li>806ed99c - ci: run the Forgejo front tests on one worker, as GitLab's now do</li></ul> [Compare with previous version](/amaurycoudr/chess-project/-/merge_requests/68/diffs?diff_id=504&start_sha=8f9751535f07927e12cb206466be23fa854c0824)

root (Migrated from gitlab.core-project.space) merged commit into main

2026-10-22 09:49:46 +00:00

Sign in to join this conversation.

No reviewers