macaw CI helpers

Shared Forgejo Actions for macaw projects. The useful piece is a weekly-tagged toolchain image that is built only when missing — same idea you already use in auth / lmdbal / squawk, without copying the workflow into every repo.

Why this exists

Arch is rolling. Baking pacman -S … into a project Containerfile and rebuilding that image on every commit is wasteful; installing packages fresh on every CI job is slow. The compromise:

1. Hash Containerfile + current UTC ISO week → deterministic tag
2. On each CI run (and on a Monday schedule), inspect the registry
3. Build & push only if that tag is absent
4. Run the real build/test job in that image

Requirement: this repository must be public on the Forgejo instance. Cross-repo uses: only works for public repos.

Ensure CI image

# .forgejo/workflows/test.yml
jobs:
  image:
    uses: blue/ci/.forgejo/workflows/ensure-ci-image.yml@main
    with:
      image: jay
    secrets: inherit

  build-and-test:
    needs: image
    runs-on: worker2
    container:
      image: ${{ needs.image.outputs.image }}
    steps:
      - uses: actions/checkout@v4

Keep a thin scheduled workflow in each project so the image still refreshes without commits:

# .forgejo/workflows/image.yml
name: Refresh CI image
on:
  schedule:
    - cron: "0 4 * * 1"
  workflow_dispatch:
jobs:
  image:
    uses: blue/ci/.forgejo/workflows/ensure-ci-image.yml@main
    with:
      image: jay
    secrets: inherit

Inputs

Input	Default	Meaning
image	(required)	Name under the registry namespace
registry	docker.io	Registry host
namespace	thebluestbird	Registry user/org
containerfile	Containerfile	Path in the caller repo
default_branch	main	Branch that may push :latest
submodules	false	Recursive submodule checkout
runner	builder	Runner label for the image job

Secrets

Pass via secrets: inherit from the caller:

• DOCKER_HUB_USERNAME
• DOCKER_HUB_PASSWORD

Outputs

• tag — weekly md5 tag
• image — registry/namespace/image:tag

Compute-tag action

Used by the reusable workflow. Short owner/repo action refs go to DEFAULT_ACTIONS_URL, and ./ resolves in the caller workspace, so this repo references itself with an absolute URL:

- uses: https://git.macaw.me/blue/ci/.forgejo/actions/compute-tag@main

Migrating existing projects

Replace the in-repo copy of .forgejo/workflows/image.yml + .forgejo/actions/compute-tag with the uses: blue/ci/... snippets above. Keep each project’s Containerfile where it is — package lists stay per-repo.