Skip to content

Codey

Codey instances run Forgejo, so the Forgejo guide applies. This page covers what is specific to Codey.

Pushing images to the Codey registry

The job's automatic token (${{ forgejo.token }}) cannot push packages, even with permissions: packages: write. Use one of the two ways below.

The job asks Codey for a short-lived token and logs in to the registry with it. Nothing long-lived is stored in the repository.

  1. In your Codey instance, open Settings → Authorized Integrations → Add authorized integration → Forgejo Actions (Local).
  2. Select the source repository. Optionally restrict the workflow file, the Git reference (for example refs/heads/main) and the event.
  3. Under Select permissions, set package to Read and write and leave everything else at No access. Save.
  4. Copy the generated Audience and store it as an Actions variable, for example REGISTRY_AUDIENCE.
  5. In the workflow:
jobs:
  build:
    runs-on: ubuntu-latest
    enable-openid-connect: true
    steps:
      - uses: actions/checkout@v4
      - name: Registry token
        id: jwt
        run: |
          set -o pipefail
          jwt=$(curl --fail -sS \
            -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
            "$ACTIONS_ID_TOKEN_REQUEST_URL&audience=${{ vars.REGISTRY_AUDIENCE }}" | jq -r .value)
          echo "::add-mask::$jwt"
          echo "jwt=$jwt" >> "$GITHUB_OUTPUT"
      - uses: docker/login-action@v3
        with:
          registry: <your-instance>.app.codey.ch
          username: ${{ forgejo.actor }}
          password: ${{ steps.jwt.outputs.jwt }}

The integration acts as the user who created it, with only the permissions selected in step 3.

Alternative: an access token as a secret

Create an access token with the scope write:package and store it as an Actions secret, for example REGISTRY_TOKEN. Log in with your user name and that secret. The token is long-lived, so prefer the authorized integration.

Fetching from an instance that requires sign-in

If your instance requires sign-in, a plain git fetch in a step fails with could not read Username. Pass the job token:

git -c http.extraHeader="Authorization: token ${{ forgejo.token }}" fetch

Publishing a static site with Codey Pages

Codey Pages serves static sites built in a workflow. This documentation is published that way; see its workflow in runnerli/docs.