ci-actions — shared Forgejo Actions

Source-of-truth for shared CI actions. Mirror this to the Forgejo repo beezly/ci-actions so workflows can uses: beezly/ci-actions/<action>@main.

aws-roles-anywhere

Exchanges a Teleport-issued X.509 SVID for temporary AWS credentials via IAM Roles Anywhere — no static keys in CI. The job mounts only its own per-workload SVID subdir (posture B), and the action installs aws_signing_helper, writes a credential_process profile, and exports AWS_PROFILE/AWS_CONFIG_FILE for later steps.

Adding a new CI consumer (the recipe — no secrets, ever)

1. Teleport (/opt/teleport): add a workload_identity (/svc/<name>) + an issuer role (label-matched), grant the role to the bot, and add a workload-identity-x509 service to tbot.yaml writing to /ci-output/<name> (→ host /opt/forgejo-runner/svid/<name>).
2. AWS: an IAM role (its own policy) + a Roles Anywhere profile, reusing the shared trust anchor arn:aws:rolesanywhere:us-east-1:392346798719:trust-anchor/fceb47ca-3977-4322-bde2-085852272cb5. Trust policy pins aws:PrincipalTag/x509SAN/URI == spiffe://teleport.a10r.net/svc/<name>.
3. Workflow: mount /opt/forgejo-runner/svid/<name>:/svid:ro (allowlisted by the runner) and uses: beezly/ci-actions/aws-roles-anywhere@main with the role/profile/trust-anchor ARNs.

No runner changes needed after the one-time valid_volumes setup.

Deploy / handoff steps (require Forgejo write access)

# 1. Create the shared repo (once) and push this action:
#    (run wherever you have git + a Forgejo token/SSH for beezly)
git clone https://code.a10r.net/beezly/ci-actions.git   # after creating the empty repo in the UI/API
cp -r ci-actions/aws-roles-anywhere ci-actions-clone/ && cd ci-actions-clone
git add aws-roles-anywhere/action.yml && git commit -m "Add aws-roles-anywhere action" && git push

# 2. Update beezly/bezfest: replace .forgejo/workflows/build.yml with examples/bezfest-build.yml,
#    push to a BRANCH first (deploy steps are main-gated, so a branch run builds only).
#    Verify the job's "Configure AWS" step succeeds, then merge to main.

# 3. After a soak on main: remove the AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY secrets from the
#    bezfest repo, and deactivate the bezfest-deployer IAM access key (break-glass first).

The portainer-session AI is blocked from minting Forgejo tokens for your account, so these push steps are left to you (or run them with an explicitly-granted token).