Forgejo CI

Self-hosted CI/CD built on Forgejo Actions. Runner containers run Docker-in-Docker, so jobs build and test container images without sharing a host daemon.

Runners are ephemeral — they scale up on demand and hold no state between jobs. External contributors get a constrained path: build and test stages run against a locked-down secret set, publish stages are gated behind a maintainer.

Build tooling is a Taskfile-driven pipeline that cross-compiles Go binaries for linux/amd64 and linux/arm64 from a non-Linux host.