What Codebahn adds to Forgejo
Last updated:
Codebahn runs Forgejo with a managed layer on top. This page lists what that layer abstracts, what it adds, and what it changes. For stock Forgejo features (repositories, the API, user admin, Actions syntax), see the upstream docs.
Runner provisioning
Section titled “Runner provisioning”You pick a runner size in runs-on, we provision an isolated, ephemeral VM on Scaleway in Paris. No runner binary to install, no Docker host to manage, no registration tokens for the common case. Jobs start in about 40 seconds cold, 2 seconds warm. Bring your own runner alongside ours if you want different hardware.
See CI runners for sizes, the pre-cached toolchain, and bring-your-own setup.
GitHub Actions compatibility
Section titled “GitHub Actions compatibility”Workflow files in .codebahn/workflows/, .forgejo/workflows/, .gitea/workflows/, and .github/workflows/ are all read and merged, so GitHub workflows run without renaming the directory. The runner image follows the GitHub Actions layout with pre-cached Go and Node toolchains in the GitHub-style toolcache, so actions/setup-go and actions/setup-node resolve offline. New commits to the same branch auto-cancel in-progress runs on that branch.
See Workflow directories for precedence and de-duplication, and CI runners for the image contents.
Deployment environments
Section titled “Deployment environments”A callback-driven environment system turns PaaS webhooks into commit statuses and PR comments. Create an environment, paste the callback URL into your provider’s webhook settings, and deploy results appear on the commit and pull request. Supports Vercel, Netlify, Render, Railway, Cloudflare Pages, and a generic format.
See Environments for the callback format and provider notes.
Container registry integration
Section titled “Container registry integration”The built-in OCI container registry lives at codebahn.net. In CI, ${{ github.token }} authenticates automatically, so you push images without creating or storing a PAT. Every image is private; there is no public or anonymous pull.
See Container registry for image naming, storage quota, and cleanup rules.
Bot identity for CI
Section titled “Bot identity for CI”Each CI job receives a CODEBAHN_BOT_TOKEN environment variable: a short-lived, repo-scoped personal access token issued to a dedicated bot user. Tools like Renovate can use it to open pull requests under a recognizable identity that triggers CI (the built-in Actions token cannot trigger workflows). The token is scoped to the repository that owns the job, expires after the job timeout, and is not injected for fork pull requests.
GitHub App import and mirrors
Section titled “GitHub App import and mirrors”Token-based mirrors are stock Forgejo. Codebahn adds a GitHub App flow: install the Codebahn app on GitHub, pick repos, and import up to 100 at once with full history, issues, PRs, labels, milestones, and releases. Syncs mint short-lived, repo-scoped credentials automatically. No token to rotate or store. Imported repos can convert to ongoing mirrors if you want both remotes.
See Migrate from GitHub for the import flow and Mirror a GitHub repository for ongoing sync and the token-to-app conversion.
Action mirrors
Section titled “Action mirrors”Common GitHub Actions (actions/checkout, actions/setup-go, actions/setup-node, and others) are pre-mirrored on the platform as system-level organisations. Workflows that reference actions/checkout@v4 resolve without manual mirror setup. Self-hosted Forgejo needs manual mirrors or a redirect for each action org.
See Action mirrors for the full list.
A dedicated command-line tool for working with Codebahn repositories, CI, pull requests, and issues. Also ships the built-in MCP server for AI coding assistants. Published on GitHub, installable via go install or binary download.
See CLI for installation and commands.
Built-in MCP server
Section titled “Built-in MCP server”MCP is built into the platform at codebahn.net/mcp and also available via the CLI. AI assistants connect with OAuth (platform) or a personal access token (CLI). The server covers every core flow: repos, branches, issues, pull requests (including reviews), and CI. Works with Claude Code, Cursor, and VS Code.
See Connect an AI assistant for setup.
Opinionated defaults
Section titled “Opinionated defaults”Codebahn changes a few Forgejo defaults to match the product’s stance:
- Private-only repositories. No public repos, no anonymous pull. Every image in the container registry is private. Tenant data is never browsable without auth.
- Workflow directory merging. Enabled by default. Upstream Forgejo reads only the first directory found; Codebahn reads all four and merges.
- Auto-cancel on same-branch push. A new commit to a branch cancels in-progress runs on that branch. Override with a
concurrencyblock. - Federation disabled. ActivityPub federation is off. Tenant isolation requires it; a federated instance would expose tenant activity to external servers.
What we leave to upstream Forgejo
Section titled “What we leave to upstream Forgejo”Everything not listed above is stock Forgejo: repository management, the REST API, OAuth providers, package formats beyond OCI, and admin. We link to the upstream docs and do not re-document it. Note that wiki, projects, stars, and time tracking are disabled.