Forgejo / gitea support

[Crocmagnon]

Forgejo / Gitea actions are similar to GHA in their syntax.
A support for offline mode at first would be great.

[woodruffw]

Hi @Crocmagnon, thanks for opening a discussion.

Could you say more? My understanding is that offline mode should work fine as long as the Forgejo / Gitea workflows use the same compatible subset of syntax as GitHub Actions.

(Note, however, that neither of these is officially supported and any breakage/issues you run into won't be considered bugs, at least until someone sponsors official support for those CI systems.)

[Crocmagnon]

When running zizmor . in a repo containing a .forgejo/workflows/ dir, it doesn't automatically find the workflows.
When analyzing a workflow file directly it works fine though.

❯ zizmor .
🌈 zizmor v1.19.0
fatal: no audit was performed
error: no inputs collected
  |
  = help: collection yielded no auditable inputs
  = help: inputs must contain at least one valid workflow, action, or Dependabot config

Caused by:
    no inputs collected

❯ zizmor .forgejo/workflows/terraform.yml 
🌈 zizmor v1.19.0
 INFO audit: zizmor: 🌈 completed .forgejo/workflows/terraform.yml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .forgejo/workflows/terraform.yml:29:7
   |
29 |       - name: Checkout
   |  _______^
30 | |       uses: actions/checkout@v4
   | |_______________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

error[unpinned-uses]: unpinned action reference
  --> .forgejo/workflows/terraform.yml:40:13
   |
40 |       uses: https://github.com/hashicorp/setup-terraform@v3
   |             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High

3 findings (1 suppressed, 1 fixable): 0 informational, 0 low, 1 medium, 1 high

[woodruffw]

Yes, that's intentional at the moment. If/when Forgejo/Gitea are officially supported, the discovery mechanism will be updated to discover them. Right now we assume a GitHub Actions layout.

[Crocmagnon]

Ok so I guess what I'm after is official support for these in zizmor.
What would be required for that to happen?

[woodruffw]

I think at least two things:

1. A champion/technical expert on the Forgejo/Gitea side who can answer technical questions about what's different versus GHA.
2. Either a financial sponsor for the project or a motivated third-party contributor who already has a track record of making useful contributions to zizmor.

[wwuck]

https://forgejo.org/docs/latest/user/actions/github-actions/ has a known list of differences

[woodruffw]

Triage: I'm tracking zizmor's additional platform support with #2253. Please collaborate with me on that discussion thread for any new platforms you'd like to see supported 🙂