Migrate nfq_forwarder (repo, CI, and workflows) from GitLab to Forgejo #40

New issue

claude · 2026-07-07T17:55:21+01:00

claude commented

2026-07-07 17:55:21 +01:00

(Migrated from gitlab.keyop.co.uk)

Blocks #39.

This GitLab instance is running the Enterprise Edition codebase but without an active Premium/Ultimate license, so it effectively only offers Community Edition-level features. Confirmed while investigating #39 ("Require approval from a human before MRs can be merged"): both the legacy approvals_before_merge project setting and the modern approval_rules API are unusable here - the former is silently ignored (a write to it has no effect), and the latter returns 403 Forbidden - consistent with "Merge request approvals" being a licensed-only feature. There is no supported way on this instance to enforce that an MR requires a real human approval before merging.

Since buying a GitLab Premium/Ultimate license isn't an option, the longer-term fix is to move this project (repo history, issues/MRs as far as practical, CI pipeline, and release workflow) to Forgejo instead, once Danny's planned Forgejo infrastructure is ready. Forgejo has built-in, license-free branch protection with required-approval support, which would let #39 actually be enforced rather than remaining a documented process/convention only.

Scope (to be refined once Forgejo is available):

Repository migration (history, tags, branches).
Recreating the .gitlab-ci.yml pipeline (lint/build/test/release stages) as Forgejo Actions (or equivalent CI).
Recreating branch protection + required-approval rules on the new host - this is the actual fix for #39.
Recreating the release process (tag-triggered package build/publish - see project memory on the release process) against Forgejo's release/package registry equivalents.
Deciding what happens to existing GitLab issue/MR history (full migration vs. a clean cutover with a link back to the GitLab archive).

Not started - waiting on the Forgejo infrastructure project itself to be ready first.

Blocks #39. This GitLab instance is running the Enterprise Edition codebase but without an active Premium/Ultimate license, so it effectively only offers Community Edition-level features. Confirmed while investigating #39 ("Require approval from a human before MRs can be merged"): both the legacy `approvals_before_merge` project setting and the modern `approval_rules` API are unusable here - the former is silently ignored (a write to it has no effect), and the latter returns `403 Forbidden` - consistent with "Merge request approvals" being a licensed-only feature. There is no supported way on this instance to enforce that an MR requires a real human approval before merging. Since buying a GitLab Premium/Ultimate license isn't an option, the longer-term fix is to move this project (repo history, issues/MRs as far as practical, CI pipeline, and release workflow) to Forgejo instead, once Danny's planned Forgejo infrastructure is ready. Forgejo has built-in, license-free branch protection with required-approval support, which would let #39 actually be enforced rather than remaining a documented process/convention only. **Scope** (to be refined once Forgejo is available): - Repository migration (history, tags, branches). - Recreating the `.gitlab-ci.yml` pipeline (lint/build/test/release stages) as Forgejo Actions (or equivalent CI). - Recreating branch protection + required-approval rules on the new host - this is the actual fix for #39. - Recreating the release process (tag-triggered package build/publish - see project memory on the release process) against Forgejo's release/package registry equivalents. - Deciding what happens to existing GitLab issue/MR history (full migration vs. a clean cutover with a link back to the GitLab archive). Not started - waiting on the Forgejo infrastructure project itself to be ready first.

claude commented

2026-07-07 17:55:41 +01:00

(Migrated from gitlab.keyop.co.uk)

marked as related to #39

claude commented

2026-07-07 17:56:06 +01:00

(Migrated from gitlab.keyop.co.uk)

mentioned in issue #39

claude commented

2026-07-07 18:02:20 +01:00

(Migrated from gitlab.keyop.co.uk)

mentioned in issue danny/cs-bifrost#7

claude referenced this issue from a commit

2026-07-09 10:18:24 +01:00

Migrate CI from GitLab to Forgejo Actions (#40)

claude referenced this issue from a pull request that will close it,

2026-07-09 10:18:39 +01:00

Migrate CI from GitLab to Forgejo Actions (#40) #80

claude referenced this issue from a commit

2026-07-09 12:52:07 +01:00

Downgrade upload-artifact to v3 (#40)

claude referenced this issue from a commit

2026-07-09 13:03:16 +01:00

Rename release secret to RELEASE_TOKEN (#40)

danny closed this issue

2026-07-09 13:09:29 +01:00

danny referenced this issue from a commit

2026-07-09 13:09:29 +01:00

Merge pull request 'Migrate CI from GitLab to Forgejo Actions (#40)' (#80) from issue40_migrate_to_forgejo into main

claude referenced this issue from a commit

2026-07-09 13:15:04 +01:00

Set GORELEASER_FORCE_TOKEN=gitea for the release job (#40)

claude referenced this issue

2026-07-09 13:15:18 +01:00

Set GORELEASER_FORCE_TOKEN=gitea for the release job (#40) #81

danny referenced this issue from a commit

2026-07-09 13:21:09 +01:00

Merge pull request 'Set GORELEASER_FORCE_TOKEN=gitea for the release job (#40)' (#81) from issue40_goreleaser_force_token into main

claude commented

2026-07-09 13:27:43 +01:00

Fully done end to end - closing out for real now.

Repo remigrated cleanly (git history, issues, PRs, labels, releases all confirmed matching GitLab byte-for-byte at the time).
CI translated to Forgejo Actions (#80) and confirmed green on a real run.
.goreleaser.yaml retargeted to Forgejo's own registry/release APIs (#80, #81).
Real tagged release confirmed working end to end: v1.1.7 (https://forgejo.keyop.co.uk/keyop-go/nfq_forwarder/releases/tag/v1.1.7) published automatically from the tag push, with all four package formats + checksums attached, matching what GitLab used to produce.

Six distinct real infra issues were found and fixed along the way (runner scope, registry auth/image size, missing Node.js in the CI image, a Docker-in-Docker host-gateway resolution gotcha, an artifact-upload protocol version mismatch, and a goreleaser multi-token ambiguity) - see the linked PRs for details. GitLab (gitlab.keyop.co.uk/keyop/go/nfq_forwarder) is no longer the canonical location for this project.

Fully done end to end - closing out for real now. - Repo remigrated cleanly (git history, issues, PRs, labels, releases all confirmed matching GitLab byte-for-byte at the time). - CI translated to Forgejo Actions (#80) and confirmed green on a real run. - `.goreleaser.yaml` retargeted to Forgejo's own registry/release APIs (#80, #81). - **Real tagged release confirmed working end to end**: `v1.1.7` (https://forgejo.keyop.co.uk/keyop-go/nfq_forwarder/releases/tag/v1.1.7) published automatically from the tag push, with all four package formats + checksums attached, matching what GitLab used to produce. Six distinct real infra issues were found and fixed along the way (runner scope, registry auth/image size, missing Node.js in the CI image, a Docker-in-Docker `host-gateway` resolution gotcha, an artifact-upload protocol version mismatch, and a goreleaser multi-token ambiguity) - see the linked PRs for details. GitLab (`gitlab.keyop.co.uk/keyop/go/nfq_forwarder`) is no longer the canonical location for this project.

claude added the

Claude-fixed

label

2026-07-09 13:27:57 +01:00

claude referenced this issue

2026-07-09 13:33:16 +01:00

Require approval from a human (i.e. user 'danny') before MRs can be merged #39

Sign in to join this conversation.