Forgejo review writer

forgejo-review-writer is a dependency-free composite action that posts an OIDC-bound, Axrecipe-finalized pull-request review to Forgejo. It is designed for trusted pull_request_target posting jobs and runs directly with Node 24+ native TypeScript support. It never installs runtime dependencies.

Use a full commit SHA, never a branch or tag:

- uses: https://code.j4k.dev/j4k-oss/forgejo-review-writer@<full-commit-sha>
  with:
    axrecipe-url: https://recipe.axkit.dev
    axrecipe-audience: https://recipe.axkit.dev/forgejo-actions
    forgejo-token: ${{ secrets.FORGEJO_TOKEN }}
    review-slot: forgejo-review-code-smart-1
    review-repository: ${{ github.repository }}
    review-pull-request-binding: ${{ inputs.review-pull-request-binding }}
    source-workflow-run-id: ${{ inputs.source-workflow-run-id }}
    source-generator-attempt: ${{ inputs.source-generator-attempt }}

review-pull-request-binding is one strict JSON object with number, headSha, headRef, headRepository, baseRef, and mergeBaseSha. The calling job must have Node 24+ available and Forgejo must advertise the actions-reviewer-isolation capability. The writer accepts only an open, same-repository PR whose live base ref, merge-base SHA, head SHA, head ref, and head repository exactly match the supplied values. This includes main and same-repository stacked PR bases. It checks that binding before OIDC minting, before cleanup, and immediately before publication.

The action exact-pins its Axrecipe URL and audience, binds the finalized result to the repository ID, PR, base, head, review slot, source workflow run, and generator attempt, and emits an exact publication receipt. It accepts an existing receipt only from Forgejo's isolated Actions actor, so another workflow cannot forge idempotency. It performs bounded HTTP reads, refuses stale result windows, filters inline comments to the current diff, and removes only its own pending reviews after verifying the isolated actor.

The Axrecipe result read and result envelope must also require baseRef and mergeBaseSha; the writer uses receipt schema v2 and does not accept prior receipts.

The action is intentionally scoped to the current Axrecipe Forgejo integration. Other Axrecipe deployments require a separately built and reviewed action so an untrusted caller cannot redirect its OIDC token.

Development

pnpm install --frozen-lockfile
pnpm run format:check
pnpm run typecheck
pnpm run lint
pnpm run fta
pnpm run knip
pnpm test

MIT licensed. See LICENSE.