- TypeScript 100%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
| test | ||
| .gitignore | ||
| .oxfmtrc.json | ||
| action.yml | ||
| forgejo-post-review-capability.ts | ||
| forgejo-post-review-comments.ts | ||
| forgejo-post-review-common.ts | ||
| forgejo-post-review-diff.ts | ||
| forgejo-post-review-envelope.ts | ||
| forgejo-post-review-http.ts | ||
| forgejo-post-review-pending.ts | ||
| forgejo-post-review-pr.ts | ||
| forgejo-post-review-receipt.ts | ||
| forgejo-post-review-result.ts | ||
| knip.json | ||
| LICENSE | ||
| oxlint.config.ts | ||
| package.json | ||
| pnpm-lock.yaml | ||
| post-review.ts | ||
| README.md | ||
| tsconfig.json | ||
Forgejo review writer
forgejo-review-writer is a dependency-free composite action that posts an
OIDC-bound, Axrecipe-finalized pull-request review to Forgejo. It is designed
for trusted pull_request_target posting jobs and runs directly with Node 24+
native TypeScript support. It never installs runtime dependencies.
Use a full commit SHA, never a branch or tag:
- uses: https://code.j4k.dev/j4k-oss/forgejo-review-writer@<full-commit-sha>
with:
axrecipe-url: https://recipe.axkit.dev
axrecipe-audience: https://recipe.axkit.dev/forgejo-actions
forgejo-token: ${{ secrets.FORGEJO_TOKEN }}
review-slot: forgejo-review-code-smart-1
review-repository: ${{ github.repository }}
review-number: ${{ github.event.pull_request.number }}
review-head-sha: ${{ github.event.pull_request.head.sha }}
source-workflow-run-id: ${{ inputs.source-workflow-run-id }}
source-generator-attempt: ${{ inputs.source-generator-attempt }}
The calling job must have Node 24+ available and Forgejo must advertise the
actions-reviewer-isolation capability. The writer only accepts same-repository
PRs into main; it checks the live PR state and head before OIDC minting,
before cleanup, and immediately before publication.
The action exact-pins its Axrecipe URL and audience, binds the finalized result to the repository ID, PR, head, review slot, source workflow run, and generator attempt, and emits an exact publication receipt. It accepts an existing receipt only from Forgejo's isolated Actions actor, so another workflow cannot forge idempotency. It performs bounded HTTP reads, refuses stale result windows, filters inline comments to the current diff, and removes only its own pending reviews after verifying the isolated actor.
The action is intentionally scoped to the current Axrecipe Forgejo integration. Other Axrecipe deployments require a separately built and reviewed action so an untrusted caller cannot redirect its OIDC token.
Development
pnpm install --frozen-lockfile
pnpm run format:check
pnpm run typecheck
pnpm run lint
pnpm run fta
pnpm run knip
pnpm test
MIT licensed. See LICENSE.