devops-pipeline

A reusable CI/CD pipeline for Forgejo repositories. Drop it into any new project and get: push to main → build/test with AI-fix → release + bottles

• formula update. Push to devops → build/test with AI-fix → PR to main. Open a bug/enhancement issue → opencode implements the fix and opens a PR to devops.

The pipeline is a thin bootstrap — a single level-pipeline.yml passes context to opencode and opencode does everything else (detect, build, test, AI-fix, release, bottles, PR, tidy). The AI orchestration logic lives in the opencode prompt (see AGENTS.md), not in YAML hardcoded steps.

How to use this template

You have two options — pick whichever is more convenient.

Option A — "Use this template" button (Forgejo web UI)

1. In Forgejo, navigate to https://forge.akinus21.com/akinus/devops-pipeline.
2. Click the ⋯ menu (top right) → Use this template (or the equivalent button in your Forgejo version).
3. Pick the new repo's owner + name, set visibility, and create.
4. Clone your new repo locally:

   git clone ssh://git@forge.akinus21.com:2222/<owner>/<new-repo>.git ~/projects/<new-repo>
   cd ~/projects/<new-repo>
   

5. The .forgejo/workflows/ + install.sh are already in the repo — nothing else to copy. Skip to Configure the new repo.

Option B — Manual install via the install script

If you already have a repo (perhaps with existing code) and want to add the pipeline:

# Download the install.sh + .forgejo/ from the template repo into /tmp
curl -sSL https://forge.akinus21.com/akinus/devops-pipeline/archive/main.tar.gz \
  | tar xz -C /tmp --strip-components=1 devops-pipeline

# Run the installer — it copies the workflow files into your repo,
# creates the 'devops' branch, commits, and pushes.
bash /tmp/install.sh ~/projects/<new-repo>

Notes:

• The archive directory is named devops-pipeline/ (no branch suffix). The --strip-components=1 devops-pipeline extracts it directly into /tmp.
• For self-hosted Forgejo on a non-default host, replace forge.akinus21.com/akinus/devops-pipeline with your <host>/<owner>/devops-pipeline.

Or if you have this template cloned somewhere already:

~/projects/devops-pipeline/install.sh ~/projects/<new-repo>

To install the Homebrew formula stub too (only relevant for CLI tools with homebrew distribution):

WITH_FORMULA=1 ~/projects/devops-pipeline/install.sh ~/projects/<new-repo>

To use non-default branch names:

DEV_BRANCH=staging MAIN_BRANCH=production \
  ~/projects/devops-pipeline/install.sh ~/projects/<new-repo>

Configure the new repo

After the pipeline files are in place, you need to set a few things in your new repo's Forgejo UI:

1. Settings → Actions → Secrets — add the secrets the pipeline needs:

   • TAP_TOKEN — only if you use a homebrew tap. Personal API token with write:repository scope, scoped to your tap repo. If you don't distribute via homebrew, skip this.

2. Settings → Actions → Variables — optional overrides:

   • OPENCODE_MODEL — model ID passed to opencode run --model. Empty = runner default.
   • BREW_TAP_ENABLED — true to enable the formula + bottle pipeline.
   • BREW_TAP_REPO — owner/tap-repo-name.
   • BREW_TAP_BRANCH — tap branch (default main).
   • BOT_NAME / BOT_EMAIL — git committer identity for bot commits.
   • MAIN_BRANCH / DEVOPS_BRANCH / ISSUE_BRANCH_PREFIX — only set if your branch names differ from the defaults (main, devops, issue-).

3. Runner prerequisites (set on the Forgejo runner host, not in the repo):

   • A runner registered with the label rust-ci pointing at a Docker image that has rustc, cargo, opencode, jq, git, and curl pre-installed. The pipeline uses runs-on: rust-ci for that reason. A reference image is the akclip Dockerfile.rust-ci.
   • forgejo-actions auto-token enabled on the runner, so ${{ github.token }} resolves.

What you'll see once it's running

• Push to main — triggers the release pipeline: build/test with AI-fix → bump version → cut release → build bottles → update formula → tidy.
• Push to devops — triggers the devops pipeline: build/test with AI-fix → open PR to main → tidy.
• Open a bug or enhancement issue — triggers the AI-fix loop: opencode analyzes the issue, implements the fix on an issue-N branch, opens a PR to devops, closes the issue.

Customizing the pipeline

The pipeline is a thin bootstrap — one workflow file (level-pipeline.yml) passes context to opencode and opencode handles everything else. The AI orchestration logic (detect language, build, test, AI-fix, release, bottles, PR, tidy) lives in the opencode prompt, not in YAML.

To change pipeline behavior, edit AGENTS.md (the opencode orchestration spec) or the prompt blocks within it. Do not edit level-pipeline.yml for logic changes — keep it as a thin bootstrap layer.

Files in this template

.
├── .forgejo/workflows/
│   ├── level-pipeline.yml  # Unified pipeline (thin opencode bootstrap)
│   └── level0-sync.yml     # Template sync
├── install.sh              # One-shot installer
├── AGENTS.md               # opencode orchestration spec (for template itself)
└── README.md               # This file

Validated end-to-end

This pipeline was developed and validated on akinus/akclip. The unified pipeline (push to main release, push to devops PR, and issue AI-fix) completed a full end-to-end run on June 28, 2026 — including an AI-generated 23-test suite added via an enhancement issue.