2af7b60fd9
Document the OpenID Connect tokens that Gitea Actions jobs can request since https://github.com/go-gitea/gitea/pull/39052, so they can sign in to cloud providers without long-lived secrets. - Add an OpenID Connect page covering how to trust Gitea, request a token and match its claims - Document the `id-token` permission scope and its maximum - Translate both for zh-cn and zh-tw, which still listed `id-token` as unsupported Co-authored-by: silverwind <[email protected]> Co-authored-by: silverwind <[email protected]> Reviewed-on: https://gitea.com/gitea/docs/pulls/526 Reviewed-by: silverwind <[email protected]> Co-authored-by: Max P. <[email protected]>
4.2 KiB
date, slug, sidebar_position
| date | slug | sidebar_position |
|---|---|---|
| 2023-04-27T15:00:00+08:00 | comparison | 120 |
Compared to GitHub Actions
Gitea Actions is designed to be compatible with GitHub Actions, with the differences below.
Additional features
Absolute action URLs
uses: accepts an absolute URL to any git host, e.g. uses: https://gitea.com/actions/checkout@v4.
Action prefixes
uses: accepts these prefixes:
self:references your own Gitea instance, e.g.uses: self:owner/repo@v1oruses: self:owner/repo/.gitea/workflows/build.yml@v1builtin:runs an action built into Gitea Runner, which needs no download and no Node in the job image, e.g.uses: builtin:checkout
builtin:checkout accepts the repository, ref, token, path and fetch-depth inputs of actions/checkout with the same defaults, and fails on any other input.
Workflow-relative actions
$/ references the repository and commit of the workflow, or of the enclosing composite action, e.g. uses: $/.gitea/actions/build.
Unlike ./, it needs no checkout first.
Actions written in Go
See Creating Go Actions.
Support the non-standard syntax @yearly, @monthly, @weekly, @daily, @hourly on schedule
schedule also accepts @yearly, @monthly, @weekly, @daily and @hourly, which GitHub does not.
Unsupported workflows syntax
jobs.<job_id>.environment
jobs.<job_id>.environment is ignored.
Complex runs-on
runs-on supports:
- Static strings:
runs-on: self-hosted - Arrays of labels:
runs-on: [linux, self-hosted] - String expressions:
runs-on: ${{ github.event_name == 'push' && 'ubuntu-latest' || 'self-hosted' }} - Arrays containing expressions:
runs-on: [linux, "${{ github.event_name == 'push' && 'ubuntu-latest' || 'self-hosted' }}"]
Missing features
Package repository authorization
GITEA_TOKEN cannot publish to the package registry of its repository, e.g. to push OCI images.
Use a personal access token instead, see this issue.
Problem Matchers
Problem matchers are ignored.
Create an error annotation
Error annotations are ignored.
Expressions
Expressions support the standard GitHub functions and contexts.
Missing UI features
Pre and Post steps
Pre and post steps have no section of their own in the job log.
Services steps
Service steps have no section of their own in the job log.
Different behavior
Job token permissions (permissions)
permissions and jobs.<job_id>.permissions control the GITEA_TOKEN permissions, clamped by the repository and owner settings and further restricted for fork pull requests and cross-repository access.
GitHub-only scopes like statuses, checks, deployments, security-events and pages are not supported, while Gitea adds code, releases, wiki and projects. id-token works like on GitHub, see OpenID Connect.
See Actions job token permissions.
Downloading actions
Actions without a host, like uses: actions/checkout@v4, are downloaded from https://github.com, or from your own instance when [actions].DEFAULT_ACTIONS_URL is self.
See the Configuration Cheat Sheet.
For other sources, see Absolute action URLs, Action prefixes and Workflow-relative actions.
Context availability
Context availability is not checked, so contexts like env work in more places.