# fremforge runner toolstack

Tools available to your workflows on fremforge-hosted runners (`runs-on: ubuntu-latest` / `fremforge`). Multi-version language runtimes resolve through the standard `setup-*` actions; everything else is on `PATH`.

> Auto-generated from `runner-base/toolstack.yaml` — do not edit by hand.

## Language runtimes (multi-version)

| Runtime | Versions | Resolve via |
|---|---|---|
| Node.js | 26.8.1, 24.20.0, 22.23.2 | `actions/setup-node` |
| Go | 1.27.1, 1.26.8 | `actions/setup-go` |
| Python | 3.14, 3.13, 3.12 | `actions/setup-python` |
| .NET SDK | 10.0, 8.0 | `actions/setup-dotnet` |
| Java (Temurin) | 21, 17, 25 | `actions/setup-java` |
| Ruby | 4.0.6, 3.4.10, 3.3.12 | `ruby/setup-ruby` |
| Android SDK | 34 | `android-actions/setup-android` |
| Miniconda3 | py311 | `conda-incubator/setup-miniconda` |
| R | 4.3 | `r-lib/actions/setup-r` |

## Languages

| Tool | Version | Notes |
|---|---|---|
| Rust (stable) | rustup | rustc + cargo via rustup |
| PowerShell | 7.6.5 |  |
| PHP | 8.3 | with Composer |

## Package managers

| Tool | Version | Notes |
|---|---|---|
| pnpm | corepack |  |
| Yarn | corepack |  |
| Composer | latest |  |
| Maven | 3.9.16 |  |
| Gradle | 9.7.1 |  |

## Build toolchain

| Tool | Version | Notes |
|---|---|---|
| GCC / G++ (build-essential) | debian-13 |  |
| Clang / LLD | debian-13 |  |
| CMake | debian-13 |  |
| Ninja | debian-13 |  |
| make / pkg-config / autotools | debian-13 |  |
| zstd | debian-13 |  |

## Infrastructure-as-Code

| Tool | Version | Notes |
|---|---|---|
| OpenTofu | 1.12.6 | Terraform is BUSL — not baked; use hashicorp/setup-terraform at runtime |
| Bicep | 0.46.1 |  |
| Pulumi | 3.261.0 |  |
| Ansible | latest | ansible-core via pipx |
| AWS SAM CLI | 1.161.0 |  |

## Cloud CLIs

| Tool | Version | Notes |
|---|---|---|
| AWS CLI | 2.34.62 |  |
| Azure CLI | latest |  |
| Google Cloud CLI | 569.0.0 | gcloud + gsutil + bq |

## Security & lint scanners

| Tool | Version | Notes |
|---|---|---|
| Checkov | 3.3.16 | IaC misconfig (pipx) |
| cfn-lint | latest | CloudFormation lint (pipx) |
| actionlint | 1.7.12 | lints Forgejo/GitHub Actions workflows |
| hadolint | 2.15.1 | Dockerfile lint |
| yamllint | debian-13 |  |
| gitleaks | 8.30.1 |  |
| trivy | 0.74.0 | vuln + IaC/misconfig (absorbed tfsec) |
| osv-scanner | 2.4.0 |  |
| cosign | 3.1.2 |  |
| syft | 1.48.0 |  |
| opengrep | 1.22.0 | SAST (Semgrep fork) |
| scorecard | 5.5.0 |  |

## Containers

| Tool | Version | Notes |
|---|---|---|
| kaniko | 1.24.0 | rootless image build |
| skopeo | debian-13 |  |
| Docker (CLI + native daemon) | 29.5.3 | Docker daemon runs natively on the runner VM (no sidecar, no DOCKER_HOST indirection). Add the `dind-privileged` runs-on label for workflows that need KVM-nesting / extra capabilities. |
| Docker Buildx | 0.37.0 | BuildKit frontend for `docker buildx build` |
| forgejo-runner (act_runner) | 12.10.2 | Upstream act_runner; the VM's runner binary. Registered with --ephemeral so it picks up exactly one task before the VM is destroyed. |

## Kubernetes

| Tool | Version | Notes |
|---|---|---|
| kubectl | 1.36.1 |  |
| Helm | 4.2.0 |  |
| kustomize | 5.8.1 |  |
| kind | 0.33.0 | needs the native Docker daemon (default) or `dind-privileged` for KVM-nesting |

## Git / forge / utilities

| Tool | Version | Notes |
|---|---|---|
| git / git-lfs | debian-13 |  |
| tea | 0.14.1 | Forgejo/Gitea CLI |
| jq | debian-13 |  |
| yq | 4.45.1 |  |
| shellcheck / shfmt | 3.10.0 |  |

## Database clients

| Tool | Version | Notes |
|---|---|---|
| PostgreSQL client | debian-13 |  |
| MySQL client | debian-13 |  |
| SQLite3 | debian-13 |  |

## Browsers & e2e

| Tool | Version | Notes |
|---|---|---|
| Chromium + chromedriver | debian-13 |  |
| Firefox ESR + geckodriver | 0.36.0 |  |
| Selenium Server | 4.44.0 |  |

## Accessibility testing

| Tool | Version | Notes |
|---|---|---|
| a11y-session | builtin | wrapper — starts Xvfb + session D-Bus + the AT-SPI bus, then runs your command: `a11y-session pytest tests/a11y`. Launch the browser HEADED with --force-renderer-accessibility; headless exposes an EMPTY tree rather than failing, so assert a canary. |
| AT-SPI2 (at-spi2-core) | debian-13 | the accessibility bus + registry; Chromium and Firefox publish their tree here |
| pyatspi | debian-13 | Python bindings — walk the tree and assert the role / accessible name / state of each element |
| Xvfb | debian-13 | virtual X display; required, because Chromium exposes no AT-SPI tree without one |