Marketplace compatibility

Top-20 Marketplace actions compatibility

Most Marketplace actions work on fremforge without modification because fremforge runners resolve action code through fremverk-operated Forgejo pull-mirrors of upstream GitHub publishers. A workflow’s uses: actions/checkout@v4 resolves to https://frem.sh/actions/checkout — a Forgejo pull-mirror of github.com/actions/checkout with an 8-hour upstream sync interval. No customer-workflow execution reaches github.com directly: runners only ever see the mirrored copy held inside the EU, satisfying the DPA Annex A.6 commitment. The Forgejo Actions runtime exposes the same environment variables as GitHub Actions (GITHUB_TOKEN, GITHUB_SHA, GITHUB_REF, GITHUB_API_URL, etc.) so a workflow’s uses: actions/checkout@v4 directive resolves through the mirror transparently.

Mirrored upstream publishers (as of 2026-06-02)

These GitHub publishers are mirrored as Forgejo pull-mirrors on frem.sh and resolve cleanly from any customer workflow:

actions/ — checkout, setup-node, setup-python, setup-go, setup-java, setup-dotnet, upload-artifact, download-artifact, cache
docker/ — login-action, setup-buildx-action, build-push-action
pnpm/ — action-setup
step-security/ — harden-runner
aws-actions/ — configure-aws-credentials
azure/ — login
google-github-actions/ — auth
peter-evans/ — create-pull-request
dorny/ — paths-filter, test-reporter
softprops/ — action-gh-release
sonarsource/ — sonarcloud-github-action

If you need an action from a publisher not listed above, file a mirror request. We add a new pull-mirror of github.com/<publisher>/<repo> and your workflow runs cleanly on the next dispatch. Mirror requests typically complete within one business day. Reserved publisher names (aws-actions, azure, microsoft, sigstore, etc.) are pre-locked at the Forgejo identity layer so no customer tenant can squat them and inject malicious code through your workflows.

This matrix covers the top-20 most-downloaded actions. Entries are marked with their verification tier:

Code-reviewed, assessed from the action’s source code and Forgejo community reports; not yet run on a live fremforge hosted runner.
Runner-verified, run against a real fremforge hosted runner; outcome confirmed empirically.

Runner-verified entries land as the Phase 1 launch-blocker checklist is worked through.

Status legend

✅ Works as-is, runs unchanged; workflows port without modification.
⚠️ Works with note, runs, but a specific behaviour differs or a prerequisite must be met. Note describes what to do.
🔧 Needs wrapper, a small wrapper or composite action restores compatibility. Wrapper code provided.
❌ No equivalent, depends on GitHub-only infrastructure and cannot run against fremforge. Alternative recommended.

Coverage promise

The top 20 most-used actions on the GitHub Marketplace as of launch. The list is reviewed quarterly; an action that drops out of the top-20 stays on the matrix until a usage signal removes it.

Compatibility matrix

Action	Status	Tier	Notes
`actions/checkout`	✅	Code-reviewed	Uses `GITHUB_TOKEN` + Forgejo Git endpoint. No GitHub-specific API calls. Works unchanged.
`actions/setup-node`	✅	Code-reviewed	Pure tool-cache action. Downloads Node.js from `nodejs.org` or the runner’s tool cache; no GitHub API calls.
`actions/setup-python`	✅	Code-reviewed	Same tool-cache pattern as setup-node. Works unchanged.
`actions/setup-go`	✅	Code-reviewed	Same tool-cache pattern. Works unchanged.
`actions/setup-java`	✅	Code-reviewed	Same tool-cache pattern. Works unchanged.
`actions/setup-dotnet`	✅	Code-reviewed	Same tool-cache pattern. Works unchanged.
`actions/cache`	✅	Code-reviewed	Reads `ACTIONS_CACHE_URL` from the runner environment; fremforge runners set this via the Forgejo 1.21+ cache API. Works unchanged.
`actions/upload-artifact`	✅	Code-reviewed	Uses `ACTIONS_RUNTIME_URL` / artifact API. Forgejo 1.22+ implements this endpoint; fremforge runners are on a compatible version. Works unchanged.
`actions/download-artifact`	✅	Code-reviewed	Same artifact API as upload-artifact. Works unchanged.
`docker/login-action`	✅	Code-reviewed	Calls the target registry directly (Docker Hub, GHCR, custom registry). No GitHub-specific API. Works unchanged.
`docker/build-push-action`	✅	Code-reviewed	Docker is available natively on the runner (see Runner images), so this action works out of the box (BuildKit features included). `kaniko` remains pre-installed as a daemonless alternative — see Runner image / Container builds.
`docker/setup-buildx-action`	✅	Code-reviewed	Buildx works against the native Docker on the runner; BuildKit features (cache-from/to, multi-platform via QEMU) are available.
`peter-evans/create-pull-request`	✅	Code-reviewed	Uses the GitHub REST API (PR creation, branch push) via `GITHUB_API_URL`, which fremforge sets to the Forgejo API endpoint. Forgejo’s PR API is GitHub v3-compatible for this action’s call set. Works unchanged.
`azure/login`	⚠️	Code-reviewed	OIDC federation path: the action requests an OIDC token from `ACTIONS_ID_TOKEN_REQUEST_URL`, which fremforge runners provide. You must configure an Azure AD federated credential using fremforge’s OIDC issuer (`https://frem.sh/_app/runner/oidc` — single global issuer for all tenants). See the Runner OIDC onboarding runbook for the setup steps. The username/password (`creds`) path works without any OIDC config.
`aws-actions/configure-aws-credentials`	⚠️	Code-reviewed	Same OIDC prerequisite as azure/login. Configure an AWS IAM OIDC identity provider with the fremforge issuer URL. See the Runner OIDC onboarding runbook. The static access-key path works without OIDC config.
`google-github-actions/auth`	⚠️	Code-reviewed	Same OIDC prerequisite. Configure a GCP Workload Identity Federation pool with the fremforge issuer. See the Runner OIDC onboarding runbook. Service-account-key auth works without OIDC config.
`sonarsource/sonarcloud-github-action`	⚠️	Code-reviewed	Scan and quality-gate logic works unchanged (calls SonarCloud API directly). Inline PR decoration (posting review comments) uses the GitHub Checks API; Forgejo’s Checks API support is partial, decoration may appear as a commit status instead of inline annotations. Functional for pass/fail gate; annotation density differs.
`dorny/paths-filter`	✅	Code-reviewed	Reads file diff via `GITHUB_EVENT_PATH` payload and Git commands. No GitHub-API-only calls. Works unchanged.
`softprops/action-gh-release`	✅	Code-reviewed	Uses the GitHub Releases API via `GITHUB_API_URL`. Forgejo implements the Releases API. Works unchanged.
`dorny/test-reporter`	⚠️	Code-reviewed	Parses test result files and posts a Check Run. Forgejo supports Check Runs but annotation limits differ from GitHub’s (GitHub allows 50 annotations per Check Run; Forgejo’s limit may vary by version). For large test suites, annotations may be truncated. Pass/fail status is always reported correctly.

OIDC federation setup

Actions using OIDC (azure/login, aws-actions/configure-aws-credentials, google-github-actions/auth) require a one-time configuration step to register fremforge as a trusted OIDC issuer with the cloud provider.

fremforge’s OIDC discovery endpoint: https://frem.sh/_app/runner/oidc/.well-known/openid-configuration (single global endpoint serving all tenants; the iss claim on every runner-issued token is https://frem.sh/_app/runner/oidc). Per-tenant trust isolation is enforced by pinning cloud trust-policy conditions on the repository_owner JWT claim — the GitHub-Actions-compatible pattern.

Full step-by-step instructions for Azure AD, AWS IAM, and GCP Workload Identity are in the Runner OIDC onboarding runbook.

Container image builds

docker build and docker compose run natively on the runner — docker/build-push-action and docker/setup-buildx-action work unchanged (see Runner images for the runner model and Docker availability). kaniko is pre-installed as a daemonless alternative when you want faster cold-start or remote-registry layer caching:

- name: Build + push image (kaniko)
  run: |
    /usr/local/bin/kaniko \
      --context=$GITHUB_WORKSPACE \
      --dockerfile=Dockerfile \
      --destination=registry.example.com/$GITHUB_REPOSITORY:$GITHUB_SHA

For pure image copy/retag/push between registries, the pre-installed skopeo works without a Docker daemon. See Runner image for the full pattern.

When you find a gap

If you find a Marketplace action that should be in the top-20 and we have not flagged compatibility for it, or you find an action listed here that does not behave as documented, file an issue at support@frem.sh with subject line starting MARKETPLACE COMPAT -. We will verify and update the matrix.

Beyond the top-20

Most other Marketplace actions Just Work. The exceptions are actions that:

Rely on GitHub-internal API endpoints (Codespaces API, Copilot API, GitHub Packages container registry API beyond standard OCI push/pull).
Hardcode the GitHub OIDC issuer URL (https://token.actions.githubusercontent.com) rather than reading ACTIONS_ID_TOKEN_REQUEST_URL.
Require GitHub-specific authentication beyond GITHUB_TOKEN.

For unverified actions outside the top-20: try it. Most work. The few that do not, document, and we either ship a wrapper or surface the gap in the migration guides.