Forgejo v15.0 adds repo-scoped tokens, OIDC for Actions, and major usability upgrades

Forgejo v15.0 has been released as the project’s new Long Term Support version, with its main changes centered on access control, Actions, and runner setup. It adds repository specific access tokens, so users can limit a token to selected repositories, and it also brings OpenID Connect support to Forgejo Actions, allowing workflows to sign in to external services with short lived credentials instead of stored secrets. This feature requires Forgejo Runner versions newer than v12.5.0.

The update also improves how reusable workflows work in Forgejo Actions. They can now be expanded into separate jobs, which makes logs easier to read and allows jobs to run across different runners or platforms. Forgejo also adds ephemeral runners for one time job execution, helping reduce credential reuse in autoscaled setups. Runner registration has also been simplified with a new web based setup flow.

The v15.0 also includes two breaking changes to keep in mind before upgrading. Most users will need to log in again because the default cookie names have changed, and older config paths are no longer supported in rootless Docker deployments unless they are manually overridden. Other changes include better OAuth and git push error messages, automatic container linking, a more responsive releases page, improved issue filter controls, better Git notes editing in pull requests, and more screen reader accessibility improvements.