Forgejo 15.0 Dev Platform Released with OIDC and Ephemeral Runners

Forgejo 15.0 has been released as a major update and is now the project’s latest long-term support (LTS) version. One of the key highlights is the addition of repository-scoped access tokens. This allows administrators and users to limit token permissions to specific repositories, improving security by reducing unnecessary access. The repository API has also been updated to align with this new authorization model.

Forgejo 15.0 brings major improvements to Forgejo Actions as well. Reusable workflows can now expand into separate jobs when the top-level runs-on field is not defined, making logs clearer and allowing jobs to be executed independently across different runners.

Another important feature is the introduction of OpenID Connect (OIDC) support for Forgejo Actions. This enables workflows to authenticate with external services using short-lived, signed tokens instead of static credentials, significantly lowering the risk of leaks or misuse. This functionality requires Forgejo 15.0 along with Forgejo Runner versions newer than 12.5.

The release also introduces ephemeral runners, which are designed to execute a single job before automatically invalidating credentials and deregistering. This is particularly useful for autoscaling environments and integrations that rely on temporary workers. Additionally, runner setup has been simplified with a new web-based registration process, reducing reliance on command-line configuration.

On the user interface side, several enhancements improve usability and accessibility. These include removing the need for the Alt key when excluding labels in filters, better responsiveness on the releases page, expanded Git notes editing in single-commit pull requests, and improved support for screen readers.

Administrators planning to upgrade should be aware of some breaking changes. Default cookie names have been updated, meaning users may need to sign in again unless the previous configuration is restored. Also, backward compatibility for the old rootless Docker configuration path (/etc/gitea) has been removed, which may affect certain deployments.

Forgejo follows a three-month major release cycle with regular patch updates. With version 15.0 now designated as the LTS release, version 11.0 will continue to receive support until July 16, 2026.

For more details, see the announcement.