Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. How compatible are Gitea/Forgejo Actions workflows with GitHub Actions?

   1. ANot at all
   2. BLargely compatible syntax (on, jobs, steps, uses, run); most common actions work, but some GitHub-specific features and actions don't, so test each workflow
   3. CIdentical in every feature
   4. DThey only support Jenkinsfiles
   Show answer

   B. The runners are based on act-style execution. Familiar syntax, but not a perfect clone of GitHub's platform.

   From lesson 09 · The air-gapped port

2. Q2. In an air-gapped network, where does `uses: actions/checkout@v4` come from?

   1. Agithub.com, always
   2. BFrom a mirror of that action's repository inside the air gap, with the server configured to resolve actions locally
   3. CIt's built into Git
   4. DIt can't be used
   Show answer

   B. Every external dependency (actions, images, packages, scanner databases) must be mirrored inside the gap.

   From lesson 09 · The air-gapped port

3. Q3. Keyless cosign signing isn't possible offline by default. Why, and what's the alternative?

   1. Acosign doesn't work offline
   2. BKeyless relies on public Sigstore services (Fulcio, Rekor) and an OIDC issuer; offline, use key-based signing with keys in an HSM/KMS or run a private Sigstore
   3. CSigning isn't needed offline
   4. DUse MD5 sums instead
   Show answer

   B. Supply-chain controls still matter inside the gap; they just use local trust roots.

   From lesson 09 · The air-gapped port