diff --git a/.forgejo/workflows/actions.yml b/.forgejo/workflows/actions.yml
new file mode 100644
index 0000000..8308ec1
--- /dev/null
+++ b/.forgejo/workflows/actions.yml
@@ -0,0 +1,65 @@
+on: [ push ]
+
+jobs:
+  actions:
+    runs-on: self-hosted
+    strategy:
+      matrix:
+        info:
+          - version: "1.21.0-5-rc2"
+            image: codeberg.org/forgejo-experimental/forgejo
+            # keep "cron" last otherwise it will linger and pollute the following runs
+            tests: "${{ vars.V1_21_TESTS || 'echo push-cancel artifacts service checkout pull-request container expression local-action docker-action if if-fail cron' }}"
+          - version: "1.20"
+            image: codeberg.org/forgejo/forgejo
+            tests: "${{ vars.V1_20_TESTS || 'echo checkout service container expression local-action docker-action if if-fail' }}"
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: https://code.forgejo.org/actions/setup-forgejo@v1
+        with:
+          install-only: true
+
+      - if: matrix.info.tests != 'none'
+        shell: bash
+        run: |
+          forgejo.sh setup root admin1234 ${{ matrix.info.image }} ${{ matrix.info.version }}
+          forgejo-runner.sh setup
+          export FORGEJO_RUNNER_LOGS=forgejo-runner.log
+          export url=http://root:admin1234@$(cat forgejo-ip):3000
+          export token=$(cat forgejo-token)
+
+          function run() {
+            local example=$1
+
+            export example
+            export EXAMPLE_DIR=$(pwd)/actions/example-$example
+
+            if test -f $EXAMPLE_DIR/setup.sh ; then
+              echo "============================ SETUP example-$example ==================="
+              bash -ex $EXAMPLE_DIR/setup.sh || return 1
+            fi
+
+            if test -f $EXAMPLE_DIR/run.sh ; then
+              echo "============================ RUN example-$example ==================="
+              bash -ex $EXAMPLE_DIR/run.sh || return 1
+            else
+              forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example setup-forgejo $token || return 1
+            fi
+
+            if test -f $EXAMPLE_DIR/teardown.sh ; then
+              echo "============================ TEARDOWN example-$example ==================="
+              bash -ex $EXAMPLE_DIR/teardown.sh || return 1
+            fi
+          }
+
+          for example in ${{ matrix.info.tests }} ; do
+            echo "============================ BEGIN example-$example ==================="
+            if ! time run $example >& /tmp/run.out ; then
+                cat /tmp/run.out
+                echo "============================ FAIL example-$example ==================="
+                sleep 5 # hack for Forgejo v1.21 to workaround a but by which the last lines of the output are moved to the next step
+                false
+            fi
+            echo "============================ END example-$example ==================="
+          done
diff --git a/README.md b/README.md
index e1a0811..21a0270 100644
--- a/README.md
+++ b/README.md
@@ -1 +1,11 @@
-end-to-end tests
+# Forgejo end-to-end tests
+
+A series of tests scenarios and assertions covering
+[Forgejo](https://codeberg.org/forgejo/forgejo) and the [Forgejo
+runner](https://code.forgejo.org/forgejo/runner). They partially rely
+on [Forgejo actions](https://code.forgejo.org/actions) developped
+specifically for testing such as
+[setup-forgejo](https://code.forgejo.org/actions/setup-forgejo).
+
+They are designed to run using Forgejo releases and development
+versions compiled from designated repositories.
diff --git a/actions/example-artifacts/.forgejo/workflows/test.yml b/actions/example-artifacts/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..0a8e3b8
--- /dev/null
+++ b/actions/example-artifacts/.forgejo/workflows/test.yml
@@ -0,0 +1,47 @@
+on: [push]
+jobs:
+  upload-many:
+    runs-on: docker
+    steps:
+    - run: mkdir -p artifacts
+
+    - run: touch artifacts/ONE artifacts/TWO
+
+    - uses: actions/upload-artifact@v3
+      with:
+        name: many-artifacts
+        path: artifacts/
+
+  download-many:
+    needs: [upload-many]
+    runs-on: docker
+    steps:
+    - uses: actions/download-artifact@v3
+
+    - run: |
+        test -f many-artifacts/ONE
+        test -f many-artifacts/TWO
+
+  upload-one:
+    runs-on: docker
+    steps:
+    - run: mkdir -p path/to/artifact
+
+    - run: echo hello > path/to/artifact/world.txt
+
+    - uses: actions/upload-artifact@v3
+      with:
+        name: my-artifact
+        path: path/to/artifact/world.txt
+
+  download-one:
+    needs: [upload-one]
+    runs-on: docker
+    steps:
+    - run: "! test -f world.txt"
+
+    - uses: actions/download-artifact@v3
+      with:
+        name: my-artifact
+
+    - run: "test -f world.txt"
diff --git a/actions/example-checkout/.forgejo/workflows/test.yml b/actions/example-checkout/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..7b88160
--- /dev/null
+++ b/actions/example-checkout/.forgejo/workflows/test.yml
@@ -0,0 +1,10 @@
+on: [push]
+jobs:
+  v3:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v3
+  v4:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v4
diff --git a/actions/example-container/.forgejo/workflows/test.yml b/actions/example-container/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..6385e42
--- /dev/null
+++ b/actions/example-container/.forgejo/workflows/test.yml
@@ -0,0 +1,8 @@
+on: [push]
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: alpine:3.18
+    steps:
+      - run: grep Alpine /etc/os-release
diff --git a/actions/example-context/.forgejo/fileone.txt b/actions/example-context/.forgejo/fileone.txt
new file mode 100644
index 0000000..a2628c1
--- /dev/null
+++ b/actions/example-context/.forgejo/fileone.txt
@@ -0,0 +1 @@
+ONE
diff --git a/actions/example-cron/.forgejo/workflows/test.yml b/actions/example-cron/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..c81b017
--- /dev/null
+++ b/actions/example-cron/.forgejo/workflows/test.yml
@@ -0,0 +1,14 @@
+on:
+  schedule:
+    - cron: '* * * * *'
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/debian:bookworm
+      options: "--volume /srv/example-cron-volume:/srv/example-cron-volume"
+
+    steps:
+      - run: |
+          touch /srv/example-cron-volume/DONE
diff --git a/actions/example-cron/run.sh b/actions/example-cron/run.sh
new file mode 100755
index 0000000..b855cc5
--- /dev/null
+++ b/actions/example-cron/run.sh
@@ -0,0 +1,6 @@
+forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+# cron runs once per minute, give it three minutes max before declaring failure
+if ! RETRY_DELAYS="30 30 30 30 30 30" forgejo.sh retry test -f /srv/example-cron-volume/DONE ; then
+    cat $FORGEJO_RUNNER_LOGS
+    false
+fi
diff --git a/actions/example-cron/runner-config.yaml b/actions/example-cron/runner-config.yaml
new file mode 100644
index 0000000..119cde4
--- /dev/null
+++ b/actions/example-cron/runner-config.yaml
@@ -0,0 +1,30 @@
+
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:16-bullseye"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: ""
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example-cron-volume"]
+  docker_host: ""
+
+host:
+  workdir_parent:
diff --git a/actions/example-cron/setup.sh b/actions/example-cron/setup.sh
new file mode 100755
index 0000000..db8208f
--- /dev/null
+++ b/actions/example-cron/setup.sh
@@ -0,0 +1,2 @@
+mkdir /srv/example-cron-volume
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload
diff --git a/actions/example-cron/teardown.sh b/actions/example-cron/teardown.sh
new file mode 100755
index 0000000..b410c51
--- /dev/null
+++ b/actions/example-cron/teardown.sh
@@ -0,0 +1 @@
+forgejo-runner.sh reload
diff --git a/actions/example-docker-action/.forgejo/workflows/test.yml b/actions/example-docker-action/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..988a81e
--- /dev/null
+++ b/actions/example-docker-action/.forgejo/workflows/test.yml
@@ -0,0 +1,19 @@
+on: [push]
+
+jobs:
+  ls:
+    runs-on: docker
+    steps:
+      #
+      # This Docker action creates the file SOMEFILE ...
+      #
+      - uses: https://code.forgejo.org/forgejo/test-setup-forgejo-docker@main
+        with:
+          args: ${{ github.workspace }}/SOMEFILE
+      #
+      # ... which then also exists in the job workspace
+      # because both docker containers are automatically
+      # sharing the volume that contains it.
+      #
+      - run: |
+          test -f ${{ github.workspace }}/SOMEFILE
diff --git a/actions/example-echo/.forgejo/workflows/test.yml b/actions/example-echo/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..d470cda
--- /dev/null
+++ b/actions/example-echo/.forgejo/workflows/test.yml
@@ -0,0 +1,6 @@
+on: [push]
+jobs:
+  test:
+    runs-on: docker
+    steps:
+      - run: echo All Good
diff --git a/actions/example-expression/.forgejo/fileone.txt b/actions/example-expression/.forgejo/fileone.txt
new file mode 100644
index 0000000..a2628c1
--- /dev/null
+++ b/actions/example-expression/.forgejo/fileone.txt
@@ -0,0 +1 @@
+ONE
diff --git a/actions/example-expression/.forgejo/workflows/test.yml b/actions/example-expression/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..9a9acb1
--- /dev/null
+++ b/actions/example-expression/.forgejo/workflows/test.yml
@@ -0,0 +1,106 @@
+on: [push]
+
+env:
+  KEY1: value1
+  KEY2: value2
+
+jobs:
+  test:
+    runs-on: docker
+    steps:
+
+      - name: environment
+        run: |
+          set -x
+          test "KEY1=${{ env.KEY1 }}" = "KEY1=value1"
+          test "KEY2=$KEY2" = "KEY2=value2"
+
+      - name: if skip one
+        run: false
+        if: env.KEY1 == 'nogood'
+      - name: if skip two
+        run: false
+        if: ${{ env.KEY1 == 'nogood' }}
+      - name: if does not skip
+        id: conditional
+        run: echo 'check=good' >> $GITHUB_OUTPUT
+        if: env.KEY1 == 'value1'
+      - name: verify if did not skip
+        run: test ${{ steps.conditional.outputs.check }} = good
+
+      - name: logical
+        run: |
+          set -x
+          test "${{ fromJSON('["one","two"]')[0] }}" = "one"
+          test "${{ !false }}" = "true"
+          test "${{ !( 1 > 2 ) }}" = "true"
+          test "${{ 1 >= 1 }}" = "true"
+          test "${{ 1 <= 1 }}" = "true"
+          test "${{ 1 < 2 }}" = "true"
+          test "${{ 1 == 1 }}" = "true"
+          test "${{ 1 != 2 }}" = "true"
+          test "${{ true && true }}" = "true"
+          test "${{ true || false }}" = "true"
+
+      - name: literals
+        run: |
+          set -x
+          test "${{ 0.9 }}" = "0.9"
+          test "${{ env.NULL == null }}" = "true"
+          test "${{ true == true }}" = "true"
+          test "${{ true == false }}" = "false"
+          test "${{ 'something' }}" = "something"
+          test "${{ 'inside''quote' }}" = "inside'quote"
+          test "${{ 'something' == 'SOMETHING' }}" = "true"
+
+      - name: contains
+        run: |
+          set -x
+          test "${{ contains('number 0.9', 0.9) }}" = "true"
+          test "${{ contains('zeroonetwo', 'one') }}" = "true"
+          test "${{ contains('zeroonetwo', 'notfound') }}" = "false"
+          test "${{ contains(fromJSON('["one","two"]'), 'one') }}" = "true"
+          test "${{ contains(fromJSON('["one","two"]'), 'notfound') }}" = "false"
+
+      - name: startsWith
+        run: |
+          set -x
+          test "${{ startsWith('0.9 number', 0.9) }}" = "true"
+          test "${{ startsWith('some number', 'SOME') }}" = "true"
+          test "${{ startsWith('number', '0.9') }}" = "false"
+
+      - name: endsWith
+        run: |
+          set -x
+          test "${{ endsWith('number 0.9', 0.9) }}" = "true"
+          test "${{ endsWith('number some', 'SOME') }}" = "true"
+          test "${{ endsWith('number', '0.9') }}" = "false"
+
+      - name: format
+        run: |
+          set -x
+          test "${{ format('{0} and {1}', 'A', 'B') }}" = "A and B"
+          test "${{ format('{{ and }}', 'A', 'B') }}" = "{ and }"
+
+      - name: join
+        run: |
+          set -x
+          test "${{ join(fromJSON('["one","two"]')) }}" = "one,two"
+          test "${{ join(fromJSON('["one","two"]'), '+') }}" = "one+two"
+
+      - name: toJSON
+        run: |
+          set -x
+          test "${{ toJSON(0.9) }}" = "0.9"
+
+      - name: fromJSON
+        run: |
+          set -x
+          test "${{ fromJSON('["one","two"]')[0] }}" = 'one'
+
+      - name: hashFiles
+        run: |
+          set -x
+          hash="bd52020371c038c4ad38a8d2df05dfa1a220d40fbe1ae83b63d6010cb527e531"
+          test "${{ hashFiles('actions/example-expression/.forgejo/fileone.txt') }}" = $hash
+          test "${{ hashFiles('actions/example-expression/.forgejo/fileone.*') }}" = $hash
diff --git a/actions/example-if-cancel/.forgejo/workflows/test.yml b/actions/example-if-cancel/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..5a92198
--- /dev/null
+++ b/actions/example-if-cancel/.forgejo/workflows/test.yml
@@ -0,0 +1,17 @@
+#
+# As of Forgejo v1.20 running this example would require using the web
+# endpoints because there is no API to do the same.
+#
+# It was manually tested to **not work** with Forgejo v1.21 & runner 3.0.1
+#
+on: [push]
+
+jobs:
+  test:
+    runs-on: docker
+    steps:
+
+      - run: sleep infinity
+
+      - if: cancelled()
+        run: echo IF TEST CANCELLED
diff --git a/actions/example-if-fail/.forgejo/workflows/test.yml b/actions/example-if-fail/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..7720b00
--- /dev/null
+++ b/actions/example-if-fail/.forgejo/workflows/test.yml
@@ -0,0 +1,30 @@
+on: [push]
+
+jobs:
+  test:
+    runs-on: docker
+    steps:
+
+      - run: false
+      - if: failure()
+        run: echo IF TEST FAILURE
+      - if: always()
+        run: echo IF TEST ALWAYS
+
+  #
+  # This is documented in GitHub Actions and does not work in Forgejo Actions
+  # as of 3.0.1.
+  #
+  # If you have a chain of dependent jobs, failure() returns true if any ancestor job fails.
+  #
+  # first:
+  #   runs-on: docker
+  #   steps:
+  #     - run: false
+
+  # second:
+  #   runs-on: docker
+  #   needs: [first]
+  #   steps:
+  #     - if: failure()
+  #       run: echo IF TEST FAIL DEPENDS
diff --git a/actions/example-if-fail/run.sh b/actions/example-if-fail/run.sh
new file mode 100755
index 0000000..75d16ea
--- /dev/null
+++ b/actions/example-if-fail/run.sh
@@ -0,0 +1,4 @@
+! forgejo-test-helper.sh run_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+grep --quiet 'IF TEST FAILURE' $FORGEJO_RUNNER_LOGS
+grep --quiet 'IF TEST ALWAYS' $FORGEJO_RUNNER_LOGS
diff --git a/actions/example-if/.forgejo/workflows/test.yml b/actions/example-if/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..cc9401c
--- /dev/null
+++ b/actions/example-if/.forgejo/workflows/test.yml
@@ -0,0 +1,17 @@
+on: [push]
+
+jobs:
+  basic:
+    runs-on: docker
+    steps:
+
+      - name: if true
+        if: true
+        id: if_true
+        run: echo 'check=good' >> $GITHUB_OUTPUT
+      - name: verify if true was run
+        run: test ${{ steps.if_true.outputs.check }} = good
+
+      - name: if false
+        if: false
+        run: false
diff --git a/actions/example-local-action/.forgejo/local-action/action.yml b/actions/example-local-action/.forgejo/local-action/action.yml
new file mode 100644
index 0000000..d83d33c
--- /dev/null
+++ b/actions/example-local-action/.forgejo/local-action/action.yml
@@ -0,0 +1,16 @@
+inputs:
+  input-one:
+    default: 'one'
+    description: 'description one'
+  input-two-required:
+    description: 'description two'
+    required: true
+outputs:
+  key:
+    description: 'output value'
+    value: "${{ steps.one.outputs.key }}"
+
+runs:
+  using: "composite"
+  steps:
+    - run: echo key=${{ inputs.input-two-required }} >> $GITHUB_OUTPUT
diff --git a/actions/example-local-action/.forgejo/workflows/test.yml b/actions/example-local-action/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..2e9e8c5
--- /dev/null
+++ b/actions/example-local-action/.forgejo/workflows/test.yml
@@ -0,0 +1,11 @@
+on: [push]
+jobs:
+  ls:
+    runs-on: docker
+    steps:
+      - uses: actions/checkout@v3
+      - id: local-action
+        uses: ./.forgejo/local-action
+        with:
+          input-two-required: "two"
+      - run: test "${{ steps.local-action.outputs.key }}" = "two"
diff --git a/actions/example-pull-request/.forgejo/workflows/test.yml b/actions/example-pull-request/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..a05f961
--- /dev/null
+++ b/actions/example-pull-request/.forgejo/workflows/test.yml
@@ -0,0 +1,123 @@
+on:
+  pull_request:
+  pull_request_target:
+    types:
+      - opened
+      - synchronize
+
+jobs:
+  test:
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/debian:bookworm
+      options: "--volume /srv/example-pull-request:/srv/example-pull-request"
+
+    steps:
+      - name: setup
+        shell: bash
+        run: |
+          set -x
+          test $GITHUB_TOKEN = ${{ env.GITHUB_TOKEN }}
+          test $GITHUB_TOKEN = ${{ github.token }}
+          export DEBIAN_FRONTEND=noninteractive ; apt-get -qq update ; apt-get install -y -qq curl git >& /dev/null
+          curl -sS -o /usr/local/bin/forgejo-curl.sh https://code.forgejo.org/forgejo/forgejo-curl/raw/branch/main/forgejo-curl.sh && chmod +x /usr/local/bin/forgejo-curl.sh
+          forgejo-curl.sh --token "$GITHUB_TOKEN" login $GITHUB_SERVER_URL
+          forgejo-curl.sh api_json $GITHUB_SERVER_URL/api/v1/user
+
+      - name: secrets
+        shell: bash
+        run: |
+          set -x
+          if test ${{ github.event.pull_request.base.repo.full_name }} = ${{ github.event.pull_request.head.repo.full_name }} ; then
+            forked=false
+          else
+            forked=true
+          fi
+          case $GITHUB_EVENT_NAME in
+            pull_request_target)
+              #
+              # all PRs: secrets
+              #
+              test "${{ secrets.SECRET }}"
+              ;;
+            pull_request)
+              if $forked ; then
+                #
+                # PRs from forked repositories: no secrets
+                #
+                test -z "${{ secrets.SECRET }}"
+              else
+                #
+                # PRs from the same repository: secrets
+                #
+                test "${{ secrets.SECRET }}"
+              fi
+              ;;
+            *)
+              echo unexpected event $GITHUB_EVENT_NAME
+              false
+              ;;
+          esac
+
+      - name: PR TOKEN scopes
+        shell: bash
+        run: |
+          set -x
+          if test ${{ github.event.pull_request.base.repo.full_name }} = ${{ github.event.pull_request.head.repo.full_name }} ; then
+            forked=false
+          else
+            forked=true
+          fi
+          function assert_fail_if_forked() {
+            if "$@" ; then
+               ! $forked
+            else
+               $forked
+            fi
+          }
+          #
+          # create an issue
+          #
+          base_repo=${{ github.event.pull_request.base.repo.full_name }}
+          forgejo-curl.sh api_json --data-raw '{"title":"ISSUE"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/issues
+          url=$(echo $GITHUB_SERVER_URL | sed -e "s|://|://$GITHUB_TOKEN@|")
+          git clone $url/$base_repo base
+          branch=B$RANDOM
+          (
+            cd base
+            git checkout -b $branch
+            git config user.email root@example.com
+            git config user.name username
+            echo CHANGE >> README
+            git add .
+            git commit -m 'change'
+            case $GITHUB_EVENT_NAME in
+              pull_request_target|pull_request)
+                #
+                # repository write scope via http git passthrough
+                #
+                assert_fail_if_forked git push --force -u origin $branch
+                #
+                # repository write scope via the API
+                #
+                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"title":"PR","base":"main","head":"'$branch'"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/pulls
+                assert_fail_if_forked forgejo-curl.sh api_json --data-raw '{"color":"#ffffff","name":"labelname"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/labels
+                #
+                # See https://codeberg.org/forgejo/forgejo/issues/1525
+                #
+                ! forgejo-curl.sh api_json --data-raw '{"new_branch_name":"B'$RANDOM'"}' $GITHUB_SERVER_URL/api/v1/repos/$base_repo/branches
+                ;;
+              *)
+                echo unexpected event $GITHUB_EVENT_NAME
+                false
+                ;;
+            esac
+          )
+
+      - name: save event
+        run: |
+          d=/srv/example-pull-request/${{ github.event.pull_request.head.repo.owner.username }}/$GITHUB_EVENT_NAME/${{ github.event.action }}
+          mkdir -p $d
+          cat > $d/event <<EOF
+          ${{ toJSON(github.event) }}
+          EOF
diff --git a/actions/example-pull-request/assert-token.sh b/actions/example-pull-request/assert-token.sh
new file mode 100755
index 0000000..daa47d3
--- /dev/null
+++ b/actions/example-pull-request/assert-token.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+
+set -ex
+
+test -d $d/fork-org/pull_request/opened
+test -d $d/fork-org/pull_request_target/opened
+test -d $d/root/pull_request/opened
+test -d $d/root/pull_request_target/opened
diff --git a/actions/example-pull-request/run.sh b/actions/example-pull-request/run.sh
new file mode 100755
index 0000000..78bbf22
--- /dev/null
+++ b/actions/example-pull-request/run.sh
@@ -0,0 +1,57 @@
+api=$url/api/v1
+export d=/srv/example-pull-request
+
+PROOF='some proof'
+
+function setup() {
+    forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+
+    forgejo-curl.sh api_json --data-raw '{"username":"fork-org"}' $api/orgs
+    forgejo-curl.sh api_json --data-raw '{"organization":"fork-org"}' $api/repos/root/example-pull-request/forks
+    forgejo-curl.sh api_json -X PUT --data-raw '{"data":"AAAA"}' $api/repos/root/example-pull-request/actions/secrets/SECRET
+
+
+    (
+	cd $d
+	git clone $url/fork-org/example-pull-request fork
+	cd fork
+	git config user.email root@example.com
+	git config user.name username
+	echo fork $PROOF >> README
+	git add .
+	git commit -m 'fork change'
+	git push
+    )
+
+    forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR from fork","base":"main","head":"fork-org:main"}' $api/repos/root/example-pull-request/pulls
+
+    (
+	cd $d
+	git clone $url/root/example-pull-request
+	cd example-pull-request
+	git checkout -b other
+	git config user.email root@example.com
+	git config user.name username
+	echo other $PROOF >> README
+	git add .
+	git commit -m 'other change'
+	git push --force -u origin other
+    )
+
+    forgejo.sh retry forgejo-curl.sh api_json --data-raw '{"title":"PR same repo","base":"main","head":"other"}' $api/repos/root/example-pull-request/pulls
+
+    export RETRY_DELAYS="60 60 60 60 60 60 60"
+    for assert in $EXAMPLE_DIR/assert-*.sh ; do
+	if ! forgejo.sh retry $assert ; then
+	    find $d
+	    cat $FORGEJO_RUNNER_LOGS
+	    false
+	fi
+    done
+}
+
+function main() {
+    setup
+}
+
+main
diff --git a/actions/example-pull-request/runner-config.yaml b/actions/example-pull-request/runner-config.yaml
new file mode 100644
index 0000000..e9f4aeb
--- /dev/null
+++ b/actions/example-pull-request/runner-config.yaml
@@ -0,0 +1,30 @@
+
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:16-bullseye"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: "bridge"
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example-pull-request"]
+  docker_host: ""
+
+host:
+  workdir_parent:
diff --git a/actions/example-pull-request/setup.sh b/actions/example-pull-request/setup.sh
new file mode 100755
index 0000000..f2c4556
--- /dev/null
+++ b/actions/example-pull-request/setup.sh
@@ -0,0 +1,2 @@
+mkdir -p /srv/example-pull-request
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload
diff --git a/actions/example-pull-request/teardown.sh b/actions/example-pull-request/teardown.sh
new file mode 100755
index 0000000..b410c51
--- /dev/null
+++ b/actions/example-pull-request/teardown.sh
@@ -0,0 +1 @@
+forgejo-runner.sh reload
diff --git a/actions/example-push-cancel/.forgejo/workflows/test.yml b/actions/example-push-cancel/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..556f5e8
--- /dev/null
+++ b/actions/example-push-cancel/.forgejo/workflows/test.yml
@@ -0,0 +1,6 @@
+on: [push]
+jobs:
+  test:
+    runs-on: docker
+    steps:
+      - run: sleep infinity
diff --git a/actions/example-push-cancel/run.sh b/actions/example-push-cancel/run.sh
new file mode 100755
index 0000000..37ed9d3
--- /dev/null
+++ b/actions/example-push-cancel/run.sh
@@ -0,0 +1,18 @@
+repo=root/example-$example
+#
+# push the repository
+#
+forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+sha=$(forgejo-test-helper.sh branch_tip $url $repo main)
+#
+# wait for the workflow (sleep infinity) to start running
+#
+forgejo-test-helper.sh wait_running $url $repo $sha
+#
+# push to the same branch
+#
+forgejo-test-helper.sh push_workflow actions/example-$example $url root example-$example setup-forgejo $token
+#
+# wait for the workflow to be canceld as a result of the previous push
+#
+forgejo-test-helper.sh wait_failure $url $repo $sha 'Has been cancelled'
diff --git a/actions/example-push-cancel/teardown.sh b/actions/example-push-cancel/teardown.sh
new file mode 100644
index 0000000..ae9987a
--- /dev/null
+++ b/actions/example-push-cancel/teardown.sh
@@ -0,0 +1,4 @@
+#
+# this will effectively discard any linger workflow so they do not interfere with other tests
+#
+forgejo-runner.sh reload
diff --git a/actions/example-service/.forgejo/workflows/test.yml b/actions/example-service/.forgejo/workflows/test.yml
new file mode 100644
index 0000000..438203c
--- /dev/null
+++ b/actions/example-service/.forgejo/workflows/test.yml
@@ -0,0 +1,59 @@
+on: [push]
+
+jobs:
+  #
+  # No volume involved
+  #
+  simple:
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/debian:bookworm
+
+    services:
+      pgsql:
+        image: code.forgejo.org/oci/postgres:15
+        env:
+          POSTGRES_DB: test
+          POSTGRES_PASSWORD: postgres
+    steps:
+    - run: |
+       apt-get update -qq
+       apt-get install -y -qq  postgresql-client
+       PGPASSWORD=postgres psql -h pgsql -U postgres -c '\dt' test
+  #
+  # A --volume option will expose the volume from the docker host to the job
+  #
+  volume-on-step:
+    needs: [simple]
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/debian:bookworm
+      options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid --volume /srv/example-service-volume-invalid:/srv/example-service-volume-invalid"
+
+    steps:
+    - run: |
+       test -f /srv/example-service-volume-valid
+       ! test -f /srv/example-service-volume-invalid
+
+  #
+  # A --volume option will expose the volume from the docker host to the service
+  #
+  volume-on-service:
+    needs: [volume-on-step]
+    runs-on: docker
+    container:
+      image: code.forgejo.org/oci/debian:bookworm
+      options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid"
+
+    services:
+      myservice:
+        image: code.forgejo.org/oci/debian:bookworm
+        options: "--volume /srv/example-service-volume-valid:/srv/example-service-volume-valid"
+        cmd: ["bash", "-c", "echo -n SUCCESS > /srv/example-service-volume-valid ; sleep infinity"]
+
+    steps:
+    - run: |
+        set -x
+        f=/srv/example-service-volume-valid
+        test -f $f
+        test $(cat $f) = SUCCESS
diff --git a/actions/example-service/runner-config.yaml b/actions/example-service/runner-config.yaml
new file mode 100644
index 0000000..4606852
--- /dev/null
+++ b/actions/example-service/runner-config.yaml
@@ -0,0 +1,30 @@
+
+log:
+  level: info
+
+runner:
+  file: .runner
+  capacity: 1
+  env_file: .env
+  timeout: 3h
+  insecure: false
+  fetch_timeout: 5s
+  fetch_interval: 2s
+  labels: ["docker:docker://code.forgejo.org/oci/node:16-bullseye"]
+
+cache:
+  enabled: false
+  dir: ""
+  host: ""
+  port: 0
+
+container:
+  network: ""
+  privileged: false
+  options:
+  workdir_parent:
+  valid_volumes: ["/srv/example-service-volume-valid"]
+  docker_host: ""
+
+host:
+  workdir_parent:
diff --git a/actions/example-service/setup.sh b/actions/example-service/setup.sh
new file mode 100755
index 0000000..3a9674e
--- /dev/null
+++ b/actions/example-service/setup.sh
@@ -0,0 +1,3 @@
+> /srv/example-service-volume-valid
+> /srv/example-service-volume-invalid
+FORGEJO_RUNNER_CONFIG=$EXAMPLE_DIR/runner-config.yaml forgejo-runner.sh reload
diff --git a/actions/example-service/teardown.sh b/actions/example-service/teardown.sh
new file mode 100755
index 0000000..b410c51
--- /dev/null
+++ b/actions/example-service/teardown.sh
@@ -0,0 +1 @@
+forgejo-runner.sh reload