[CI] Forgejo Actions based release process (squash) refactor (#2053)

Refs: https://codeberg.org/forgejo/forgejo/issues/2051
Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/2053
Reviewed-by: Loïc Dachary <dachary@noreply.codeberg.org>
Co-authored-by: Earl Warren <contact@earl-warren.org>
Co-committed-by: Earl Warren <contact@earl-warren.org>
(cherry picked from commit 01abf4d505)

[CI] Forgejo Actions based release process (squash) no ownca

The private Forgejo instance trusted with the release signing keys no
longer requires the installation of the ownca certificate authority.

Refs: https://codeberg.org/forgejo/docs/pulls/338
(cherry picked from commit 72f9ae796d)
(cherry picked from commit b0ca4236d7)
(cherry picked from commit 81619cf8b5)
(cherry picked from commit 2cb32c1a2b)
(cherry picked from commit f817d97f85)
(cherry picked from commit 7499661326)

.forgejo/workflows/build-release-integration.yml

@@ -7,14 +7,13 @@ on:
       - Dockerfile
       - Dockerfile.rootless
       - docker/**
-      - .forgejo/actions/build-release/action.yml
       - .forgejo/workflows/build-release.yml
       - .forgejo/workflows/build-release-integration.yml
 
 jobs:
   release-simulation:
+    if: ${{ !startsWith(vars.ROLE, 'forgejo-') }}
     runs-on: self-hosted
-    if: secrets.ROLE != 'forgejo-integration' && secrets.ROLE != 'forgejo-experimental' && secrets.ROLE != 'forgejo-release'
     steps:
       - uses: actions/checkout@v3
 
@@ -23,7 +22,7 @@ jobs:
         with:
           user: root
           password: admin1234
-          image-version: 1.19
+          image-version: 1.21
           lxc-ip-prefix: 10.0.9
 
       - name: publish the forgejo release
@@ -52,7 +51,6 @@ jobs:
           cp -a .forgejo/testdata/build-release/* $dir
           mkdir -p $dir/.forgejo/workflows
           cp .forgejo/workflows/build-release.yml $dir/.forgejo/workflows
-          cp -a .forgejo/actions $dir/.forgejo/actions
           cp $dir/Dockerfile $dir/Dockerfile.rootless
 
           forgejo-test-helper.sh push $dir $url root forgejo
@@ -62,6 +60,8 @@ jobs:
           # Push a tag to trigger the release workflow and wait for it to complete
           #
           forgejo-curl.sh api_json --data-raw '{"tag_name": "v'$version'", "target": "'$sha'"}' $url/api/v1/repos/root/forgejo/tags
+          forgejo-curl.sh api_json -X PUT --data-raw '{"data":"${{ steps.forgejo.outputs.token }}"}' $url/api/v1/repos/root/forgejo/actions/secrets/TOKEN
+          forgejo-curl.sh api_json -X PUT --data-raw '{"data":"root"}' $url/api/v1/repos/root/forgejo/actions/secrets/DOER
           LOOPS=180 forgejo-test-helper.sh wait_success "$url" root/forgejo $sha
 
           #