Without BUNNY_STORAGE_PASSWORD, the action now requests the running
workflow's OIDC identity token (Forgejo with enable-openid-connect,
GitHub with id-token: write) for the gateway's audience and starts the
deployment with it. It takes the Storage Zone password from the
gateway's answer, masks it in the log, plans and uploads with it, and
finalizes or aborts with a fresh token. A dry run in this mode stays
local. Password deployments work as before.
action.yml finds its script under FORGEJO_ACTION_PATH or
GITHUB_ACTION_PATH, so the action also runs on GitHub Actions.
Project sites can pass a TOML file of edge rules (redirects, status
codes, blocking, response headers, cache times) to the deploy action.
The gateway validates them when a deployment starts and reconciles its
own rules on the site's Pull Zones when it finalizes, deleting dropped
rules and purging when a rule changed. Actions that could reach beyond
the site, such as origin changes, are not available.
The purge retry is limited to recorded purge failures, so a deployment
whose rules failed to apply cannot be completed by a purge alone.
