diff --git a/.forgejo/workflows/act.yml b/.forgejo/workflows/act.yml
deleted file mode 100644
index 1a1b149b..00000000
--- a/.forgejo/workflows/act.yml
+++ /dev/null
@@ -1,80 +0,0 @@
-name: act
-on:
-  push:
-    branches:
-      - 'main'
-  pull_request:
-
-env:
-  GOPROXY: https://goproxy.io,direct
-  GOPATH: /go_path
-  GOCACHE: /go_cache
-
-jobs:
-  unit:
-    runs-on: docker
-    if: vars.ROLE == 'forgejo-coding'
-    container:
-      image: 'code.forgejo.org/oci/node:22-bookworm'
-    steps:
-      - name: cache go path
-        id: cache-go-path
-        uses: https://code.forgejo.org/actions/cache@v4
-        with:
-          path: /go_path
-          key: go_path-${{ forge.repository }}-${{ forge.ref_name }}
-          restore-keys: |
-            go_path-${{ forge.repository }}-
-            go_path-
-      - name: cache go cache
-        id: cache-go-cache
-        uses: https://code.forgejo.org/actions/cache@v4
-        with:
-          path: /go_cache
-          key: go_cache-${{ forge.repository }}-${{ forge.ref_name }}
-          restore-keys: |
-            go_cache-${{ forge.repository }}-
-            go_cache-
-
-      - uses: https://code.forgejo.org/actions/checkout@v4
-
-      - uses: https://code.forgejo.org/actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: validate go version
-        run: |
-          set -ex
-          toolchain=$(grep -oP '(?<=toolchain ).+' go.mod)
-          version=$(go version | cut -d' ' -f3)
-          if dpkg --compare-versions ${version#go} lt ${toolchain#go}; then
-            echo "go version too low: $toolchain >= $version"
-            exit 1
-          fi
-
-      - name: unit test
-        run: |
-          go test -short ./act/container
-          go test ./act/artifactcache/... ./act/workflowpattern/... ./act/filecollector/... ./act/common/... ./act/jobparser ./act/model ./act/exprparser ./act/schema
-
-  integration:
-    runs-on: lxc-bookworm
-    if: vars.ROLE == 'forgejo-coding'
-    needs: [unit]
-    steps:
-      - uses: https://code.forgejo.org/actions/checkout@v4
-
-      - uses: https://code.forgejo.org/actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: apt install docker.io
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          apt-get update -qq
-          apt-get -q install -qq -y docker.io
-
-      - name: integration test
-        run: |
-          go test ./act/container
-          go test -timeout 30m ./act/runner/...
diff --git a/.forgejo/workflows/build-release-integration.yml b/.forgejo/workflows/build-release-integration.yml
deleted file mode 100644
index 762cb222..00000000
--- a/.forgejo/workflows/build-release-integration.yml
+++ /dev/null
@@ -1,94 +0,0 @@
-name: Integration tests for the release process
-
-on:
-  push:
-    paths:
-      - go.mod
-      - Dockerfile
-      - .forgejo/workflows/build-release.yml
-      - .forgejo/workflows/build-release-integration.yml
-    branches-ignore:
-      - renovate/** # they are build via PR
-  pull_request:
-    paths:
-      - go.mod
-      - Dockerfile
-      - .forgejo/workflows/build-release.yml
-      - .forgejo/workflows/build-release-integration.yml
-
-enable-email-notifications: true
-
-jobs:
-  release-simulation:
-    runs-on: lxc-bookworm
-    if: vars.ROLE == 'forgejo-coding'
-    steps:
-      - uses: actions/checkout@v4
-
-      - id: forgejo
-        uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2
-        with:
-          user: root
-          password: admin1234
-          image-version: 1.20
-          lxc-ip-prefix: 10.0.9
-
-      - name: publish
-        run: |
-          set -x
-
-          version=1.2.3
-          cat > /etc/docker/daemon.json <<EOF
-            {
-              "insecure-registries" : ["${{ steps.forgejo.outputs.host-port }}"]
-            }
-          EOF
-          systemctl restart docker
-
-          dir=$(mktemp -d)
-          trap "rm -fr $dir" EXIT
-
-          url=http://root:admin1234@${{ steps.forgejo.outputs.host-port }}
-          export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"
-
-          #
-          # Create a new project with the runner and the release workflow only
-          #
-          rsync -a --exclude .git ./ $dir/
-          rm $(find $dir/.forgejo/workflows/*.yml | grep -v build-release.yml)
-          forgejo-test-helper.sh push $dir $url root runner
-          sha=$(forgejo-test-helper.sh branch_tip $url root/runner main)
-
-          #
-          # Push a tag to trigger the release workflow and wait for it to complete
-          #
-          forgejo-curl.sh api_json --data-raw '{"tag_name": "v'$version'", "target": "'$sha'"}' $url/api/v1/repos/root/runner/tags
-          LOOPS=180 forgejo-test-helper.sh wait_success "$url" root/runner $sha
-
-          #
-          # uncomment to see the logs even when everything is reported to be working ok
-          #
-          #cat $FORGEJO_RUNNER_LOGS
-
-          #
-          # Minimal sanity checks. e2e test is for the setup-forgejo action
-          #
-          for arch in amd64 arm64 ; do
-            binary=forgejo-runner-$version-linux-$arch
-            for suffix in '' '.xz' ; do
-              curl --fail -L -sS $url/root/runner/releases/download/v$version/$binary$suffix > $binary$suffix
-              if test "$suffix" = .xz ; then
-                 unxz --keep $binary$suffix
-              fi
-              chmod +x $binary
-              ./$binary --version | grep $version
-              curl --fail -L -sS $url/root/runner/releases/download/v$version/$binary$suffix.sha256 > $binary$suffix.sha256
-              shasum -a 256 --check $binary$suffix.sha256
-              rm $binary$suffix
-            done
-          done
-
-          docker pull ${{ steps.forgejo.outputs.host-port }}/root/runner:$version
-
-          docker inspect ${{ steps.forgejo.outputs.host-port}}/root/runner:$version > labels.json
-          python3 .forgejo/labelscompare.py
diff --git a/.forgejo/workflows/build-release.yml b/.forgejo/workflows/build-release.yml
deleted file mode 100644
index 6bb6c4b4..00000000
--- a/.forgejo/workflows/build-release.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-# SPDX-License-Identifier: MIT
-#
-# https://code.forgejo.org/forgejo/runner
-#
-#  Build the runner binaries and OCI images
-#
-#  ROLE: forgejo-integration
-#  DOER: forgejo-ci
-#  TOKEN: <generated from https://code.forgejo.org/forgejo-ci>
-#
-name: Build release
-
-on:
-  push:
-    tags:
-    - 'v*'
-
-enable-email-notifications: true
-
-jobs:
-  release:
-    runs-on: lxc-bookworm
-    # root is used for testing, allow it
-    if: vars.ROLE == 'forgejo-integration' || forge.repository_owner == 'root'
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Increase the verbosity when there are no secrets
-        id: verbose
-        run: |
-          if test -z "${{ secrets.TOKEN }}"; then
-            value=true
-          else
-            value=false
-          fi
-          echo "value=$value" >> "$FORGEJO_OUTPUT"
-
-      - name: Sanitize the name of the repository
-        id: repository
-        run: |
-          echo "value=${FORGEJO_REPOSITORY##*/}" >> "$FORGEJO_OUTPUT"
-
-      - name: create test TOKEN
-        id: token
-        if: ${{ secrets.TOKEN == '' }}
-        run: |
-          apt-get -qq install -y jq
-          url="${{ env.FORGEJO_SERVER_URL }}"
-          hostport=${url##http*://}
-          hostport=${hostport%%/}
-          doer=root
-          api=http://$doer:admin1234@$hostport/api/v1/users/$doer/tokens
-          curl -sS -X DELETE $api/release
-          token=$(curl -sS -X POST -H 'Content-Type: application/json' --data-raw '{"name": "release", "scopes": ["all"]}' $api | jq --raw-output .sha1)
-          echo "value=${token}" >> "$FORGEJO_OUTPUT"
-
-      - name: version from ref_name
-        id: tag-version
-        run: |
-          version=${FORGEJO_REF_NAME##*v}
-          echo "value=$version" >> "$FORGEJO_OUTPUT"
-
-      - name: build without TOKEN
-        if: ${{ secrets.TOKEN == '' }}
-        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.4.1
-        with:
-          forgejo: "${{ env.FORGEJO_SERVER_URL }}"
-          owner: "${{ env.FORGEJO_REPOSITORY_OWNER }}"
-          repository: "${{ steps.repository.outputs.value }}"
-          doer: root
-          sha: "${{ forge.sha }}"
-          release-version: "${{ steps.tag-version.outputs.value }}"
-          token: ${{ steps.token.outputs.value }}
-          platforms: linux/amd64,linux/arm64
-          binary-name: forgejo-runner
-          binary-path: /bin/forgejo-runner
-          verbose: ${{ steps.verbose.outputs.value }}
-
-      - name: build with TOKEN
-        if: ${{ secrets.TOKEN != '' }}
-        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/build@v5.4.1
-        with:
-          forgejo: "${{ env.FORGEJO_SERVER_URL }}"
-          owner: "${{ env.FORGEJO_REPOSITORY_OWNER }}"
-          repository: "${{ steps.repository.outputs.value }}"
-          doer: "${{ secrets.DOER }}"
-          sha: "${{ forge.sha }}"
-          release-version: "${{ steps.tag-version.outputs.value }}"
-          token: "${{ secrets.TOKEN }}"
-          platforms: linux/amd64,linux/arm64
-          binary-name: forgejo-runner
-          binary-path: /bin/forgejo-runner
-          verbose: ${{ steps.verbose.outputs.value }}
diff --git a/.forgejo/workflows/cascade-setup-forgejo.yml b/.forgejo/workflows/cascade-setup-forgejo.yml
deleted file mode 100644
index bd3684ba..00000000
--- a/.forgejo/workflows/cascade-setup-forgejo.yml
+++ /dev/null
@@ -1,31 +0,0 @@
-# SPDX-License-Identifier: MIT
-on:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
-      - closed
-
-enable-email-notifications: true
-
-jobs:
-  cascade:
-    runs-on: docker
-    container:
-      image: 'code.forgejo.org/oci/node:22-bookworm'
-    if: >
-      ! contains(forge.event.pull_request.title, '[skip cascade]')
-    steps:
-      - uses: https://code.forgejo.org/actions/cascading-pr@v2.2.1
-        with:
-          origin-url: ${{ env.FORGEJO_SERVER_URL }}
-          origin-repo: forgejo/runner
-          origin-token: ${{ secrets.CASCADING_PR_ORIGIN }}
-          origin-pr: ${{ forge.event.pull_request.number }}
-          destination-url: ${{ env.FORGEJO_SERVER_URL }}
-          destination-repo: actions/setup-forgejo
-          destination-fork-repo: cascading-pr/setup-forgejo
-          destination-branch: main
-          destination-token: ${{ secrets.CASCADING_PR_DESTINATION }}
-          close-merge: true
-          update: .forgejo/cascading-pr-setup-forgejo
diff --git a/.forgejo/workflows/docker-build-push-action-in-lxc.yml b/.forgejo/workflows/docker-build-push-action-in-lxc.yml
deleted file mode 100644
index dcfb7d88..00000000
--- a/.forgejo/workflows/docker-build-push-action-in-lxc.yml
+++ /dev/null
@@ -1,85 +0,0 @@
-#
-# Example that requires a Forgejo runner with an [LXC backend](https://forgejo.org/docs/latest/admin/actions/runner-installation/#setting-up-the-container-environment).
-#
-# - Start a Forgejo instance to be used as a container registry
-# - Build a container image using the [docker/build-push-action](https://code.forgejo.org/docker/build-push-action) action
-# - Push the image to the Forgejo instance
-# - Retrieve the image
-#
-# Runs of this workflow can be seen in [the Forgejo runner](https://code.forgejo.org/forgejo/runner/actions?workflow=docker-build-push-action-in-lxc.yml) logs.
-#
-name: example
-on:
-  push:
-    branches:
-      - 'main'
-  pull_request:
-    paths:
-      - examples/docker-build-push-action/**
-      - .forgejo/workflows/docker-build-push-action-in-lxc.yml
-
-enable-email-notifications: true
-
-env:
-  FORGEJO_VERSION: 11.0.3 # renovate: datasource=docker depName=code.forgejo.org/forgejo/forgejo
-  FORGEJO_USER: root
-  FORGEJO_PASSWORD: admin1234
-
-jobs:
-  docker-build-push-action-in-lxc:
-    if: vars.ROLE == 'forgejo-coding'
-    runs-on: lxc-bookworm
-
-    steps:
-
-      - name: install Forgejo so it can be used as a container registry
-        id: registry
-        uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2
-        with:
-          user: ${{ env.FORGEJO_USER }}
-          password: ${{ env.FORGEJO_PASSWORD }}
-          binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v${{ env.FORGEJO_VERSION }}/forgejo-${{ env.FORGEJO_VERSION }}-linux-amd64
-          lxc-ip-prefix: 10.0.9
-
-      - name: enable insecure / http uploads to the Forgejo registry
-        run: |-
-          set -x
-          # the docker daemon was implicitly installed when Forgejo was
-          # installed in the previous step. But it will refuse to connect
-          # to an insecure / http registry by default and must be told
-          # otherwise
-          cat > /etc/docker/daemon.json <<EOF
-            {
-              "insecure-registries" : ["${{ steps.registry.outputs.host-port }}"]
-            }
-          EOF
-          systemctl restart docker
-
-      - uses: https://data.forgejo.org/docker/setup-qemu-action@v3
-      - uses: https://data.forgejo.org/docker/setup-buildx-action@v2
-        with:
-          # insecure / http connections to the registry are allowed
-          config-inline: |
-            [registry."${{ steps.registry.outputs.host-port }}"]
-              http = true
-
-      - name: login to the Forgejo registry
-        uses: https://data.forgejo.org/docker/login-action@v3
-        with:
-          registry: ${{ steps.registry.outputs.host-port }}
-          username: ${{ env.FORGEJO_USER }}
-          password: ${{ env.FORGEJO_PASSWORD }}
-
-      - name: build and push to the Forgejo registry
-        uses: https://data.forgejo.org/docker/build-push-action@v5
-        with:
-          context: examples/docker-build-push-action
-          push: true
-          tags: ${{ steps.registry.outputs.host-port }}/root/testimage:latest
-          cache-from: type=gha,scope=docker-build-push-action-in-lxc
-          cache-to: type=gha,scope=docker-build-push-action-in-lxc
-
-      - name: verify the image can be read from the Forgejo registry
-        run: |
-          set -x
-          docker pull ${{ steps.registry.outputs.host-port }}/root/testimage:latest
diff --git a/.forgejo/workflows/example-docker-compose.yml b/.forgejo/workflows/example-docker-compose.yml
deleted file mode 100644
index dce57a39..00000000
--- a/.forgejo/workflows/example-docker-compose.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-# SPDX-License-Identifier: MIT
-on:
-  push:
-    branches:
-      - 'main'
-  pull_request:
-    paths:
-      - examples/docker-compose/**
-      - .forgejo/workflows/example-docker-compose.yml
-
-enable-email-notifications: true
-
-jobs:
-  example-docker-compose:
-    if: vars.ROLE == 'forgejo-coding'
-    runs-on: lxc-bookworm
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Install docker
-        run: |
-          apt-get update -qq
-          export DEBIAN_FRONTEND=noninteractive
-          apt-get install -qq -y ca-certificates curl gnupg
-          install -m 0755 -d /etc/apt/keyrings
-          curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
-          echo "deb [arch="$(dpkg --print-architecture)" signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian "$(. /etc/os-release && echo "$VERSION_CODENAME")" stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-          apt-get update -qq
-          apt-get install -qq -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-          docker version
-          docker compose version
-
-      - name: run the example
-        run: |
-          set -x
-          cd examples/docker-compose
-          secret=$(openssl rand -hex 20)
-          sed -i -e "s/{SHARED_SECRET}/$secret/" compose-forgejo-and-runner.yml
-          cli="docker compose --progress quiet -f compose-forgejo-and-runner.yml"
-          #
-          # Launch Forgejo & the runner
-          #
-          $cli up -d
-          for delay in $(seq 60) ; do test -f /srv/runner-data/.runner && break ; sleep 30 ; done
-          test -f /srv/runner-data/.runner
-          #
-          # Run the demo workflow
-          #
-          cli="$cli -f compose-demo-workflow.yml"
-          $cli up -d demo-workflow
-          #
-          # Wait for the demo workflow to complete
-          #
-          success='DEMO WORKFLOW SUCCESS'
-          failure='DEMO WORKFLOW FAILURE'
-          for delay in $(seq 60) ; do
-            $cli logs demo-workflow > /tmp/out
-            grep --quiet "$success" /tmp/out && break
-            grep --quiet "$failure" /tmp/out && break
-            $cli ps --all
-            $cli logs --tail=20 runner-daemon demo-workflow
-            sleep 30
-          done
-          grep --quiet "$success" /tmp/out
-          $cli logs runner-daemon > /tmp/runner.log
-          grep --quiet 'Start image=code.forgejo.org/oci/node:20-bookworm' /tmp/runner.log
-
-      - name: full docker compose logs
-        if: always()
-        run: |
-          cd examples/docker-compose
-          docker compose -f compose-forgejo-and-runner.yml -f compose-demo-workflow.yml logs
diff --git a/.forgejo/workflows/example-lxc-systemd.yml b/.forgejo/workflows/example-lxc-systemd.yml
deleted file mode 100644
index 5ebdd1a7..00000000
--- a/.forgejo/workflows/example-lxc-systemd.yml
+++ /dev/null
@@ -1,162 +0,0 @@
-# SPDX-License-Identifier: MIT
-on:
-  push:
-    branches:
-      - 'main'
-  pull_request:
-    paths:
-      - examples/lxc-systemd/**
-      - .forgejo/workflows/example-lxc-systemd.yml
-
-enable-email-notifications: true
-
-env:
-  SERIAL: "30"
-  LIFETIME: "60"
-  SYSTEMD_OPTIONS: "--no-pager --full"
-
-jobs:
-  example-lxc-systemd:
-    if: vars.ROLE == 'forgejo-coding'
-    runs-on: lxc-bookworm
-    steps:
-       - uses: https://data.forgejo.org/actions/checkout@v4
-
-       - name: forgejo-runner-service.sh dependencies
-         # run before setup-forgejo because it installs LXC and
-         # this would do nothing (false positive if a bug sneaks in)
-         run: |
-          set -x
-          cd examples/lxc-systemd
-          VERBOSE=true ./forgejo-runner-service.sh dependencies
-          lxc-ls
-
-       - name: forgejo-runner-service.sh upgrade
-         run: |
-           set -x
-
-           bin=/usr/local/bin
-           scripts="lxc-helpers.sh lxc-helpers-lib.sh forgejo-runner-service.sh"
-
-           # make the existing scripts different, as if originating from a previous release
-           rm -f $bin/*.backup
-           for script in $scripts; do
-              echo '# something' >> $bin/$script
-           done
-
-           cd examples/lxc-systemd
-           VERBOSE=true ./forgejo-runner-service.sh upgrade file://$(pwd)/forgejo-runner-service.sh
-
-           for script in $scripts; do
-              ! grep --quiet something $bin/$script
-              grep --quiet something $bin/$script.backup
-           done
-
-       - id: forgejo
-         uses: https://data.forgejo.org/actions/setup-forgejo@v3.0.2
-         with:
-           user: root
-           password: admin1234
-           binary: https://code.forgejo.org/forgejo/forgejo/releases/download/v7.0.12/forgejo-7.0.12-linux-amd64
-           # must be the same as LXC_IPV4_PREFIX in examples/lxc-systemd/forgejo-runner-service.sh
-           lxc-ip-prefix: 10.105.7
-
-       - name: forgejo-runner-service.sh env
-         run: |
-           set -x
-           # this Forgejo instance needs to be reachable from within the LXC
-           # container created by forgejo-runner-service.sh
-           url=http://root:admin1234@${{ steps.forgejo.outputs.host-port }}
-           docker ps --all
-           export PATH=$(dirname /tmp/*/forgejocli):$PATH
-           token=$(su -c 'forgejocli -- actions generate-runner-token' forgejo)
-           cat > /tmp/env <<EOF
-             export INPUTS_SERIAL=${{ env.SERIAL }}
-             export INPUTS_FORGEJO=$url
-             export INPUTS_TOKEN=$token
-             export INPUTS_LIFETIME=${{ env.LIFETIME }}
-             export VERBOSE=true
-           EOF
-
-       - name: forgejo-runner-service.sh create
-         run: |
-           eval $(cat /tmp/env)
-           set -x
-           ./examples/lxc-systemd/forgejo-runner-service.sh install_runner
-           ./examples/lxc-systemd/forgejo-runner-service.sh lxc_create
-           ./examples/lxc-systemd/forgejo-runner-service.sh inside ensure_configuration_and_registration
-           ./examples/lxc-systemd/forgejo-runner-service.sh service_create
-
-       - name: forgejo-runner-service.sh assert
-         run: |
-           eval $(cat /tmp/env)
-           set -x
-
-           runner=/etc/forgejo-runner/$INPUTS_SERIAL/.runner
-           cat $runner
-           test "$(hostname)-${{ env.SERIAL }}" = $(jq -r .name < $runner)
-
-           config=/etc/forgejo-runner/$INPUTS_SERIAL/config.yml
-           cat $config
-           grep --quiet data.forgejo.org $config
-
-           env=/etc/forgejo-runner/$INPUTS_SERIAL/env
-           cat $env
-           grep --quiet INPUTS_SERIAL=$INPUTS_SERIAL $env
-           echo VERBOSE=true >> $env
-
-           service=/etc/systemd/system/forgejo-runner@.service
-           cat $service
-
-           cache=/var/lib/forgejo-runner/runner-$INPUTS_SERIAL-lxc/.cache/actcache
-           touch $cache/something
-           lxc-attach runner-$INPUTS_SERIAL-lxc -- test -f $cache/something
-
-       - name: forgejo-runner-service.sh start / stop
-         run: |
-           set -x
-           serial=${{ env.SERIAL }}
-           all="${{ env.SYSTEMD_OPTIONS }}"
-
-           systemctl start forgejo-runner@$serial
-           systemctl $all status forgejo-runner@$serial
-           started_running=/etc/forgejo-runner/$serial/started-running
-           killed_gracefully=/etc/forgejo-runner/$serial/killed-gracefully
-           stopped_gracefully=/etc/forgejo-runner/$serial/stopped-gracefully
-           retry --delay 5 --times 20 cp -a $started_running /tmp/first-run
-           retry --delay 1 --times 30 grep --quiet 'Starting runner daemon' /var/log/forgejo-runner/$serial.log
-           systemctl stop forgejo-runner@$serial
-           ! systemctl $all status forgejo-runner@$serial
-           ls -l /etc/forgejo-runner/$serial
-           test -f $killed_gracefully
-           test -f $stopped_gracefully
-
-           systemctl start forgejo-runner@$serial
-           retry --delay 5 --times 20 cp -a $started_running /tmp/second-run
-           ! test -f $killed_gracefully
-           ! test -f $stopped_gracefully
-           lifetime=${{ env.LIFETIME }}
-           # give it time to restart at least once
-           ls -l /etc/forgejo-runner/$serial
-           sleep $lifetime ; sleep $lifetime
-           ls -l /etc/forgejo-runner/$serial
-           ! test -f $killed_gracefully
-           ! test -f $stopped_gracefully
-           retry --delay 5 --times 20 cp -a $started_running /tmp/third-run
-           systemctl stop forgejo-runner@$serial
-           ls -l /etc/forgejo-runner/$serial
-           test -f $killed_gracefully
-           test -f $stopped_gracefully
-
-           ls -l /tmp/*-run
-           test /tmp/first-run -ot /tmp/second-run
-           test /tmp/second-run -ot /tmp/third-run
-
-       - name: forgejo-runner-service.sh status & destroy
-         if: always()
-         run: |
-           eval $(cat /tmp/env)
-           set -x
-           cat /var/log/forgejo-runner/${{ env.SERIAL }}.log || true
-           journalctl ${{ env.SYSTEMD_OPTIONS }} --unit forgejo-runner@${{ env.SERIAL }} || true
-           ./examples/lxc-systemd/forgejo-runner-service.sh lxc_destroy
diff --git a/.forgejo/workflows/publish-release.yml b/.forgejo/workflows/publish-release.yml
deleted file mode 100644
index 5555996a..00000000
--- a/.forgejo/workflows/publish-release.yml
+++ /dev/null
@@ -1,58 +0,0 @@
-# SPDX-License-Identifier: MIT
-#
-# https://invisible.forgejo.org/forgejo/runner
-#
-#  Copies & sign a release from code.forgejo.org/forgejo-integration/runner to code.forgejo.org/forgejo/runner
-#
-#  vars.FORGEJO: https://code.forgejo.org
-#  vars.FROM_OWNER: forgejo-integration
-#  vars.TO_OWNER: forgejo
-#  vars.DOER: release-team
-#  vars.ROLE: forgejo-release
-#  secrets.TOKEN: <generated from code.forgejo.org/release-team>
-#  secrets.GPG_PRIVATE_KEY: <XYZ>
-#  secrets.GPG_PASSPHRASE: <ABC>
-#
-name: publish
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-enable-email-notifications: true
-
-jobs:
-  publish:
-    runs-on: lxc-bookworm
-    if: vars.ROLE == 'forgejo-release'
-    steps:
-      - uses: https://data.forgejo.org/actions/checkout@v4
-
-      - name: copy & sign
-        uses: https://data.forgejo.org/forgejo/forgejo-build-publish/publish@v5.4.1
-        with:
-          from-forgejo: ${{ vars.FORGEJO }}
-          to-forgejo: ${{ vars.FORGEJO }}
-          from-owner: ${{ vars.FROM_OWNER }}
-          to-owner: ${{ vars.TO_OWNER }}
-          repo: "runner"
-          release-notes: |
-            - [User guide](https://forgejo.org/docs/next/user/actions/overview/)
-            - [Administrator guide](https://forgejo.org/docs/next/admin/actions/)
-            - [Container images](https://code.forgejo.org/forgejo/-/packages/container/runner/versions)
-
-            Release Notes
-
-            ---
-
-          release-notes-assistant: true
-          ref-name: ${{ forge.ref_name }}
-          sha: ${{ forge.sha }}
-          container-suffixes: " "
-          from-token: ${{ secrets.TOKEN }}
-          to-doer: ${{ vars.DOER }}
-          to-token: ${{ secrets.TOKEN }}
-          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          gpg-passphrase: ${{ secrets.GPG_PASSPHRASE }}
-          verbose: ${{ vars.VERBOSE }}
diff --git a/.forgejo/workflows/release-notes-assistant.yml b/.forgejo/workflows/release-notes-assistant.yml
deleted file mode 100644
index bf63f433..00000000
--- a/.forgejo/workflows/release-notes-assistant.yml
+++ /dev/null
@@ -1,42 +0,0 @@
-#
-# secrets.RELEASE_NOTES_ASSISTANT_TOKEN issued by https://code.forgejo.org/release-notes-assistant-bot with write:issue, write:repository, write:organization and member of the https://code.forgejo.org/org/forgejo/teams/release-notes-assistant team that further tune the access
-#
-name: issue-labels
-
-on:
-  pull_request_target:
-    types:
-      - edited
-      - synchronize
-      - labeled
-
-env:
-  RNA_VERSION: v1.4.0 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
-
-jobs:
-  release-notes:
-    if: vars.ROLE == 'forgejo-coding'
-    runs-on: docker
-    container:
-      image: 'data.forgejo.org/oci/ci:1'
-    steps:
-      - uses: https://data.forgejo.org/actions/checkout@v4
-
-      - name: event
-        run: |
-          cat <<'EOF'
-          ${{ toJSON(forge.event.pull_request.labels.*.name) }}
-          EOF
-          cat <<'EOF'
-          ${{ toJSON(forge.event) }}
-          EOF
-
-      - name: install release-notes-assistant
-        run: |
-          set -x
-          wget -O /usr/local/bin/rna https://code.forgejo.org/forgejo/release-notes-assistant/releases/download/${{ env.RNA_VERSION}}/release-notes-assistant
-          chmod +x /usr/local/bin/rna
-
-      - name: release-notes-assistant preview
-        run: |
-          rna --verbose --storage pr --storage-location ${{ forge.event.pull_request.number }}  --forgejo-url $FORGEJO_SERVER_URL --repository $FORGEJO_REPOSITORY --token ${{ secrets.RELEASE_NOTES_ASSISTANT_TOKEN }} preview ${{ forge.event.pull_request.number }}
diff --git a/.forgejo/workflows/test.yml b/.forgejo/workflows/test.yml
deleted file mode 100644
index 9ce07101..00000000
--- a/.forgejo/workflows/test.yml
+++ /dev/null
@@ -1,129 +0,0 @@
-name: checks
-on:
-  push:
-    branches:
-      - 'main'
-  pull_request:
-
-enable-email-notifications: true
-
-env:
-  FORGEJO_HOST_PORT: 'forgejo:3000'
-  FORGEJO_ADMIN_USER: 'root'
-  FORGEJO_ADMIN_PASSWORD: 'admin1234'
-  FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
-  FORGEJO_SCRIPT: |
-    /usr/bin/s6-svscan /etc/s6 & sleep 10 ; su -c "forgejo admin user create --admin --username $FORGEJO_ADMIN_USER --password $FORGEJO_ADMIN_PASSWORD --email root@example.com" git && su -c "forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET" git && sleep infinity
-  GOPROXY: https://goproxy.io,direct
-
-jobs:
-  build-and-tests:
-    name: build and test
-    if: vars.ROLE == 'forgejo-coding'
-    runs-on: docker
-    container:
-      image: 'code.forgejo.org/oci/ci:1'
-
-    services:
-      forgejo:
-        image: code.forgejo.org/forgejo/forgejo:11
-        env:
-          FORGEJO__security__INSTALL_LOCK: "true"
-          FORGEJO__log__LEVEL: "debug"
-          FORGEJO__actions__ENABLED: "true"
-          FORGEJO_ADMIN_USER: root
-          FORGEJO_ADMIN_PASSWORD: admin1234
-          FORGEJO_RUNNER_SECRET: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'
-        cmd:
-          - 'bash'
-          - '-c'
-          - '/usr/bin/s6-svscan /etc/s6 & sleep 10 ; su -c "forgejo admin user create --admin --username $FORGEJO_ADMIN_USER --password $FORGEJO_ADMIN_PASSWORD --email root@example.com" git && su -c "forgejo forgejo-cli actions register --labels docker --name therunner --secret $FORGEJO_RUNNER_SECRET" git && sleep infinity'
-
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.mod
-
-      - name: validate go version
-        run: |
-          set -ex
-          toolchain=$(grep -oP '(?<=toolchain ).+' go.mod)
-          version=$(go version | cut -d' ' -f3)
-          if dpkg --compare-versions ${version#go} lt ${toolchain#go}; then
-            echo "go version too low: $toolchain >= $version"
-            exit 1
-          fi
-
-      - run: make vet
-
-      - run: make build
-
-      - uses: https://code.forgejo.org/actions/upload-artifact@v3
-        with:
-          name: forgejo-runner
-          path: forgejo-runner
-
-      - name: check the forgejo server is responding
-        run: |
-          sleep 10 # matches the sleep 10 in the bootstrap of the Forgejo instance
-          # in case of a slow machine, give it time to bootstrap
-          retry --delay=10 --times=6 bash -c 'test $FORGEJO_ADMIN_USER = $(curl -sS http://$FORGEJO_ADMIN_USER:$FORGEJO_ADMIN_PASSWORD@$FORGEJO_HOST_PORT/api/v1/user | jq --raw-output .login)'
-
-      - run: make FORGEJO_URL=http://$FORGEJO_HOST_PORT test
-
-  runner-exec-tests:
-    needs: [build-and-tests]
-    name: runner exec tests
-    if: vars.ROLE == 'forgejo-coding'
-    runs-on: lxc-bookworm
-
-    steps:
-
-      - uses: actions/checkout@v4
-
-      - uses: https://code.forgejo.org/actions/download-artifact@v3
-        with:
-          name: forgejo-runner
-
-      - run: chmod +x forgejo-runner
-
-      - name: install docker
-        run: |
-          mkdir /etc/docker
-          cat > /etc/docker/daemon.json  <<EOF
-          {
-            "ipv6": true,
-            "experimental": true,
-            "ip6tables": true,
-            "fixed-cidr-v6": "fd05:d0ca:1::/64",
-            "default-address-pools": [
-              {
-                "base": "172.19.0.0/16",
-                "size": 24
-              },
-              {
-                "base": "fd05:d0ca:2::/104",
-                "size": 112
-              }
-            ]
-          }
-          EOF
-          apt --quiet install --yes -qq docker.io
-
-      - name: forgejo-runner exec --enable-ipv6
-        run: |
-          set -x
-          ./forgejo-runner exec --enable-ipv6 --workflows .forgejo/testdata/ipv6.yml
-          if ./forgejo-runner exec --workflows .forgejo/testdata/ipv6.yml >& /tmp/out ; then
-             cat /tmp/out
-             echo "IPv6 not enabled, should fail"
-             exit 1
-          fi
-
-      - name: forgejo-runner exec --var
-        run: |
-          set -x
-          ./forgejo-runner exec --var MY_VAR=testvariable --workflows .forgejo/testdata/var.yml |& tee /tmp/var.out
-          grep --quiet 'Success - Main echo "VAR -> testvariable"' /tmp/var.out