Forgejo 15.0 Adds Repository-Scoped Tokens, OIDC Support, and Ephemeral Runners in New LTS Release
Forgejo 15.0 lands as the project's new LTS release with repository-scoped access tokens, reusable workflow expansion, OpenID Connect support, and ephemeral runners.
Overview
Forgejo v15.0 shipped on April 16, 2026 as the project’s 100th release and its new long-term-support branch, according to the official Forgejo announcement, LWN, and the Forgejo release schedule. The release keeps pushing the self-hosted Git forge toward more opinionated security and automation defaults, with repository-scoped access tokens, expanded Forgejo Actions behavior, OpenID Connect support, and ephemeral runners all landing in the same update.
What We Know
Forgejo says v15.0 refines day-to-day usability and security while adding new Forgejo Actions capabilities, and LWN summarizes the release the same way, highlighting repository-specific access tokens, UI improvements, and broader Actions changes. Forgejo’s schedule page says the 15.0 branch is an LTS release supported through July 15, 2027, while 11.0 remains supported until July 16, 2026. Forgejo LWN Forgejo release schedule
The most consequential security change is repository-specific access tokens. Forgejo says token creators can now restrict a token to a defined repository list, and that the token will not be able to act outside those repositories except for read-only access to public repositories. The project also says it adjusted repository API authorization to fit the new model. Forgejo
Forgejo Actions also gets a structural upgrade. The official announcement says reusable workflows can be expanded into individual jobs when the top-level runs-on field is removed, which lets Forgejo dispatch the jobs separately and show their logs separately in the UI. Forgejo
Forgejo adds OpenID Connect support for Actions in v15.0, and Linuxiac reports that the feature is meant to replace long-lived static secrets with short-lived signed tokens when workflows authenticate to third-party systems. Linuxiac also notes that Forgejo Runner versions later than 12.5 are required for the feature. Forgejo Linuxiac
The release also introduces ephemeral runners. Forgejo says these runners can be registered to execute a single job, after which their registration is deleted and their credentials cannot be reused. Linuxiac adds that the release also improves runner setup with a web-based registration workflow, reducing the amount of command-line setup needed for many deployments. Forgejo Linuxiac
On the UI side, Forgejo says label exclusion no longer depends on holding the Alt key, releases have been reworked for better screen shapes, and Git notes can now be edited from the single-commit pull request view. The announcement also says container uploads can now be automatically linked to repositories when the image metadata or naming pattern makes that relationship clear. Forgejo
What We Don’t Know
Forgejo does not say how many installations will be affected by the cookie-name change or the rootless Docker config migration, only that both are breaking changes for some upgrades. Linuxiac reports that users on affected deployments may need to sign in again and that rootless container operators using the old /etc/gitea path must move the config or override GITEA_APP_INI. Forgejo Linuxiac
The release notes also do not quantify adoption of the new Actions features. It is still unclear how quickly operators will switch from static credentials to OIDC, or how widely ephemeral runners will replace long-lived runner registrations in production fleets. That impact will depend on how much automation each deployment already has in place, which the sources do not measure. Forgejo Linuxiac
Analysis
Forgejo 15.0 reads less like a cosmetic point release than a deliberate tightening of the platform’s security model. Repository-scoped tokens reduce blast radius, OIDC replaces a class of permanent secrets, and ephemeral runners cut the lifetime of CI credentials. For self-hosted operators, that combination matters more than any single UI tweak because it reduces the amount of trust that has to be left lying around in the first place. Forgejo Linuxiac
The tradeoff is ordinary operational friction. The release explicitly warns about re-logins and a container config path change, which is typical of security-focused LTS updates: the project is making the safer path easier, but it is also asking admins to touch live deployments. For teams already running Forgejo as infrastructure, that is a reasonable exchange. Forgejo Forgejo release schedule