sops — install checksum-verified SOPS and decrypt *.sops.* files with an age key
ssh-copy — rsync a local directory to a remote host over SSH
ssh-run — run a script on a remote host over SSH

Reference a local action from a workflow:

- uses: studio/actions/ssh-run@main
  with:
    host: ${{ secrets.HOST }}
    user: deploy
    key: ${{ secrets.SSH_KEY }}
    script: ./deploy.sh

Runner image

images/act builds git.studiovita.li/studio/actions:ubuntu-latest from the Gitea runner image, adding rsync and SOPS. Built weekly and on images/** changes via .gitea/workflows/build.yml.

Maintenance

Dependencies pinned in action.yml / Dockerfile are updated by Renovate using ## renovate: annotations.