forgejo: actionsFromSelf defaults to whether this host runs the swarm-controller

The controller seeds the actions/checkout mirror from its own host's
mirror list, so a forge host without it got DEFAULT_ACTIONS_URL = self
and no mirror. The default now follows
deploy.swarm-controller.enable; the module-eval check pins forge-only
(false, no warning) and forge+controller (true, mirror seeded).

docs/scheduler/ci.md

@@ -169,12 +169,18 @@ the forge admin panel as offline until an admin deletes it.
 
 <!-- vale write-good.Passive = NO -->
 
-With `services.hyperhive.deploy.forgejo.actionsFromSelf` enabled (the default)
-on the forge's host, the swarm controller seeds an `actions/checkout` pull-mirror on the forge
-and Forgejo's `DEFAULT_ACTIONS_URL` points at the forge itself. CI
+With `services.hyperhive.deploy.forgejo.actionsFromSelf` enabled, the swarm
+controller seeds an `actions/checkout` pull-mirror on the forge and Forgejo's
+`DEFAULT_ACTIONS_URL` points at the forge itself. CI
 `uses: actions/checkout@vN` steps then resolve on the forge, with no external
 DNS on the CI critical path.
 
+The option defaults to whether the forge's host also runs the swarm controller
+(`services.hyperhive.deploy.swarm-controller.enable`): on when it does, off
+otherwise. Setting it `true` on a forge host without the controller leaves
+`actions/checkout` unresolved, because nothing seeds the mirror; evaluation
+warns about it.
+
 <!-- vale write-good.Passive = YES -->
 
 The **swarm controller** seeds the mirror in its swarm-wide forge-objects

nix/host-modules/deploy.nix

@@ -53,8 +53,9 @@ let
 
         The runner registers as a new runner on the forge, so delete the old
         one in the forge's admin panel (Site administration, Actions, Runners).
-        The forge keeps resolving `uses: actions/checkout` from itself unless
-        services.hyperhive.deploy.forgejo.actionsFromSelf is false on its host.
+        A forge host that runs the swarm-controller keeps resolving
+        `uses: actions/checkout` from itself unless
+        services.hyperhive.deploy.forgejo.actionsFromSelf is false there.
         See docs/scheduler/ci.md.
       '';
 in

nix/host-modules/hive-forge/default.nix

@@ -175,14 +175,15 @@ in
         failure on whatever reads it.
 
         With {option}`services.hyperhive.deploy.forgejo.actionsFromSelf`
-        enabled (the default), an `actions/checkout` mirror is appended to
-        this list.
+        enabled (the default on a host that runs the swarm-controller), an
+        `actions/checkout` mirror is appended to this list.
       '';
     };
 
     actionsFromSelf = lib.mkOption {
       type = lib.types.bool;
-      default = true;
+      default = deployCfg.swarm-controller.enable;
+      defaultText = lib.literalExpression "config.services.hyperhive.deploy.swarm-controller.enable";
       example = false;
       description = ''
         Resolve a workflow's `uses: <org>/<action>@vN` against this forge
@@ -192,6 +193,12 @@ in
         checkout then needs no external DNS; only the mirror's re-sync
         does.
 
+        Defaults to on when this host runs the swarm-controller, which seeds
+        the `actions/checkout` mirror, and off otherwise. Setting it `true` on
+        a host without the controller leaves `actions/checkout` unresolved:
+        nothing seeds the mirror, and the warning about unseeded mirrors
+        fires.
+
         Any other action a workflow names has to be mirrored here too. Set to
         `false` to resolve actions from `data.forgejo.org` and seed no mirror.
       '';

nix/module-eval/swarm-services-switch.nix

@@ -117,6 +117,11 @@ let
     deploy.forgejo.enable = true;
     deploy.forgejo.mirrors = [ aMirror ];
   };
+  forgeOnly = hive { deploy.forgejo.enable = true; };
+  forgeWithController = hive {
+    deploy.swarm-controller.enable = true;
+    deploy.forgejo.enable = true;
+  };
   controllerWithSelfActions = hive {
     deploy.swarm-controller.enable = true;
     deploy.forgejo.enable = true;
@@ -469,6 +474,24 @@ let
         && mirrorsOf controllerWithMirrors == [ aMirror ]
         && actionsUrlOf controllerWithMirrors == null;
     }
+    {
+      # The default follows the controller, the only thing that seeds the
+      # checkout mirror: a forge alone must not resolve actions from itself.
+      name = "actionsFromSelf defaults to whether this host runs the swarm-controller";
+      ok =
+        let
+          actionsUrlOf =
+            m: m.containers.hive-forge.config.services.forgejo.settings.actions.DEFAULT_ACTIONS_URL or null;
+          mirrorsOf =
+            m: builtins.fromJSON m.systemd.services.swarm-controller.environment.SWARM_CONTROLLER_FORGE_MIRRORS;
+        in
+        !forgeOnly.services.hyperhive.deploy.forgejo.actionsFromSelf
+        && actionsUrlOf forgeOnly == null
+        && forgeOnly.warnings == [ ]
+        && forgeWithController.services.hyperhive.deploy.forgejo.actionsFromSelf
+        && actionsUrlOf forgeWithController == "self"
+        && lib.elem "actions/checkout" (map (m: m.dest) (mirrorsOf forgeWithController));
+    }
     {
       name = "the old c0re org-avatar option lands on the controller's unit";
       ok =