ci: add Forgejo CI workflow (mirror text-extract)

The six gates the rest of chain-modules already runs against:
fmt-check, clippy with -D warnings, host build, host test,
release wasm32-wasip2 build, plus the manual external-URL
checkout and chain-module-sdk insteadOf URL rewrite (via
secrets.MODULE_SDK_PAT) so cargo can reach the org-private SDK
git dep through Forgejo's REQUIRE_SIGNIN_VIEW.

Same template as text-extract's .forgejo/workflows/ci.yml; the
only swap is the module-name string in the checkout step.

Signed-off-by: flemming-it <sf@flemming.it>

.forgejo/workflows/ci.yml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+  RUSTFLAGS: "-D warnings"
+  RUST_TOOLCHAIN: "1.86"
+  CARGO_NET_GIT_FETCH_WITH_CLI: "true"
+
+jobs:
+  ci:
+    name: Linux x86_64 (Forgejo)
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout stats-cohort-size via external URL
+        run: |
+          set -eu
+          mkdir -p "$GITHUB_WORKSPACE"
+          cd "$GITHUB_WORKSPACE"
+          git init -q
+          git remote add origin \
+            "https://x-access-token:${GITHUB_TOKEN}@git.flemming.ws/${GITHUB_REPOSITORY}.git"
+          git fetch --depth=1 origin "$GITHUB_SHA"
+          git checkout -q FETCH_HEAD
+
+      - name: Configure git URL rewrite for SDK fetch
+        env:
+          SDK_PAT: ${{ secrets.MODULE_SDK_PAT }}
+        run: |
+          git config --global \
+            "url.https://x-access-token:${SDK_PAT}@git.flemming.ws/.insteadOf" \
+            "https://git.flemming.ws/"
+
+      - name: Install system dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends \
+            curl ca-certificates build-essential pkg-config libssl-dev git
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \
+            | sh -s -- -y --profile minimal \
+              --default-toolchain "$RUST_TOOLCHAIN" \
+              --target wasm32-wasip2 --component rustfmt --component clippy
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Cargo fmt --check
+        run: cargo fmt --all -- --check
+
+      - name: Cargo clippy
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Cargo build (host)
+        run: cargo build --all-targets
+
+      - name: Cargo test (host)
+        run: cargo test --all-targets
+
+      - name: Cargo build (wasm32-wasip2)
+        run: cargo build --release --target wasm32-wasip2

src/lib.rs

@@ -24,7 +24,7 @@ struct Cohort {
 #[fai_module]
 pub fn invoke(_ctx: Context, inputs: Inputs) -> Result<Outputs, ModuleError> {
     let id = inputs.require_text("cohort_id")?;
-    let cohort = resolve(&id).ok_or_else(|| {
+    let cohort = resolve(id).ok_or_else(|| {
         ModuleError::invalid_input(format!(
             "unknown cohort_id: {id} (v0.1.0 supports: \
              berlin-kmu, de-kmu, gastro-de, handwerk-be, bauwirtschaft-be)"
@@ -76,6 +76,7 @@ fn resolve(id: &str) -> Option<Cohort> {
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
     use super::*;
 
     #[test]