Port IFC and IDS checks to Forgejo Actions

The GitHub workflows could never run here: they ask for runs-on:
ubuntu-latest, which no runner on hub.postle.net offers, so all 8 runs
so far were cancelled. Moved to .forgejo/workflows and pointed at the
`ifc` runner, which serves the pinned ifc-ci image.

The setup steps are gone because the image already contains
ifcopenshell, ifctester, idssplit and pytest, so a run no longer spends
most of its time in setup-python and `pip install ifcopenshell`.

Both bodies are otherwise unchanged apart from skipping libraries/,
which holds vendored component sources rather than deliverable models.

Verified in the ifc-ci container against this model before pushing:
both checks pass, and both were shown to fail when they should --
a corrupted GlobalId exits non-zero, and an IDS rule applying to all 32
windows reports [FAIL] (0/32) and exits 1. That second check matters
because ifctester's CLI never sets an exit code, so the grep for
[FAIL] is what makes the check capable of failing at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T93BEAfP4jvcYo7oMo5AL1

.forgejo/workflows/ids-lint.yml

@@ -1,3 +1,16 @@
+# IDS compliance: every rule in every IDS/**/*.ids, against every model.
+#
+# Port of .github/workflows/ids-lint.yml. The script body is unchanged apart
+# from skipping libraries/; only the setup steps and `runs-on:` differ, because
+# ifc-ci already contains ifctester and idssplit.
+#
+# idssplit splits each IDS file into one file per rule before testing, so a
+# failure names the specific rule rather than only the specification.
+#
+# Runs on the user-scoped `ifc` runner (user ci-ifc) on hub.postle.net, whose
+# root-owned config.yaml has an empty `valid_volumes` -- no host path can be
+# mounted, which is what makes it safe for an outside contributor's PR.
+
 name: IDS Compliance Check
 
 on:
@@ -7,23 +20,19 @@ on:
 
 jobs:
   ids-lint:
-    runs-on: ubuntu-latest
+    runs-on: ifc
+    container:
+      image: hub.postle.net/bruno/ifc-ci:latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.10'
-
-      - name: Install ifctester and idssplit
-        run: |
-          pip install ifctester
-          pip install --no-deps https://github.com/brunopostle/idssplit/releases/download/0.1.0/idssplit-0.1.0-py3-none-any.whl
+        uses: actions/checkout@v4
 
       - name: Run IDS validations
+        # Deliberately greps output instead of trusting the exit status:
+        # ifctester's CLI has no sys.exit anywhere, so a model that violates
+        # every rule still exits 0. A naive `run: ifctester ...` would be a
+        # permanently green check that can never fail.
         run: |
           set -e
           shopt -s globstar nullglob
@@ -40,7 +49,12 @@ jobs:
             exit 0
           fi
 
-          ifc_files=(**/*.ifc)
+          # libraries/ holds vendored component sources, not deliverable models.
+          ifc_files=()
+          for f in **/*.ifc; do
+            [[ "$f" == libraries/* ]] && continue
+            ifc_files+=("$f")
+          done
 
           if [ ${#ifc_files[@]} -eq 0 ]; then
             echo "No IFC files found"

.forgejo/workflows/ifc-lint.yml

@@ -0,0 +1,39 @@
+# Schema/rule validation for every IFC model in the repo.
+#
+# Port of .github/workflows/ifc-lint.yml. Only the setup steps and `runs-on:`
+# changed: `ifc-ci` already contains ifcopenshell, so there is no setup-python
+# and no pip install -- on GitHub those were most of the runtime.
+#
+# Runs on the user-scoped `ifc` runner (user ci-ifc) on hub.postle.net, whose
+# root-owned config.yaml has an empty `valid_volumes`. A job here can mount no
+# host path at all, which is what makes it safe to run an outside contributor's
+# pull request.
+
+name: IFC Validation
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  lint-ifc:
+    runs-on: ifc
+    container:
+      image: hub.postle.net/bruno/ifc-ci:latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run IFC lint checks
+        # Gates on its own exit status: ifcopenshell.validate calls sys.exit()
+        # on failure, so `set -e` fails the job.
+        run: |
+          set -e
+          shopt -s globstar nullglob
+          for file in **/*.ifc; do
+            # libraries/ holds vendored component sources, not deliverable models.
+            [[ "$file" == libraries/* ]] && continue
+            echo "Validating $file..."
+            python3 -m ifcopenshell.validate --rules "$file"
+          done

.github/workflows/ifc-lint.yml

@@ -1,32 +0,0 @@
-name: IFC Validation
-
-on:
-  push:
-  pull_request:
-
-jobs:
-  lint-ifc:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v3
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-        with:
-          python-version: '3.x'
-
-      - name: Install ifcopenshell
-        run: |
-          pip install pytest
-          pip install ifcopenshell
-
-      - name: Run IFC lint checks
-        run: |
-          set -e
-          shopt -s globstar nullglob
-          for file in **/*.ifc; do
-            echo "Validating $file..."
-            python3 -m ifcopenshell.validate --rules "$file"
-          done