diff --git a/.forgejo/actions/build-amd64/Dockerfile b/.forgejo/actions/build-amd64/Dockerfile
new file mode 100644
index 0000000..509a673
--- /dev/null
+++ b/.forgejo/actions/build-amd64/Dockerfile
@@ -0,0 +1,7 @@
+FROM docker.io/asonix/rust-builder:latest-linux-amd64
+
+RUN rustup component add clippy
+
+COPY entrypoint.sh /entrypoint.sh
+
+ENTRYPOINT ["/entrypoint.sh"]
diff --git a/.forgejo/actions/build-amd64/action.yaml b/.forgejo/actions/build-amd64/action.yaml
new file mode 100644
index 0000000..8234889
--- /dev/null
+++ b/.forgejo/actions/build-amd64/action.yaml
@@ -0,0 +1,25 @@
+name: Build x86_64 Rust Binary
+desctiption: Compiles a rust binary with a bespoke rust image
+inputs:
+  name:
+    description: Name of the binary being compiled
+    required: true
+  action:
+    description: Action to take
+    required: true
+    default: build
+  build_mode:
+    description: debug or release
+    required: true
+    default: debug
+outputs:
+  path:
+    description: Path to the produced binary
+runs:
+  using: docker
+  image: Dockerfile
+steps:
+  args:
+    - ${{ inputs.name }}
+    - ${{ inputs.action }}
+    - ${{ inputs.build_mode }}
diff --git a/.forgejo/actions/build-amd64/entrypoint.sh b/.forgejo/actions/build-amd64/entrypoint.sh
new file mode 100644
index 0000000..c301a35
--- /dev/null
+++ b/.forgejo/actions/build-amd64/entrypoint.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+set -e
+
+name=$1
+action=$2
+build_mode=$3
+
+cargo "${action}" "--${build_mode}" "--target=${TARGET}"
+
+case "$action" in
+  build)
+    echo "path=target/${TARGET}/release/${name}" >> "${GITHUB_OUTPUT}"
+    ;;
+  check)
+    ;;
+  test)
+    ;;
+  clippy)
+    ;;
+esac
diff --git a/.forgejo/workflows/check.yaml b/.forgejo/workflows/check.yaml
index 1a2c944..a5b409a 100644
--- a/.forgejo/workflows/check.yaml
+++ b/.forgejo/workflows/check.yaml
@@ -5,6 +5,18 @@ on:
       - main
 
 jobs:
+  test-action:
+    runs-on: docker
+    container:
+      image: docker.io/node:20-bookworm
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ./.forgejo/actions/build-amd64
+        with:
+          name: pict-rs
+          action: clippy
+          build_mode: debug
+
   clippy:
     runs-on: docker
     container:
diff --git a/.forgejo/workflows/publish.yaml b/.forgejo/workflows/publish.yaml
index b02ed3c..9d9f688 100644
--- a/.forgejo/workflows/publish.yaml
+++ b/.forgejo/workflows/publish.yaml
@@ -11,6 +11,7 @@ jobs:
     steps:
       - run: |
           git clone ${{ env.github_server_url }}/${{ env.github_repository }} .
+          git checkout ${{ env.github_sha }}
           rustup component add clippy
           cargo clippy --no-default-features -- -D warnings
           cargo clippy --no-default-features --features io-uring -- -D warnings
@@ -22,6 +23,7 @@ jobs:
     steps:
       - run: |
           git clone ${{ env.github_server_url }}/${{ env.github_repository }} .
+          git checkout ${{ env.github_sha }}
           cargo test
 
   build:
@@ -30,21 +32,23 @@ jobs:
       - tests
     strategy:
       matrix:
-        - tag: latest-linux-amd64
-          artifact: linux-amd64
-          target: x86_64-unknown-linux-musl
-        - tag: latest-linux-arm32v7
-          target: armv7-unknown-linux-musleabihf
-          artifact: linux-arm32v7
-        - tag: latest-linux-arm64v8
-          artifact: linux-arm64v8
-          target: aarch64-unknown-linux-musl
+        include:
+          - tag: latest-linux-amd64
+            artifact: linux-amd64
+            target: x86_64-unknown-linux-musl
+          - tag: latest-linux-arm32v7
+            target: armv7-unknown-linux-musleabihf
+            artifact: linux-arm32v7
+          - tag: latest-linux-arm64v8
+            artifact: linux-arm64v8
+            target: aarch64-unknown-linux-musl
     runs-on: docker
     container:
       image: docker.io/asonix/rust-builder:${{ matrix.tag }}
     steps:
       - run: |
           git clone ${{ env.github_server_url }}/${{ env.github_repository }} .
+          git checkout ${{ env.github_sha }}
           cargo build --target=${{ matrix.target }} --release
           mkdir artifacts
           cp target/${{ matrix.target }}/release/pict-rs artifacts/pict-rs
@@ -59,12 +63,12 @@ jobs:
     strategy:
       matrix:
         fail-fast: false
-        platform:
-          - docker: linux/amd64
+        include:
+          - platform: linux/amd64
             artifact: linux-amd64
-          - docker: linux/arm/v7
+          - platform: linux/arm/v7
             artifact: linux-arm32v7
-          - docker: linux/arm64
+          - platform: linux/arm64
             artifact: linux-arm64v8
     runs-on: docker
     container:
@@ -73,7 +77,7 @@ jobs:
       -
         name: Prepare
         run: |
-          platform=${{ matrix.platform.docker }}
+          platform=${{ matrix.platform }}
           echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       -
@@ -98,14 +102,14 @@ jobs:
         name: Download binaries
         uses: actions/download-artifact@v4
         with:
-          name: ${{ matrix.platform.artifact }}
+          name: ${{ matrix.artifact }}
           path: artifacts/
       -
-        name: Build and push ${{ matrix.platform.docker }} docker image
+        name: Build and push ${{ matrix.platform }} docker image
         uses: docker/build-push-action@v5
         with:
-          context: .
-          platforms: ${{ matrix.platform.docker }}
+          context: ./docker/forgejo"
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
           outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
       -
@@ -115,7 +119,7 @@ jobs:
           digest="${{ steps.build.outputs.digest }}"
           touch "/tmp/digests/${digest#sha256:}"
       -
-        name: Upload ${{ matrix.platform.docker }} digest
+        name: Upload ${{ matrix.platform }} digest
         uses: actions/upload-artifact@v4
         with:
           name: digests