diff --git a/.forgejo/workflows/composite/apt-install-from/action.yaml b/.forgejo/workflows/composite/apt-install-from/action.yaml
new file mode 100644
index 0000000000..615e7cb184
--- /dev/null
+++ b/.forgejo/workflows/composite/apt-install-from/action.yaml
@@ -0,0 +1,29 @@
+inputs:
+  packages:
+    description: 'Packages to install'
+    required: true
+  release:
+    description: 'Release to install from'
+    default: testing
+
+runs:
+  using: "composite"
+  steps:
+    - name: setup apt package source
+      run: |
+        export DEBIAN_FRONTEND=noninteractive
+        echo "deb http://deb.debian.org/debian/ ${RELEASE} main" > "/etc/apt/sources.list.d/${RELEASE}.list"
+      env:
+        RELEASE: ${{inputs.release}}
+    - name: install packages
+      run: |
+        apt-get update -qq
+        apt-get -q install -qq -y ${PACKAGES}
+      env:
+        PACKAGES: ${{inputs.packages}}
+    - name: remove temporary package list to prevent using it in other steps
+      run: |
+        rm "/etc/apt/sources.list.d/${RELEASE}.list"
+        apt-get update -qq
+      env:
+        RELEASE: ${{inputs.release}}
diff --git a/.forgejo/workflows/composite/build-backend/action.yaml b/.forgejo/workflows/composite/build-backend/action.yaml
new file mode 100644
index 0000000000..193ff911e1
--- /dev/null
+++ b/.forgejo/workflows/composite/build-backend/action.yaml
@@ -0,0 +1,15 @@
+runs:
+  using: "composite"
+  steps:
+    - run: |
+        su forgejo -c 'make deps-backend'
+    - uses: actions/cache@v4
+      id: cache-backend
+      with:
+        path: '/workspace/forgejo/forgejo/gitea'
+        key: backend-build-${{ github.sha }}
+    - if: steps.cache-backend.outputs.cache-hit != 'true'
+      run: |
+        su forgejo -c 'make backend'
+      env:
+        TAGS: bindata
diff --git a/.forgejo/workflows/composite/setup-env/action.yaml b/.forgejo/workflows/composite/setup-env/action.yaml
new file mode 100644
index 0000000000..30e78dbb71
--- /dev/null
+++ b/.forgejo/workflows/composite/setup-env/action.yaml
@@ -0,0 +1,11 @@
+runs:
+  using: "composite"
+  steps:
+    - uses: https://code.forgejo.org/actions/setup-go@v4
+      with:
+        go-version-file: "go.mod"
+    - name: setup user and permissions
+      run: |
+        git config --add safe.directory '*'
+        adduser --quiet --comment forgejo --disabled-password forgejo
+        chown -R forgejo:forgejo .
diff --git a/.forgejo/workflows/testing.yml b/.forgejo/workflows/testing.yml
index 725cd242ee..8c1e6d06f8 100644
--- a/.forgejo/workflows/testing.yml
+++ b/.forgejo/workflows/testing.yml
@@ -20,19 +20,10 @@ jobs:
           ${{ toJSON(github) }}
           EOF
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
-      - run: make deps-backend deps-tools
-      - run: make --always-make -j$(nproc) lint-backend tidy-check swagger-check fmt-check swagger-validate # ensure the "go-licenses" make target runs
-      - run: |
-          make backend
-        env:
-          TAGS: bindata
-      - uses: actions/cache@v4
-        with:
-          path: '/workspace/forgejo/forgejo/gitea'
-          key: backend-build-${{ github.sha }}
+      - uses: ./.forgejo/workflows/composite/setup-env
+      - run: su forgejo -c 'make deps-backend deps-tools'
+      - run: su forgejo -c 'make --always-make -j$(nproc) lint-backend tidy-check swagger-check fmt-check swagger-validate' # ensure the "go-licenses" make target runs
+      - uses: ./.forgejo/workflows/composite/build-backend
   frontend-checks:
     if: ${{ !startsWith(vars.ROLE, 'forgejo-') }}
     runs-on: docker
@@ -67,37 +58,16 @@ jobs:
           MINIO_ROOT_PASSWORD: 12345678
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
-      - run: |
-          git config --add safe.directory '*'
-          adduser --quiet --comment forgejo --disabled-password forgejo
-          chown -R forgejo:forgejo .
+      - uses: ./.forgejo/workflows/composite/setup-env
       - name: install git >= 2.42
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          echo deb http://deb.debian.org/debian/ testing  main > /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-          apt-get -q install -qq -y git
-          rm /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
+        uses: ./.forgejo/workflows/composite/apt-install-from
+        with:
+          packages: git
       - name: test release-notes-assistant.sh
         run: |
           apt-get -q install -qq -y jq
           ./release-notes-assistant.sh test_main
-      - run: |
-          su forgejo -c 'make deps-backend'
-      - uses: actions/cache/restore@v4
-        id: cache-backend
-        with:
-          path: '/workspace/forgejo/forgejo/gitea'
-          key: backend-build-${{ github.sha }}
-      - if: steps.cache-backend.outputs.cache-hit != 'true'
-        run: |
-          su forgejo -c 'make backend'
-        env:
-          TAGS: bindata
+      - uses: ./.forgejo/workflows/composite/build-backend
       - run: |
           su forgejo -c 'make test-backend test-check'
         timeout-minutes: 50
@@ -132,33 +102,12 @@ jobs:
         options: ${{ matrix.cacher.options }}
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
-      - run: |
-          git config --add safe.directory '*'
-          adduser --quiet --comment forgejo --disabled-password forgejo
-          chown -R forgejo:forgejo .
+      - uses: ./.forgejo/workflows/composite/setup-env
       - name: install git >= 2.42
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          echo deb http://deb.debian.org/debian/ testing  main > /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-          apt-get -q install -qq -y git
-          rm /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-      - run: |
-          su forgejo -c 'make deps-backend'
-      - uses: actions/cache/restore@v4
-        id: cache-backend
+        uses: ./.forgejo/workflows/composite/apt-install-from
         with:
-          path: '/workspace/forgejo/forgejo/gitea'
-          key: backend-build-${{ github.sha }}
-      - if: steps.cache-backend.outputs.cache-hit != 'true'
-        run: |
-          su forgejo -c 'make backend'
-        env:
-          TAGS: bindata
+          packages: git
+      - uses: ./.forgejo/workflows/composite/build-backend
       - run: |
           su forgejo -c 'make test-remote-cacher test-check'
         timeout-minutes: 50
@@ -184,34 +133,12 @@ jobs:
           MYSQL_EXTRA_FLAGS: --innodb-adaptive-flushing=OFF --innodb-buffer-pool-size=4G --innodb-log-buffer-size=128M --innodb-flush-log-at-trx-commit=0 --innodb-flush-log-at-timeout=30 --innodb-flush-method=nosync --innodb-fsync-threshold=1000000000
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
+      - uses: ./.forgejo/workflows/composite/setup-env
       - name: install dependencies & git >= 2.42
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          echo deb http://deb.debian.org/debian/ testing  main > /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-          apt-get install --no-install-recommends -qq -y git git-lfs
-          rm /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-      - name: setup user and permissions
-        run: |
-          git config --add safe.directory '*'
-          adduser --quiet --comment forgejo --disabled-password forgejo
-          chown -R forgejo:forgejo .
-      - run: |
-          su forgejo -c 'make deps-backend'
-      - uses: actions/cache/restore@v4
-        id: cache-backend
+        uses: ./.forgejo/workflows/composite/apt-install-from
         with:
-          path: '/workspace/forgejo/forgejo/gitea'
-          key: backend-build-${{ github.sha }}
-      - if: steps.cache-backend.outputs.cache-hit != 'true'
-        run: |
-          su forgejo -c 'make backend'
-        env:
-          TAGS: bindata
+          packages: git git-lfs
+      - uses: ./.forgejo/workflows/composite/build-backend
       - run: |
           su forgejo -c 'make test-mysql-migration test-mysql'
         timeout-minutes: 50
@@ -238,34 +165,12 @@ jobs:
           POSTGRES_PASSWORD: postgres
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
+      - uses: ./.forgejo/workflows/composite/setup-env
       - name: install dependencies & git >= 2.42
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          echo deb http://deb.debian.org/debian/ testing  main > /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-          apt-get install --no-install-recommends -qq -y git git-lfs
-          rm /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-      - name: setup user and permissions
-        run: |
-          git config --add safe.directory '*'
-          adduser --quiet --comment forgejo --disabled-password forgejo
-          chown -R forgejo:forgejo .
-      - run: |
-          su forgejo -c 'make deps-backend'
-      - uses: actions/cache/restore@v4
-        id: cache-backend
+        uses: ./.forgejo/workflows/composite/apt-install-from
         with:
-          path: '/workspace/forgejo/forgejo/gitea'
-          key: backend-build-${{ github.sha }}
-      - if: steps.cache-backend.outputs.cache-hit != 'true'
-        run: |
-          su forgejo -c 'make backend'
-        env:
-          TAGS: bindata
+          packages: git git-lfs
+      - uses: ./.forgejo/workflows/composite/build-backend
       - run: |
           su forgejo -c 'make test-pgsql-migration test-pgsql'
         timeout-minutes: 50
@@ -281,34 +186,12 @@ jobs:
       image: 'code.forgejo.org/oci/node:20-bookworm'
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
+      - uses: ./.forgejo/workflows/composite/setup-env
       - name: install dependencies & git >= 2.42
-        run: |
-          export DEBIAN_FRONTEND=noninteractive
-          echo deb http://deb.debian.org/debian/ testing  main > /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-          apt-get install --no-install-recommends -qq -y git git-lfs
-          rm /etc/apt/sources.list.d/testing.list
-          apt-get update -qq
-      - name: setup user and permissions
-        run: |
-          git config --add safe.directory '*'
-          adduser --quiet --comment forgejo --disabled-password forgejo
-          chown -R forgejo:forgejo .
-      - run: |
-          su forgejo -c 'make deps-backend'
-      - uses: actions/cache/restore@v4
-        id: cache-backend
+        uses: ./.forgejo/workflows/composite/apt-install-from
         with:
-          path: '/workspace/forgejo/forgejo/gitea'
-          key: backend-build-${{ github.sha }}
-      - if: steps.cache-backend.outputs.cache-hit != 'true'
-        run: |
-          su forgejo -c 'make backend'
-        env:
-          TAGS: bindata sqlite sqlite_unlock_notify
+          packages: git git-lfs
+      - uses: ./.forgejo/workflows/composite/build-backend
       - run: |
           su forgejo -c 'make test-sqlite-migration test-sqlite'
         timeout-minutes: 50
@@ -330,8 +213,6 @@ jobs:
       image: 'code.forgejo.org/oci/node:20-bookworm'
     steps:
       - uses: https://code.forgejo.org/actions/checkout@v3
-      - uses: https://code.forgejo.org/actions/setup-go@v4
-        with:
-          go-version-file: "go.mod"
+      - uses: ./.forgejo/workflows/composite/setup-env
       - run: make deps-backend deps-tools
       - run: make security-check