diff --git a/.forgejo/workflows/pr.yml b/.forgejo/workflows/pr.yml
new file mode 100644
index 0000000..35cf09d
--- /dev/null
+++ b/.forgejo/workflows/pr.yml
@@ -0,0 +1,37 @@
+name: pr
+
+on:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: https://code.forgejo.org/actions/setup-go@v4
+        with:
+          go-version: ">=1.21"
+          check-latest: true
+      - name: run the fake API server
+        id: test
+        run: |
+          touch delete_me_when_ready
+          # keep server running in the background
+          ACTION_TESTING=1 go test . &
+          # wait for the OVH_ENDPOINT output to be written (inotifywait not available)
+          tail --follow=name delete_me_when_ready || echo "test server is listening"
+      - name: update the record
+        uses: ./
+        with:
+          subdomain: _release
+          domain: example.org
+          record-id: 12345
+          value: v=v1.42
+          ovh-endpoint: ${{ steps.test.outputs.OVH_ENDPOINT }}
+          ovh-app-key: APP_KEY
+          ovh-app-secret: APP_SECRET
+          ovh-consumer-key: CON_KEY
+      - name: check updated record value
+        run: |
+          cat dns.txt && echo
+          grep --quiet "v=v1.42" dns.txt
diff --git a/main_test.go b/main_test.go
index 75fe7e0..ac2e4b3 100644
--- a/main_test.go
+++ b/main_test.go
@@ -4,9 +4,12 @@
 package main
 
 import (
+	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"testing"
 
 	"github.com/sethvargo/go-githubactions"
@@ -16,15 +19,21 @@ func TestRun(t *testing.T) {
 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		default:
-			t.Errorf("unexpected request on %s", r.URL.Path)
+			msg := fmt.Sprintf("unexpected request on %s", r.URL.Path)
+			http.Error(w, msg, http.StatusBadRequest)
+			t.Error(msg)
 		case "/auth/time":
 		case "/domain/zone/FAKEVALUE-INPUT_DOMAIN/record/FAKEVALUE-INPUT_RECORD-ID":
 			buf, err := io.ReadAll(r.Body)
 			if err != nil {
-				t.Errorf("could not read request body: %v", err)
+				msg := fmt.Sprintf("could not read request body: %v", err)
+				http.Error(w, msg, http.StatusBadRequest)
+				t.Error(msg)
 			}
 			if string(buf) != `{"subDomain":"FAKEVALUE-INPUT_SUBDOMAIN","target":"\"FAKEVALUE-INPUT_VALUE\""}` {
-				t.Errorf("unexpected body: %s", string(buf))
+				msg := fmt.Sprintf("unexpected body: %s", string(buf))
+				http.Error(w, msg, http.StatusBadRequest)
+				t.Error(msg)
 			}
 		}
 	}))
@@ -40,4 +49,50 @@ func TestRun(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+
+	// for action testing (see .forgejo/workflows/pr.yml)
+	if os.Getenv("ACTION_TESTING") == "1" {
+		s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			switch r.URL.Path {
+			default:
+				msg := fmt.Sprintf("unexpected request on %s", r.URL.Path)
+				http.Error(w, msg, http.StatusBadRequest)
+				t.Error(msg)
+				return
+			case "/auth/time":
+			case "/domain/zone/example.org/record/12345":
+				var body struct {
+					SubDomain string `json:"subDomain"`
+					Target    string `json:"target"`
+				}
+				err := json.NewDecoder(r.Body).Decode(&body)
+				if err != nil {
+					msg := fmt.Sprintf("could not decode request body: %v", err)
+					http.Error(w, msg, http.StatusBadRequest)
+					t.Error(msg)
+					return
+				}
+				if body.SubDomain != "_release" {
+					msg := fmt.Sprintf("unexpected subdomain: %s", body.SubDomain)
+					http.Error(w, msg, http.StatusBadRequest)
+					t.Error(msg)
+					return
+				}
+				err = os.WriteFile("dns.txt", []byte(body.Target), 0o644)
+				if err != nil {
+					msg := fmt.Sprintf("could write dns.txt: %v", err)
+					http.Error(w, msg, http.StatusInternalServerError)
+					t.Error(msg)
+					return
+				}
+			}
+		}))
+		t.Cleanup(s.Close)
+		githubactions.SetOutput("OVH_ENDPOINT", "http://"+s.Listener.Addr().String())
+		err = os.Remove("delete_me_when_ready")
+		if err != nil {
+			t.Fatal(err)
+		}
+		select {}
+	}
 }