coilyco-flight-deck/bluesky-mcp

Watch

Migrate bluesky-mcp image publishing to Forgejo OCI #5

New issue

Closed

opened 2026-07-27 02:41:29 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-27 02:41:29 +00:00

Member

Outcome

Publish bluesky-mcp to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner.

Program authority: coilysiren/inbox#276

Registry inventory: coilyco-flight-deck/infrastructure#653

Consumer rollout: coilyco-bridge/deploy#239

Target

forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp:<immutable-source-tag>

Scope

Inspect the current trusted main-only image workflow and preserve its release trigger semantics.
Authenticate through the established package-write secret contract without placing credentials in tracked files.
Publish a source-derived immutable tag to the target Forgejo authority.
Record whether package visibility is intentionally public or private.
Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository.
Update repository documentation to name Forgejo OCI as the image authority.
Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover.
Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build.

Acceptance

A trusted main workflow publishes the target image to Forgejo OCI.
The issue records proof that the immutable manifest exists.
The standalone registry receives no new image from this repository after cutover.
Canonical source and documentation contain no active standalone-registry publish contract.
Repository validation passes.
deploy#239 records and consumes the proven reference before this issue closes.

Codex, via advisor surface

## Outcome Publish `bluesky-mcp` to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner. Program authority: https://forgejo.coilysiren.me/coilysiren/inbox/issues/276 Registry inventory: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/653 Consumer rollout: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/239 ## Target `forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp:<immutable-source-tag>` ## Scope * Inspect the current trusted main-only image workflow and preserve its release trigger semantics. * Authenticate through the established package-write secret contract without placing credentials in tracked files. * Publish a source-derived immutable tag to the target Forgejo authority. * Record whether package visibility is intentionally public or private. * Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository. * Update repository documentation to name Forgejo OCI as the image authority. * Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover. * Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build. ## Acceptance * A trusted main workflow publishes the target image to Forgejo OCI. * The issue records proof that the immutable manifest exists. * The standalone registry receives no new image from this repository after cutover. * Canonical source and documentation contain no active standalone-registry publish contract. * Repository validation passes. * deploy#239 records and consumes the proven reference before this issue closes.  Codex, via advisor surface

coilyco-ops commented

2026-07-27 04:44:45 +00:00

Author

Member

Source publisher landed on main at ddfe973.

The existing validation job still gates publication, and the publish job now uses the trusted deploy runner for forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp:<full-source-sha>.
The private publisher uses runner-provided REGISTRY_TOKEN, the runner egress proxy for dependency resolution, an isolated Docker config, one immutable tag, and remote manifest inspection.
DinD probing and the standalone-registry endpoint are removed from canonical source.
Local proof passed: publisher syntax, lint, type-checking, four read-only boundary tests, production dependency audit, full pre-commit and secret scan, and the exact non-root Docker image build.

Remote manifest proof and deploy consumption remain blocked by infrastructure#654. This issue stays open until Ops restores package write authority and deploy#239 consumes the proved manifest with the separate read credential.

Source publisher landed on `main` at `ddfe973`. * The existing validation job still gates publication, and the publish job now uses the trusted `deploy` runner for `forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp:<full-source-sha>`. * The private publisher uses runner-provided `REGISTRY_TOKEN`, the runner egress proxy for dependency resolution, an isolated Docker config, one immutable tag, and remote manifest inspection. * DinD probing and the standalone-registry endpoint are removed from canonical source. * Local proof passed: publisher syntax, lint, type-checking, four read-only boundary tests, production dependency audit, full pre-commit and secret scan, and the exact non-root Docker image build. Remote manifest proof and deploy consumption remain blocked by [infrastructure#654](https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/654). This issue stays open until Ops restores package write authority and deploy#239 consumes the proved manifest with the separate read credential.

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:45:25 +00:00

coilyco-ops commented

2026-07-29 05:03:18 +00:00

Author

Member

Ops completed the publisher and consumer checkpoints.

Publisher fix: 3fd115f replaces the unsupported checkout action.
Immutable image: forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp:3fd115fef8e5ed8c616ad8b9fa9a670ed2b7c2c1
Publisher proof: Forgejo Actions run 8 passed validation and publish.
Deploy source landed in coilyco-bridge/deploy at 47c199b.
Live proof: the bluesky-mcp Deployment is fully rolled out, the pull ExternalSecret is Ready, and the pod pulled the exact image.
Canonical Bluesky deploy source contains no standalone-registry fallback.

Closing the publisher issue.

Ops completed the publisher and consumer checkpoints. * Publisher fix: `3fd115f` replaces the unsupported checkout action. * Immutable image: `forgejo.coilysiren.me/coilyco-flight-deck/bluesky-mcp:3fd115fef8e5ed8c616ad8b9fa9a670ed2b7c2c1` * Publisher proof: Forgejo Actions run 8 passed validation and publish. * Deploy source landed in `coilyco-bridge/deploy` at `47c199b`. * Live proof: the `bluesky-mcp` Deployment is fully rolled out, the pull ExternalSecret is Ready, and the pod pulled the exact image. * Canonical Bluesky deploy source contains no standalone-registry fallback. Closing the publisher issue.

coilyco-ops closed this issue

2026-07-29 05:03:19 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/bluesky-mcp#5

No description provided.

Rows
Columns