Deprovision the unused tap-writer Forgejo runner #573

New issue

Open

opened 2026-07-22 07:07:00 +00:00 by coilyco-ops · 0 comments

coilyco-ops commented

2026-07-22 07:07:00 +00:00

Owner

The dedicated tap-writer Forgejo Actions lane is no longer used. Ward now bumps the Homebrew tap from its ordinary runs-on: docker release job with the explicit TAP_WRITE_TOKEN secret. A workspace-wide search found no runs-on: tap-writer consumer.

Acceptance criteria:

Remove deploy/forgejo-runner-tap-writer.yml and scripts/provision-tap-bump-token.sh.
Remove current-feature, token-inventory, runner-TTL, and troubleshooting references. Preserve clearly historical changelog references.
Delete the live forgejo-runner-tap-writer StatefulSet, its ExternalSecret and generated Secret, and the retained data-forgejo-runner-tap-writer-0 PVC.
Remove the stale runner registration from Forgejo after the pod is gone.
Revoke the tap-bump Forgejo PAT and delete /forgejo/tap-bump-token from SSM without exposing its value.
Verify no workflow still selects the tap-writer label and the normal ward release tap bump remains green.
Run pre-commit run --all-files, commit with closes #<issue>, and push canonical main.

Live Kubernetes, Forgejo admin, and SSM deletion steps require an attended operator-capable run.

The dedicated `tap-writer` Forgejo Actions lane is no longer used. Ward now bumps the Homebrew tap from its ordinary `runs-on: docker` release job with the explicit `TAP_WRITE_TOKEN` secret. A workspace-wide search found no `runs-on: tap-writer` consumer. Acceptance criteria: * Remove `deploy/forgejo-runner-tap-writer.yml` and `scripts/provision-tap-bump-token.sh`. * Remove current-feature, token-inventory, runner-TTL, and troubleshooting references. Preserve clearly historical changelog references. * Delete the live `forgejo-runner-tap-writer` StatefulSet, its ExternalSecret and generated Secret, and the retained `data-forgejo-runner-tap-writer-0` PVC. * Remove the stale runner registration from Forgejo after the pod is gone. * Revoke the `tap-bump` Forgejo PAT and delete `/forgejo/tap-bump-token` from SSM without exposing its value. * Verify no workflow still selects the `tap-writer` label and the normal ward release tap bump remains green. * Run `pre-commit run --all-files`, commit with `closes #<issue>`, and push canonical main. Live Kubernetes, Forgejo admin, and SSM deletion steps require an attended operator-capable run.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 03:46:20 +00:00

coilyco-ops added the

role/sysadmin

label

2026-08-25 08:02:27 +00:00

coilyco-ops added this to the Forgejo runners milestone

2026-08-29 05:41:06 +00:00