coilyco-flight-deck/infrastructure

Watch

Restore deploy-runner package write authority for Forgejo OCI migration #654

New issue

Closed

opened 2026-07-27 03:29:07 +00:00 by coilyco-ops · 4 comments

coilyco-ops commented

2026-07-27 03:29:07 +00:00

Member

Observed failure

The first migrated application publisher reached the trusted deploy runner, logged in to Forgejo OCI, built the immutable website image, then Forgejo rejected the push with unauthorized: reqPackageAccess.

Failing run: https://forgejo.coilysiren.me/coilysiren/website/actions/runs/137

Intended image: forgejo.coilysiren.me/coilysiren/website:8466f5acf84b2f12e78157cf8530d174f76d8bf8

The repository publisher is locally proven. ward exec image-publish-check, tests, image build, image smoke, and the full pre-commit suite passed before commit 8466f5a landed. The failed run checked out that commit and completed the Docker build. The failure is therefore in live Forgejo package authorization, not the image source.

The failure path also showed that the host deploy runner has no python3 for the optional Telegram alert step. That secondary alert error did not cause the package rejection.

Operator action

Ops verifies that the deploy runner's /forgejo/coilyco-ops/registry-token resolves to a Forgejo identity with package-write authority for the coilysiren owner and every owner named by infrastructure#653. Ops must not reveal the token.
Ops keeps coilysiren/website private and corrects the package or owner authorization that returns reqPackageAccess.
Ops reruns website Actions run 137 exactly once after the authorization correction.
Ops returns the successful run URL plus remote manifest proof for the exact image above.
Ops records whether the deploy runner intentionally excludes Python so source owners can standardize a compatible failure-alert shape separately.

Expected evidence

The rerun succeeds without a second repository push.
docker manifest inspect forgejo.coilysiren.me/coilysiren/website:8466f5acf84b2f12e78157cf8530d174f76d8bf8 succeeds from an authorized read surface.
Forgejo records the package as private.
The package-write credential remains distinct from /forgejo/coilyco-ops/registry-read-token.

The engineer gathered read-only workflow evidence and did not rerun or mutate live CI/CD.

Parent: infrastructure#653
Authority: coilysiren/inbox#276

Codex, via engineer surface

## Observed failure The first migrated application publisher reached the trusted deploy runner, logged in to Forgejo OCI, built the immutable website image, then Forgejo rejected the push with `unauthorized: reqPackageAccess`. Failing run: https://forgejo.coilysiren.me/coilysiren/website/actions/runs/137 Intended image: `forgejo.coilysiren.me/coilysiren/website:8466f5acf84b2f12e78157cf8530d174f76d8bf8` The repository publisher is locally proven. `ward exec image-publish-check`, tests, image build, image smoke, and the full pre-commit suite passed before commit `8466f5a` landed. The failed run checked out that commit and completed the Docker build. The failure is therefore in live Forgejo package authorization, not the image source. The failure path also showed that the host deploy runner has no `python3` for the optional Telegram alert step. That secondary alert error did not cause the package rejection. ## Operator action 1. Ops verifies that the deploy runner's `/forgejo/coilyco-ops/registry-token` resolves to a Forgejo identity with package-write authority for the `coilysiren` owner and every owner named by infrastructure#653. Ops must not reveal the token. 2. Ops keeps `coilysiren/website` private and corrects the package or owner authorization that returns `reqPackageAccess`. 3. Ops reruns website Actions run 137 exactly once after the authorization correction. 4. Ops returns the successful run URL plus remote manifest proof for the exact image above. 5. Ops records whether the deploy runner intentionally excludes Python so source owners can standardize a compatible failure-alert shape separately. ## Expected evidence * The rerun succeeds without a second repository push. * `docker manifest inspect forgejo.coilysiren.me/coilysiren/website:8466f5acf84b2f12e78157cf8530d174f76d8bf8` succeeds from an authorized read surface. * Forgejo records the package as private. * The package-write credential remains distinct from `/forgejo/coilyco-ops/registry-read-token`. The engineer gathered read-only workflow evidence and did not rerun or mutate live CI/CD. Parent: infrastructure#653 Authority: https://forgejo.coilysiren.me/coilysiren/inbox/issues/276  Codex, via engineer surface

coilyco-ops added the

autonomy

live-collab

label

2026-07-27 03:29:07 +00:00

coilyco-ops referenced this issue from coilyco-gaming/factory-game-v3

2026-07-27 04:19:02 +00:00

Migrate factory-game-v3 image publishing to Forgejo OCI #36

coilyco-ops referenced this issue from coilyco-gaming/galaxy-gen

2026-07-27 04:27:33 +00:00

Migrate galaxy-gen build and publishing to Forgejo OCI #42

coilyco-ops referenced this issue from coilyco-flight-deck/bluesky-mcp

2026-07-27 04:44:45 +00:00

Migrate bluesky-mcp image publishing to Forgejo OCI #5

coilyco-ops commented

2026-07-27 05:35:32 +00:00

Author

Member

Repository preparation is ready for the authorization repair:

All source publishers target private Forgejo packages at full source SHAs.
Deploy branch issue-239-forgejo-oci at d7e3245 contains every exact consumer pin, read-only pull Secret, and the Playwright digest mirror.
Offline Kubernetes, Forgejo workflow, shell, repository-policy, and secret-scan checks pass.

The agent has not rerun publisher CI, pushed a probe commit, landed deploy main, or touched live workloads. Ops can use this issue to restore package write authority, rerun each intended publisher once, and return immutable-manifest plus private-visibility evidence before deploy#239 lands.

Repository preparation is ready for the authorization repair: * All source publishers target private Forgejo packages at full source SHAs. * Deploy branch `issue-239-forgejo-oci` at `d7e3245` contains every exact consumer pin, read-only pull Secret, and the Playwright digest mirror. * Offline Kubernetes, Forgejo workflow, shell, repository-policy, and secret-scan checks pass. The agent has not rerun publisher CI, pushed a probe commit, landed deploy main, or touched live workloads. Ops can use this issue to restore package write authority, rerun each intended publisher once, and return immutable-manifest plus private-visibility evidence before deploy#239 lands.

coilyco-ops added the

priority

label

2026-07-29 03:46:33 +00:00

coilyco-ops commented

2026-07-30 07:10:04 +00:00

Author

Member

Sirens Echo deploy-lane evidence for the existing Forgejo OCI authorization handoff.

coilyco-gaming/sirens-discord-ops run 41 published successfully from 1d8435ee57cc2146600d9287b6b80c39441682ee.
Run 42 passed its test job in 48 seconds, then publish-echo-image failed after two seconds for 9a7a3fbc46306018fd8cf4e9354dce9fb03e3b59.
The only source change between those commits is docs/sirens-echo-rollout.md.
The current publisher still targets forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops at the full source SHA with the runner-provided package-write token.
Offline image-publisher syntax, vet, tests, and the complete pre-commit suite all pass.
Forgejo exposes the failed task state but its guarded job-log endpoint returns 404, so Engineering cannot establish the first failing step from the API.

Operator action:

Open sirens-discord-ops Actions run 42 and record the first failing publish-echo-image step plus its complete error block here, with credentials redacted.
If the evidence is deploy-runner or package-authorization state, repair that state and rerun the failed publisher exactly once without another repository push.
Return the successful run URL and manifest proof for forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops:9a7a3fbc46306018fd8cf4e9354dce9fb03e3b59.
If the error points to tracked source, hand the exact error back to Engineering.

No speculative source change or CI rerun was made. The earlier test-job symptom remains separately tracked in coilyco-gaming/sirens-discord-ops#43.

Sirens Echo deploy-lane evidence for the existing Forgejo OCI authorization handoff. * coilyco-gaming/sirens-discord-ops run 41 published successfully from 1d8435ee57cc2146600d9287b6b80c39441682ee. * Run 42 passed its test job in 48 seconds, then publish-echo-image failed after two seconds for 9a7a3fbc46306018fd8cf4e9354dce9fb03e3b59. * The only source change between those commits is docs/sirens-echo-rollout.md. * The current publisher still targets forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops at the full source SHA with the runner-provided package-write token. * Offline image-publisher syntax, vet, tests, and the complete pre-commit suite all pass. * Forgejo exposes the failed task state but its guarded job-log endpoint returns 404, so Engineering cannot establish the first failing step from the API. Operator action: 1. Open sirens-discord-ops Actions run 42 and record the first failing publish-echo-image step plus its complete error block here, with credentials redacted. 2. If the evidence is deploy-runner or package-authorization state, repair that state and rerun the failed publisher exactly once without another repository push. 3. Return the successful run URL and manifest proof for forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops:9a7a3fbc46306018fd8cf4e9354dce9fb03e3b59. 4. If the error points to tracked source, hand the exact error back to Engineering. No speculative source change or CI rerun was made. The earlier test-job symptom remains separately tracked in coilyco-gaming/sirens-discord-ops#43.

coilyco-ops commented

2026-07-30 07:31:53 +00:00

Author

Member

Siren repository-publisher verification is complete.

Live before-state showed forgejo-runner-deploy-sirens-discord-ops-0 healthy on the exact-repository publisher base, with its ExternalSecret Ready and both the repository runner token and registry token mapped by secret reference.
Manual dispatch run 43 proved the test lane but skipped publishing by design because publish-echo-image accepts only main push events.
I pushed empty commit ede36763fa05396f96ae10152db8dbf6a981163b, with no file changes, to exercise the real production gate once.
Run 44 test task 20901 passed on the Gaming runner.
Run 44 publish-echo-image task 20904 passed on the scoped Siren publisher runner after 220 seconds.
The publisher script ends with docker manifest inspect against forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops:ede36763fa05396f96ae10152db8dbf6a981163b. Job success therefore proves the immutable current-main manifest exists.

This clears sirens-discord-ops from the OCI migration queue. Run 42 remains best classified as a rollout-boundary transient, not a source-pattern defect. Its exact first error is irretrievable because Forgejo job-log endpoints return 404 and the prior runner pod was replaced.

Successful run: https://forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops/actions/runs/44
Siren evidence: coilyco-gaming/sirens-discord-ops#43 (comment)

Infrastructure #654 remains open for the other owner publishers and fleet acceptance.

Siren repository-publisher verification is complete. * Live before-state showed forgejo-runner-deploy-sirens-discord-ops-0 healthy on the exact-repository publisher base, with its ExternalSecret Ready and both the repository runner token and registry token mapped by secret reference. * Manual dispatch run 43 proved the test lane but skipped publishing by design because publish-echo-image accepts only main push events. * I pushed empty commit ede36763fa05396f96ae10152db8dbf6a981163b, with no file changes, to exercise the real production gate once. * Run 44 test task 20901 passed on the Gaming runner. * Run 44 publish-echo-image task 20904 passed on the scoped Siren publisher runner after 220 seconds. * The publisher script ends with docker manifest inspect against forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops:ede36763fa05396f96ae10152db8dbf6a981163b. Job success therefore proves the immutable current-main manifest exists. This clears sirens-discord-ops from the OCI migration queue. Run 42 remains best classified as a rollout-boundary transient, not a source-pattern defect. Its exact first error is irretrievable because Forgejo job-log endpoints return 404 and the prior runner pod was replaced. Successful run: https://forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops/actions/runs/44 Siren evidence: https://forgejo.coilysiren.me/coilyco-gaming/sirens-discord-ops/issues/43#issuecomment-44513 Infrastructure #654 remains open for the other owner publishers and fleet acceptance.

coilyco-ops commented

2026-07-30 07:53:07 +00:00

Author

Member

The deploy-runner package-write authorization repair is complete.

Website and the migrated source publishers now publish private Forgejo OCI images successfully.
Sirens Discord Ops run 44 passed its real main-push publisher and proved its immutable manifest.
Steam run 31 and Ward MCP run 53 are current successful publisher examples across coilyco-gaming and coilyco-flight-deck.
Node Stats has also published its Forgejo OCI image. Its remaining work is consumer cutover, tracked by node-stats-mcp#14 and infrastructure#653, not package-write authorization.
Eco primary image publication succeeds. Its failing mod-package jobs are tracked separately in eco-app#167.

This closes the authorization incident. Remaining registry retirement work stays under infrastructure#653.

The deploy-runner package-write authorization repair is complete. * Website and the migrated source publishers now publish private Forgejo OCI images successfully. * Sirens Discord Ops run 44 passed its real main-push publisher and proved its immutable manifest. * Steam run 31 and Ward MCP run 53 are current successful publisher examples across coilyco-gaming and coilyco-flight-deck. * Node Stats has also published its Forgejo OCI image. Its remaining work is consumer cutover, tracked by node-stats-mcp#14 and infrastructure#653, not package-write authorization. * Eco primary image publication succeeds. Its failing mod-package jobs are tracked separately in eco-app#167. This closes the authorization incident. Remaining registry retirement work stays under infrastructure#653.

coilyco-ops closed this issue

2026-07-30 07:53:13 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#654

No description provided.

Rows
Columns