Disable GitHub-side publishing across active repositories #676

New issue

Closed

opened 2026-07-28 23:19:20 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-28 23:19:20 +00:00

Member

Goal: GitHub remains a downstream mirror and does not independently build, publish, deploy, create Releases, or mutate tags.

Done when:

every active repository GitHub workflow is inventoried for tag and release triggers, write permissions, release/package/image publication, and deployment
every armed GitHub publishing path is removed or disarmed and landed on both forges
GitHub Actions defaults to read-only workflow permissions wherever Actions remains enabled
a final fleet audit finds zero GitHub publishing paths

Historical tag migration safety:

GitHub Actions stays disabled during the one-time historical tag push because tagged commits may contain retired workflow files
Actions may return only after the tag import and a current-source publishing audit pass

Non-goals:

do not disable non-publishing validation solely because it runs on GitHub
do not change Forgejo publication
do not create, delete, move, or mirror tags, Releases, or release assets in this issue
do not delete existing GitHub packages, deployments, or Pages output

Goal: GitHub remains a downstream mirror and does not independently build, publish, deploy, create Releases, or mutate tags. Done when: * every active repository GitHub workflow is inventoried for tag and release triggers, write permissions, release/package/image publication, and deployment * every armed GitHub publishing path is removed or disarmed and landed on both forges * GitHub Actions defaults to read-only workflow permissions wherever Actions remains enabled * a final fleet audit finds zero GitHub publishing paths Historical tag migration safety: * GitHub Actions stays disabled during the one-time historical tag push because tagged commits may contain retired workflow files * Actions may return only after the tag import and a current-source publishing audit pass Non-goals: * do not disable non-publishing validation solely because it runs on GitHub * do not change Forgejo publication * do not create, delete, move, or mirror tags, Releases, or release assets in this issue * do not delete existing GitHub packages, deployments, or Pages output

coilyco-ops referenced this issue from coilyco-flight-deck/umbra

2026-07-28 23:23:50 +00:00

Stop GitHub-side documentation publishing #265

coilyco-ops commented

2026-07-28 23:27:31 +00:00

Author

Member

Fleet verification complete. All 32 active GitHub repositories have Actions disabled, default workflow permissions set to read, and Actions PR approval disabled. A live scan found 11 current workflow files and zero tag, Release, package, image, Pages, or deployment publishers. Three workflows request contents: write only for Dependabot merge or website data refresh, and all are inert behind the repository-wide Actions fence. cli-guard commit e76edeb5352bf0aad4d4b95ed93602056a461a7f removed the only current publisher from Forgejo and GitHub main. Actions must stay disabled until the historical tag import completes, then non-publishing validation may return.

coilyco-ops closed this issue

2026-07-28 23:27:34 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#676

No description provided.

Rows
Columns