coilyco-flight-deck/infrastructure

Watch

Restore dev-base publisher registry authentication #685

New issue

Open

opened 2026-07-29 05:21:59 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-29 05:21:59 +00:00

Owner

Outcome

Restore the AOS dev-base publisher by repairing the existing Forgejo REGISTRY_TOKEN live credential path, then return one verified publication result.

Evidence

agentic-os Actions runs 2350 and 2355 fail every completed language publisher at registry login.
Run 2355 dotnet evidence repeats Get "https://forgejo.coilysiren.me/v2/": unauthorized four times, then exits 1.
The same commit passed repo CI (2352), mirror (2353), promote (2354), and AOS CLI release (2351). This isolates the failure from the repository change.
.forgejo/workflows/dev-base-publish.yml supplies secrets.REGISTRY_TOKEN to the shared publish action.
Infrastructure owns the durable write credential at /forgejo/coilyco-ops/registry-token and the attended ward exec registry-token-provision operation. That operation verifies write:package, syncs the org Actions secret, and rotates only when explicitly passed --rotate.

Ops verification

Establish whether the current SSM token authenticates and has write:package by running the committed infrastructure registry-token-provision operation without rotation first.
If verification proves the token invalid, Ops chooses the explicit rotation path, syncs the org REGISTRY_TOKEN, and preserves the value entirely inside the established SSM and Forgejo flow.
Trigger one authorized dev-base publication after credential repair.
Return the language job results, full-image result, and published tag evidence.

The engineer must not rerun Actions or mutate the live registry to probe this failure. This issue is the live handoff from agentic-os#781.

## Outcome Restore the AOS dev-base publisher by repairing the existing Forgejo `REGISTRY_TOKEN` live credential path, then return one verified publication result. ## Evidence * agentic-os Actions runs 2350 and 2355 fail every completed language publisher at registry login. * Run 2355 dotnet evidence repeats `Get "https://forgejo.coilysiren.me/v2/": unauthorized` four times, then exits 1. * The same commit passed repo CI (2352), mirror (2353), promote (2354), and AOS CLI release (2351). This isolates the failure from the repository change. * `.forgejo/workflows/dev-base-publish.yml` supplies `secrets.REGISTRY_TOKEN` to the shared publish action. * Infrastructure owns the durable write credential at `/forgejo/coilyco-ops/registry-token` and the attended `ward exec registry-token-provision` operation. That operation verifies `write:package`, syncs the org Actions secret, and rotates only when explicitly passed `--rotate`. ## Ops verification 1. Establish whether the current SSM token authenticates and has `write:package` by running the committed infrastructure `registry-token-provision` operation without rotation first. 2. If verification proves the token invalid, Ops chooses the explicit rotation path, syncs the org `REGISTRY_TOKEN`, and preserves the value entirely inside the established SSM and Forgejo flow. 3. Trigger one authorized dev-base publication after credential repair. 4. Return the language job results, full-image result, and published tag evidence. The engineer must not rerun Actions or mutate the live registry to probe this failure. This issue is the live handoff from agentic-os#781.

coilyco-ops added the

autonomy

live-collab

priority

labels

2026-07-29 05:22:03 +00:00

coilyco-ops commented

2026-07-29 08:26:59 +00:00

Author

Owner

New live evidence from Galaxy Gen recovery:

Ops ran the repaired canonical registry-token-provision --rotate path. The script stored the replacement in SSM and proved write:package with a real upload session.
The script then stopped at the attended admin helper before updating the coilyco-flight-deck org Actions secret. The prior org-secret value remains valid and was not revoked.
Ops force-refreshed and restarted Galaxy Gen’s repository-scoped SSM-backed publisher runner. Galaxy Gen build-publish run 80 attempt 2 then logged Login Succeeded, pushed the immutable image, and passed remote manifest inspection.

This proves the replacement credential and SSM path. Issue 685 still owns the attended org Actions-secret sync and one dev-base publication verification.

New live evidence from Galaxy Gen recovery: * Ops ran the repaired canonical `registry-token-provision --rotate` path. The script stored the replacement in SSM and proved `write:package` with a real upload session. * The script then stopped at the attended admin helper before updating the `coilyco-flight-deck` org Actions secret. The prior org-secret value remains valid and was not revoked. * Ops force-refreshed and restarted Galaxy Gen’s repository-scoped SSM-backed publisher runner. Galaxy Gen build-publish run 80 attempt 2 then logged `Login Succeeded`, pushed the immutable image, and passed remote manifest inspection. This proves the replacement credential and SSM path. Issue 685 still owns the attended org Actions-secret sync and one dev-base publication verification.

coilyco-ops added the

role/sysadmin

label

2026-08-25 08:02:19 +00:00

coilyco-ops added this to the CD and rollout milestone

2026-08-29 06:10:13 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-flight-deck/infrastructure#685

No description provided.

Rows
Columns