Migrate node-stats-mcp image publishing to Forgejo OCI #14

New issue

Closed

opened 2026-07-27 02:41:31 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-27 02:41:31 +00:00

Member

Outcome

Publish node-stats-mcp to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner.

Program authority: coilysiren/inbox#276

Registry inventory: coilyco-flight-deck/infrastructure#653

Consumer rollout: coilyco-bridge/deploy#239

Target

forgejo.coilysiren.me/coilyco-flight-deck/node-stats-mcp:<immutable-source-tag>

Scope

Inspect the current trusted main-only image workflow and preserve its release trigger semantics.
Authenticate through the established package-write secret contract without placing credentials in tracked files.
Publish a source-derived immutable tag to the target Forgejo authority.
Record whether package visibility is intentionally public or private.
Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository.
Update repository documentation to name Forgejo OCI as the image authority.
Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover.
Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build.

Acceptance

A trusted main workflow publishes the target image to Forgejo OCI.
The issue records proof that the immutable manifest exists.
The standalone registry receives no new image from this repository after cutover.
Canonical source and documentation contain no active standalone-registry publish contract.
Repository validation passes.
deploy#239 records and consumes the proven reference before this issue closes.

Codex, via advisor surface

## Outcome Publish `node-stats-mcp` to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner. Program authority: https://forgejo.coilysiren.me/coilysiren/inbox/issues/276 Registry inventory: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/653 Consumer rollout: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/239 ## Target `forgejo.coilysiren.me/coilyco-flight-deck/node-stats-mcp:<immutable-source-tag>` ## Scope * Inspect the current trusted main-only image workflow and preserve its release trigger semantics. * Authenticate through the established package-write secret contract without placing credentials in tracked files. * Publish a source-derived immutable tag to the target Forgejo authority. * Record whether package visibility is intentionally public or private. * Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository. * Update repository documentation to name Forgejo OCI as the image authority. * Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover. * Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build. ## Acceptance * A trusted main workflow publishes the target image to Forgejo OCI. * The issue records proof that the immutable manifest exists. * The standalone registry receives no new image from this repository after cutover. * Canonical source and documentation contain no active standalone-registry publish contract. * Repository validation passes. * deploy#239 records and consumes the proven reference before this issue closes.  Codex, via advisor surface

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:46:39 +00:00

coilyco-ops commented

2026-07-30 08:01:03 +00:00

Author

Member

Source publication is complete and the deploy cutover is prepared.

Node Stats main source f44c9d9b23 published successfully in run 28, including remote manifest verification.
kai-server and ser8 still consume the legacy f243623b95 image today.
Deploy branch ops/node-stats-oci-20260730 at a2008fd pins the private Forgejo image, adds the package-read pull Secret on kai-server, follows the established imperative pull-Secret pattern on ser8, and removes the Node Stats legacy exception.
Both Node Stats render verbs, Ward doctor, commit hooks, YAML validation, shellcheck, Forgejo Actions validation, documentation checks, and secret scanning pass.
kai-server briefly entered DiskPressure and evicted pods during this preparation. The taint has cleared and Node Stats is back to 1/1, but kubelet reports repeated image garbage-collection failures. The branch remains off main so CD does not replace the healthy legacy pod during unstable storage conditions.

Branch: https://forgejo.coilysiren.me/coilyco-bridge/deploy/compare/main...ops/node-stats-oci-20260730

Next operator action is an explicit main landing once kai-server storage is accepted as stable, followed by the manual ser8 rollout and MCP smoke.

Source publication is complete and the deploy cutover is prepared. * Node Stats main source f44c9d9b23b0aad140c3f26de1689eeb5eabbd5b published successfully in run 28, including remote manifest verification. * kai-server and ser8 still consume the legacy f243623b95a1ffbc41c6ad19fa0b08fd135bb44c image today. * Deploy branch ops/node-stats-oci-20260730 at a2008fd pins the private Forgejo image, adds the package-read pull Secret on kai-server, follows the established imperative pull-Secret pattern on ser8, and removes the Node Stats legacy exception. * Both Node Stats render verbs, Ward doctor, commit hooks, YAML validation, shellcheck, Forgejo Actions validation, documentation checks, and secret scanning pass. * kai-server briefly entered DiskPressure and evicted pods during this preparation. The taint has cleared and Node Stats is back to 1/1, but kubelet reports repeated image garbage-collection failures. The branch remains off main so CD does not replace the healthy legacy pod during unstable storage conditions. Branch: https://forgejo.coilysiren.me/coilyco-bridge/deploy/compare/main...ops/node-stats-oci-20260730 Next operator action is an explicit main landing once kai-server storage is accepted as stable, followed by the manual ser8 rollout and MCP smoke.

coilyco-ops referenced this issue from a commit

2026-07-30 08:15:25 +00:00

fix(oci): install locked runtime dependencies (#14)

coilyco-ops referenced this issue from a commit

2026-07-30 08:21:30 +00:00

fix(oci): include lockfile in build context (#14)

coilyco-ops commented

2026-07-30 08:27:31 +00:00

Author

Member

OCI cutover is complete.

Source main now publishes the locked runtime image at forgejo.coilysiren.me/coilyco-flight-deck/node-stats-mcp:9e486430f44f35edc39277e6b3c9d956c5abf415.
Source run 30 passed tests, built the image from uv.lock, passed the production-server import smoke before push, and verified the remote manifest: https://forgejo.coilysiren.me/coilyco-flight-deck/node-stats-mcp/actions/runs/30
The first published cutover image exposed a real artifact defect because its Docker build resolved dependencies outside the lockfile. Commits 2d157fb and 9e48643 made the image use the CI-tested lock and added the pre-push import smoke. No legacy-registry fallback was restored.
Deploy main at 1b119f5309607f54146030734d11af7f3f07cf08 pins that exact private Forgejo image and supplies the package-read pull credential separately from the publisher credential.
Deploy validation passed: https://forgejo.coilysiren.me/coilyco-bridge/deploy/actions/runs/3201
kai-server rollout 3202 passed: https://forgejo.coilysiren.me/coilyco-bridge/deploy/actions/runs/3202
kai-server is 1/1, its current pod is 2/2 Ready with zero restarts, the registry ExternalSecret is Ready, and both containers run the exact 9e48643 image. The MCP filesystem-pressure call succeeds.
ser8 rolled through ward exec rollout-node-stats-mcp-ser8; its MCP initialize smoke passed. Both containers are Ready with zero restarts on the same exact image, and filesystem pressure is healthy at 12.1%.

This closes the protected Node Stats exception. The standalone registry retirement and rollback-data decision remain tracked in infrastructure#653.

OCI cutover is complete. * Source `main` now publishes the locked runtime image at `forgejo.coilysiren.me/coilyco-flight-deck/node-stats-mcp:9e486430f44f35edc39277e6b3c9d956c5abf415`. * Source run 30 passed tests, built the image from `uv.lock`, passed the production-server import smoke before push, and verified the remote manifest: https://forgejo.coilysiren.me/coilyco-flight-deck/node-stats-mcp/actions/runs/30 * The first published cutover image exposed a real artifact defect because its Docker build resolved dependencies outside the lockfile. Commits `2d157fb` and `9e48643` made the image use the CI-tested lock and added the pre-push import smoke. No legacy-registry fallback was restored. * Deploy `main` at `1b119f5309607f54146030734d11af7f3f07cf08` pins that exact private Forgejo image and supplies the package-read pull credential separately from the publisher credential. * Deploy validation passed: https://forgejo.coilysiren.me/coilyco-bridge/deploy/actions/runs/3201 * kai-server rollout 3202 passed: https://forgejo.coilysiren.me/coilyco-bridge/deploy/actions/runs/3202 * kai-server is 1/1, its current pod is 2/2 Ready with zero restarts, the registry ExternalSecret is Ready, and both containers run the exact `9e48643` image. The MCP filesystem-pressure call succeeds. * ser8 rolled through `ward exec rollout-node-stats-mcp-ser8`; its MCP initialize smoke passed. Both containers are Ready with zero restarts on the same exact image, and filesystem pressure is healthy at 12.1%. This closes the protected Node Stats exception. The standalone registry retirement and rollback-data decision remain tracked in infrastructure#653.

coilyco-ops closed this issue

2026-07-30 08:27:36 +00:00

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-07-30 08:27:59 +00:00

Migrate the standalone k3s image registry inventory to Forgejo OCI #653