o2r packaging: shared build-publish-deploy pipeline (pkg + chart + container) to homelab registry #50

New issue

Closed

opened 2026-06-02 23:11:45 +00:00 by coilysiren · 1 comment

coilysiren commented

2026-06-02 23:11:45 +00:00

Owner

Part of #45 (per-layer isolated-unit packaging).

Cross-cutting: one publish pipeline covering all three artifact types for every layer, from this repo. Generalizes the pattern core (#45 child) proves first.

Scope

.forgejo/workflows/build-publish-deploy.yml following the documented homelab pattern (infrastructure/docs/k3s-deploy-notes.md §11):
- Container: build each layer's image on the Forgejo runner (kai-desktop-tower-wsl DinD, --insecure-registry=192.168.0.194:30500), push 192.168.0.194:30500/<name-dashed>:<git-sha>.
- Helm: package each */chart/ and publish (chart registry / OCI push to the same registry, or a packaged-chart artifact - decide here).
- Python: publish each member (core, channels, arize_phoenix, tempo_grafana) - target registry TBD (PyPI vs a private index).
- Deploy: optional kubectl set image per app namespace via a scoped deployer ServiceAccount + kubeconfig secret.
Matrix over the four layers so each is independently built/published.
Only rebuild/publish layers whose paths changed (path filters), so an isolated unit ships on its own.

Acceptance

A push to main builds, pushes, and (optionally) rolls out changed layers independently.
Per-layer deploy creds scoped to that layer's namespace.

Open decisions

Python publish target (PyPI vs private index).
Helm distribution mechanism (OCI in the same registry vs separate).

Part of #45 (per-layer isolated-unit packaging). **Cross-cutting:** one publish pipeline covering all three artifact types for every layer, from this repo. Generalizes the pattern core (#45 child) proves first. ### Scope - `.forgejo/workflows/build-publish-deploy.yml` following the documented homelab pattern (`infrastructure/docs/k3s-deploy-notes.md` §11): - **Container:** build each layer's image on the Forgejo runner (kai-desktop-tower-wsl DinD, `--insecure-registry=192.168.0.194:30500`), push `192.168.0.194:30500/<name-dashed>:<git-sha>`. - **Helm:** package each `*/chart/` and publish (chart registry / OCI push to the same registry, or a packaged-chart artifact - decide here). - **Python:** publish each member (`core`, `channels`, `arize_phoenix`, `tempo_grafana`) - target registry TBD (PyPI vs a private index). - **Deploy:** optional `kubectl set image` per app namespace via a scoped `deployer` ServiceAccount + kubeconfig secret. - Matrix over the four layers so each is independently built/published. - Only rebuild/publish layers whose paths changed (path filters), so an isolated unit ships on its own. ### Acceptance - A push to main builds, pushes, and (optionally) rolls out changed layers independently. - Per-layer deploy creds scoped to that layer's namespace. ### Open decisions - Python publish target (PyPI vs private index). - Helm distribution mechanism (OCI in the same registry vs separate).

coilysiren referenced this issue

2026-06-02 23:12:02 +00:00

Arch pivot: every o2r layer ships as an isolated unit (pkg + chart + container) published from this repo #45

coilysiren referenced this issue

2026-06-02 23:40:18 +00:00

Arch pivot: every o2r layer ships as an isolated unit (pkg + chart + container) published from this repo #45

coilysiren added the

label

2026-06-04 08:16:40 +00:00

coilysiren commented

2026-06-17 08:23:45 +00:00

Author

Owner

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: burndown-2026-06.

Backlog burndown 2026-06-17: closing low-priority (P3/P4) to bring the open count to a manageable level. Nothing lost — reopen if this resurfaces. Batch tag: `burndown-2026-06`.

coilysiren

2026-06-17 08:23:45 +00:00