Fix mod publishers invoking Ward outside the repository

coilyco-ops commented

2026-07-29 00:57:58 +00:00

Member

Failure

Forgejo Actions run 143 proved the refreshed repository-scoped runner credential works. The build-image job authenticated, published, and completed successfully.

All four downstream mod publishers then failed after extracting their packages into temporary directories. The first failure records:

ward: no .ward/ward.yaml or .coily/coily.yaml reachable from cwd

The same four jobs completed successfully before the current workflow shape, so this is a repository execution-boundary defect rather than a runner or registry failure.

Evidence: https://forgejo.coilysiren.me/coilyco-gaming/eco-app/actions/runs/143

Outcome

Keep Ward invoked from the repository context while passing the extracted package path explicitly. Do not copy or reinterpret .ward/ward.yaml into the temporary package directory.

Acceptance

ward exec test, lint, and smoke remain green.
build-image publishes the immutable source-SHA image.
All four mod publishers authenticate, extract their package, run the owning Ward verb from repository context, and publish successfully.
The successful run provides the closing verification for coilyco-flight-deck/infrastructure#675 and eco-app#166.

## Failure Forgejo Actions run 143 proved the refreshed repository-scoped runner credential works. The `build-image` job authenticated, published, and completed successfully. All four downstream mod publishers then failed after extracting their packages into temporary directories. The first failure records: `ward: no .ward/ward.yaml or .coily/coily.yaml reachable from cwd` The same four jobs completed successfully before the current workflow shape, so this is a repository execution-boundary defect rather than a runner or registry failure. Evidence: https://forgejo.coilysiren.me/coilyco-gaming/eco-app/actions/runs/143 ## Outcome Keep Ward invoked from the repository context while passing the extracted package path explicitly. Do not copy or reinterpret `.ward/ward.yaml` into the temporary package directory. ## Acceptance * `ward exec test`, lint, and smoke remain green. * `build-image` publishes the immutable source-SHA image. * All four mod publishers authenticate, extract their package, run the owning Ward verb from repository context, and publish successfully. * The successful run provides the closing verification for coilyco-flight-deck/infrastructure#675 and eco-app#166.

coilyco-ops referenced this issue from coilyco-flight-deck/infrastructure

2026-07-29 00:58:21 +00:00

Restore repository-scoped image publishers after runner migration #675

coilyco-ops added the

labels

2026-07-29 03:47:49 +00:00

coilyco-ops commented

2026-07-30 07:31:29 +00:00

Author

Member

Checkpoint: commit 2962c7781b landed on main. Run 146 proves test, frontend, and build-image successful, including the C# mod build and immutable source-SHA image. All four publish jobs then failed after 6 to 15 seconds. The guarded Forgejo job and log endpoints return 404 on this server, and no authenticated browser surface is connected, so the first stderr line remains the live verification wall. Operator action: open run 146, select any publish-* job, and paste the first failing command plus stderr from Publish immutable mod package here. No rerun is needed. Keeping this interactive issue open, with no second probe push.

Checkpoint: commit 2962c7781be3cd7016771e5fef4e9e9d1ace69d6 landed on main. Run 146 proves test, frontend, and build-image successful, including the C# mod build and immutable source-SHA image. All four publish jobs then failed after 6 to 15 seconds. The guarded Forgejo job and log endpoints return 404 on this server, and no authenticated browser surface is connected, so the first stderr line remains the live verification wall. Operator action: open run 146, select any publish-* job, and paste the first failing command plus stderr from Publish immutable mod package here. No rerun is needed. Keeping this interactive issue open, with no second probe push.

coilyco-ops commented

2026-07-30 07:50:21 +00:00

Author

Member

Root-cause checkpoint: the operator-provided run 146 log proves Ward reached /workspace and attempted the generic-package PUT, which returned HTTP 403 at the internal Forgejo service URL. Commit ecaa95a reused the runner's current write:package REGISTRY_TOKEN, but run 147 still passed test, frontend, and build-image while all four publisher jobs failed. Static evidence identifies the remaining boundary: publish-mod-from-image.sh forwarded FORGEJO_EGRESS_PROXY as global HTTP_PROXY and HTTPS_PROXY, while infrastructure's proxy contract accepts only allowlisted HTTPS CONNECT traffic and explicitly requires internal Forgejo, registry, and cluster traffic to remain direct. Branch fix/mod-publisher-direct-forgejo at commit 3093efe removes the proxy variables from the package container, adds a regression assertion that internal Forgejo traffic stays direct, and updates the package contract. Focused publisher validation, full pre-commit, 561 tests, and smoke all pass. One attended Ops action remains: land commit 3093efe on main and verify one build-publish run. If all four publishers pass, close this issue and use that run as closing evidence for eco-app#166 and infrastructure#675.

Root-cause checkpoint: the operator-provided run 146 log proves Ward reached /workspace and attempted the generic-package PUT, which returned HTTP 403 at the internal Forgejo service URL. Commit ecaa95a reused the runner's current write:package REGISTRY_TOKEN, but run 147 still passed test, frontend, and build-image while all four publisher jobs failed. Static evidence identifies the remaining boundary: publish-mod-from-image.sh forwarded FORGEJO_EGRESS_PROXY as global HTTP_PROXY and HTTPS_PROXY, while infrastructure's proxy contract accepts only allowlisted HTTPS CONNECT traffic and explicitly requires internal Forgejo, registry, and cluster traffic to remain direct. Branch fix/mod-publisher-direct-forgejo at commit 3093efe removes the proxy variables from the package container, adds a regression assertion that internal Forgejo traffic stays direct, and updates the package contract. Focused publisher validation, full pre-commit, 561 tests, and smoke all pass. One attended Ops action remains: land commit 3093efe on main and verify one build-publish run. If all four publishers pass, close this issue and use that run as closing evidence for eco-app#166 and infrastructure#675.

coilyco-ops commented

2026-07-30 08:19:48 +00:00

Author

Member

Resolved on canonical main by commit 3093efe893. Forgejo Actions run 148 completed successfully at that exact SHA.

test: success
frontend: success
build-image: success
publish-eco-jobs-tracker: success
publish-eco-replay: success
publish-eco-store-exporter: success
publish-eco-telemetry: success

The publisher now runs Ward from repository context, reuses the trusted package credential, and keeps internal Forgejo package traffic off the egress proxy. Closing with full acceptance evidence: https://forgejo.coilysiren.me/coilyco-gaming/eco-app/actions/runs/148

Resolved on canonical main by commit 3093efe89381cca84b6b04d6e351f1509a68e712. Forgejo Actions run 148 completed successfully at that exact SHA. * test: success * frontend: success * build-image: success * publish-eco-jobs-tracker: success * publish-eco-replay: success * publish-eco-store-exporter: success * publish-eco-telemetry: success The publisher now runs Ward from repository context, reuses the trusted package credential, and keeps internal Forgejo package traffic off the egress proxy. Closing with full acceptance evidence: https://forgejo.coilysiren.me/coilyco-gaming/eco-app/actions/runs/148

coilyco-ops closed this issue

2026-07-30 08:19:52 +00:00

Rows
Columns

Fix mod publishers invoking Ward outside the repository #167

Failure

Outcome

Acceptance