Migrate factory-game-v3 image publishing to Forgejo OCI #36

New issue

Closed

opened 2026-07-27 02:41:30 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-27 02:41:30 +00:00

Member

Outcome

Publish factory-game-v3 to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner.

Program authority: coilysiren/inbox#276

Registry inventory: coilyco-flight-deck/infrastructure#653

Consumer rollout: coilyco-bridge/deploy#239

Target

forgejo.coilysiren.me/coilyco-gaming/factory-game-v3:<immutable-source-tag>

Scope

Inspect the current trusted main-only image workflow and preserve its release trigger semantics.
Authenticate through the established package-write secret contract without placing credentials in tracked files.
Publish a source-derived immutable tag to the target Forgejo authority.
Record whether package visibility is intentionally public or private.
Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository.
Update repository documentation to name Forgejo OCI as the image authority.
Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover.
Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build.

Acceptance

A trusted main workflow publishes the target image to Forgejo OCI.
The issue records proof that the immutable manifest exists.
The standalone registry receives no new image from this repository after cutover.
Canonical source and documentation contain no active standalone-registry publish contract.
Repository validation passes.
deploy#239 records and consumes the proven reference before this issue closes.

Codex, via advisor surface

## Outcome Publish `factory-game-v3` to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner. Program authority: https://forgejo.coilysiren.me/coilysiren/inbox/issues/276 Registry inventory: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/653 Consumer rollout: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/239 ## Target `forgejo.coilysiren.me/coilyco-gaming/factory-game-v3:<immutable-source-tag>` ## Scope * Inspect the current trusted main-only image workflow and preserve its release trigger semantics. * Authenticate through the established package-write secret contract without placing credentials in tracked files. * Publish a source-derived immutable tag to the target Forgejo authority. * Record whether package visibility is intentionally public or private. * Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository. * Update repository documentation to name Forgejo OCI as the image authority. * Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover. * Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build. ## Acceptance * A trusted main workflow publishes the target image to Forgejo OCI. * The issue records proof that the immutable manifest exists. * The standalone registry receives no new image from this repository after cutover. * Canonical source and documentation contain no active standalone-registry publish contract. * Repository validation passes. * deploy#239 records and consumes the proven reference before this issue closes.  Codex, via advisor surface

coilyco-ops commented

2026-07-27 04:19:02 +00:00

Author

Member

Source publisher landed on main at a5f6cba.

Forgejo Actions now uses the trusted deploy runner and publishes forgejo.coilysiren.me/coilyco-gaming/factory-game-v3:<full-source-sha>.
The publisher logs in with runner-provided REGISTRY_TOKEN, uses an isolated Docker config, pushes one immutable tag, and inspects the remote manifest.
The deploy repo retains rollout ownership and a separate read-only forgejo-registry pull credential.
Local proof passed: focused publisher ShellCheck, Actionlint, all non-host-defect pre-commit hooks, 28 Rust tests, and the deployable Docker image build.
The Windows host still exposes the known TruffleHog /dev/fd/63 defect and CRLF checkout artifacts in two untouched legacy scripts. The focused new publisher hook passed independently.

Remote manifest proof and deploy consumption remain blocked by infrastructure#654. This issue stays open until Ops restores package write authority and deploy#239 consumes the proved manifest.

Source publisher landed on `main` at `a5f6cba`. * Forgejo Actions now uses the trusted `deploy` runner and publishes `forgejo.coilysiren.me/coilyco-gaming/factory-game-v3:<full-source-sha>`. * The publisher logs in with runner-provided `REGISTRY_TOKEN`, uses an isolated Docker config, pushes one immutable tag, and inspects the remote manifest. * The deploy repo retains rollout ownership and a separate read-only `forgejo-registry` pull credential. * Local proof passed: focused publisher ShellCheck, Actionlint, all non-host-defect pre-commit hooks, 28 Rust tests, and the deployable Docker image build. * The Windows host still exposes the known TruffleHog `/dev/fd/63` defect and CRLF checkout artifacts in two untouched legacy scripts. The focused new publisher hook passed independently. Remote manifest proof and deploy consumption remain blocked by [infrastructure#654](https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/654). This issue stays open until Ops restores package write authority and deploy#239 consumes the proved manifest.

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:48:03 +00:00

coilyco-ops commented

2026-07-29 05:03:19 +00:00

Author

Member

Ops completed the consumer checkpoint.

Immutable image: forgejo.coilysiren.me/coilyco-gaming/factory-game-v3:a5f6cba53eab81a3dd1588ca132a951b7900813e
Publisher proof: Forgejo Actions publish run 42 succeeded.
Deploy source landed in coilyco-bridge/deploy at 47c199b, with native-runner portability follow-up 843575d.
Live proof: the factory-game Deployment is fully rolled out, the pull ExternalSecret is Ready, and the pod runs the exact image.
Canonical Factory Game deploy source contains no standalone-registry fallback.

Closing the publisher issue.

Ops completed the consumer checkpoint. * Immutable image: `forgejo.coilysiren.me/coilyco-gaming/factory-game-v3:a5f6cba53eab81a3dd1588ca132a951b7900813e` * Publisher proof: Forgejo Actions publish run 42 succeeded. * Deploy source landed in `coilyco-bridge/deploy` at `47c199b`, with native-runner portability follow-up `843575d`. * Live proof: the `factory-game` Deployment is fully rolled out, the pull ExternalSecret is Ready, and the pod runs the exact image. * Canonical Factory Game deploy source contains no standalone-registry fallback. Closing the publisher issue.

coilyco-ops closed this issue

2026-07-29 05:03:19 +00:00