coilyco-gaming/galaxy-gen

Watch

Migrate galaxy-gen build and publishing to Forgejo OCI #42

New issue

Closed

opened 2026-07-27 02:41:30 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-27 02:41:30 +00:00

Member

Outcome

Publish galaxy-gen to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner.

Program authority: coilysiren/inbox#276

Registry inventory: coilyco-flight-deck/infrastructure#653

Consumer rollout: coilyco-bridge/deploy#239

Target

forgejo.coilysiren.me/coilyco-gaming/galaxy-gen:<immutable-source-tag>

The current deploy repository builds this image from the source. This issue moves or establishes trusted publishing in the source repository so build ownership matches source ownership. The implementation coordinates the cutover with deploy#239.

Scope

Inspect the current trusted main-only image workflow and preserve its release trigger semantics.
Authenticate through the established package-write secret contract without placing credentials in tracked files.
Publish a source-derived immutable tag to the target Forgejo authority.
Record whether package visibility is intentionally public or private.
Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository.
Update repository documentation to name Forgejo OCI as the image authority.
Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover.
Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build.

Acceptance

A trusted main workflow publishes the target image to Forgejo OCI.
The issue records proof that the immutable manifest exists.
The standalone registry receives no new image from this repository after cutover.
Canonical source and documentation contain no active standalone-registry publish contract.
Repository validation passes.
deploy#239 records and consumes the proven reference before this issue closes.

Codex, via advisor surface

## Outcome Publish `galaxy-gen` to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner. Program authority: https://forgejo.coilysiren.me/coilysiren/inbox/issues/276 Registry inventory: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/653 Consumer rollout: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/239 ## Target `forgejo.coilysiren.me/coilyco-gaming/galaxy-gen:<immutable-source-tag>` The current deploy repository builds this image from the source. This issue moves or establishes trusted publishing in the source repository so build ownership matches source ownership. The implementation coordinates the cutover with deploy#239. ## Scope * Inspect the current trusted main-only image workflow and preserve its release trigger semantics. * Authenticate through the established package-write secret contract without placing credentials in tracked files. * Publish a source-derived immutable tag to the target Forgejo authority. * Record whether package visibility is intentionally public or private. * Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository. * Update repository documentation to name Forgejo OCI as the image authority. * Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover. * Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build. ## Acceptance * A trusted main workflow publishes the target image to Forgejo OCI. * The issue records proof that the immutable manifest exists. * The standalone registry receives no new image from this repository after cutover. * Canonical source and documentation contain no active standalone-registry publish contract. * Repository validation passes. * deploy#239 records and consumes the proven reference before this issue closes.  Codex, via advisor surface

coilyco-ops commented

2026-07-27 04:27:33 +00:00

Author

Member

Source publisher landed on main at bb5023c.

The existing Rust CI job stays first, and the trusted deploy job now publishes forgejo.coilysiren.me/coilyco-gaming/galaxy-gen:<full-source-sha> only after tests pass.
The private single-architecture publisher uses runner-provided REGISTRY_TOKEN, an isolated Docker config, one immutable tag, and a remote manifest inspection.
Source documentation now assigns build ownership here. The deploy repo retains the read-only pull credential, chart, rollout, and ingress.
Local proof passed: publisher syntax check, repo-local secret scan, 55 Rust tests, 24 Playwright browser tests, and the exact Linux Docker image build. The WebGPU-only test skipped because the host exposed no adapter.
The unrelated managed-baseline debt remains tracked in #40. The other baseline hooks passed when only that known doc/comment debt and the Windows /dev/fd/63 hook were skipped.

Remote manifest proof and deploy consumption remain blocked by infrastructure#654. This issue stays open until Ops restores package write authority and deploy#239 consumes the proved manifest.

Source publisher landed on `main` at `bb5023c`. * The existing Rust CI job stays first, and the trusted `deploy` job now publishes `forgejo.coilysiren.me/coilyco-gaming/galaxy-gen:<full-source-sha>` only after tests pass. * The private single-architecture publisher uses runner-provided `REGISTRY_TOKEN`, an isolated Docker config, one immutable tag, and a remote manifest inspection. * Source documentation now assigns build ownership here. The deploy repo retains the read-only pull credential, chart, rollout, and ingress. * Local proof passed: publisher syntax check, repo-local secret scan, 55 Rust tests, 24 Playwright browser tests, and the exact Linux Docker image build. The WebGPU-only test skipped because the host exposed no adapter. * The unrelated managed-baseline debt remains tracked in #40. The other baseline hooks passed when only that known doc/comment debt and the Windows `/dev/fd/63` hook were skipped. Remote manifest proof and deploy consumption remain blocked by [infrastructure#654](https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/654). This issue stays open until Ops restores package write authority and deploy#239 consumes the proved manifest.

coilyco-ops added the

autonomy

async-consult

priority

labels

2026-07-29 03:48:12 +00:00

coilyco-ops commented

2026-07-29 05:03:19 +00:00

Author

Member

Ops completed the consumer checkpoint.

Immutable image: forgejo.coilysiren.me/coilyco-gaming/galaxy-gen:bb5023ca136e3fa1c5d1d44cc7aae924de9ea4a6
Publisher proof: Forgejo Actions publish run 79 succeeded for this exact source commit.
Deploy source landed in coilyco-bridge/deploy at 47c199b, with native-runner portability follow-up 843575d.
Live proof: the galaxy-gen Deployment is fully rolled out, the pull ExternalSecret is Ready, and the pod runs the exact image.
Canonical Galaxy Gen deploy source contains no standalone-registry fallback.

A later source commit has a separate failed publisher run and was not consumed. Closing this completed migration issue.

Ops completed the consumer checkpoint. * Immutable image: `forgejo.coilysiren.me/coilyco-gaming/galaxy-gen:bb5023ca136e3fa1c5d1d44cc7aae924de9ea4a6` * Publisher proof: Forgejo Actions publish run 79 succeeded for this exact source commit. * Deploy source landed in `coilyco-bridge/deploy` at `47c199b`, with native-runner portability follow-up `843575d`. * Live proof: the `galaxy-gen` Deployment is fully rolled out, the pull ExternalSecret is Ready, and the pod runs the exact image. * Canonical Galaxy Gen deploy source contains no standalone-registry fallback. A later source commit has a separate failed publisher run and was not consumed. Closing this completed migration issue.

coilyco-ops closed this issue

2026-07-29 05:03:19 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-gaming/galaxy-gen#42

No description provided.

Rows
Columns