Restore Galaxy Gen OCI publishing #43

New issue

Closed

opened 2026-07-29 08:14:51 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-29 08:14:51 +00:00

Member

Galaxy Gen tests pass, but the trusted publish lane fails Forgejo OCI login as unauthorized in run 80. The same publisher succeeded in run 79, so the observed failure is the managed package-write credential rather than the image build.

Ops action:

Ops rotates the managed Forgejo package-write credential through the committed infrastructure token-minting runbook.
Ops reruns failed run 80 once and returns the successful remote manifest evidence to the engineer lane.

Acceptance:

The publish job logs a successful registry login, image push, and remote manifest inspection.
The engineer updates the deploy-owned immutable Galaxy Gen pin only after that manifest exists.
Ops verifies the resulting rollout and the browser simulation.

Galaxy Gen tests pass, but the trusted publish lane fails Forgejo OCI login as `unauthorized` in [run 80](https://forgejo.coilysiren.me/coilyco-gaming/galaxy-gen/actions/runs/80/jobs/1/attempt/1). The same publisher succeeded in run 79, so the observed failure is the managed package-write credential rather than the image build. Ops action: * Ops rotates the managed Forgejo package-write credential through the committed infrastructure token-minting runbook. * Ops reruns failed run 80 once and returns the successful remote manifest evidence to the engineer lane. Acceptance: * The publish job logs a successful registry login, image push, and remote manifest inspection. * The engineer updates the deploy-owned immutable Galaxy Gen pin only after that manifest exists. * Ops verifies the resulting rollout and the browser simulation.

coilyco-ops added the

priority

autonomy

live-collab

labels

2026-07-29 08:14:51 +00:00

coilyco-ops commented

2026-07-29 08:25:55 +00:00

Author

Member

Recovered.

Ops rotated and verified the managed package-write credential through the committed infrastructure runbook.
Build-publish run 80 attempt 2 passed its test and publish jobs, including remote manifest inspection.
The deploy repo advanced the proved immutable pin on canonical main.
Deploy run 3042 upgraded Galaxy Gen to Helm revision 7 with one available replica and a Ready certificate.
Both public hostnames loaded the WASM app. The primary hostname generated a galaxy and advanced from tick 0 to tick 1.

The incident acceptance criteria are satisfied.

Recovered. * Ops rotated and verified the managed package-write credential through the committed infrastructure runbook. * Build-publish run 80 attempt 2 passed its test and publish jobs, including remote manifest inspection. * The deploy repo advanced the proved immutable pin on canonical main. * Deploy run 3042 upgraded Galaxy Gen to Helm revision 7 with one available replica and a Ready certificate. * Both public hostnames loaded the WASM app. The primary hostname generated a galaxy and advanced from tick 0 to tick 1. The incident acceptance criteria are satisfied.

coilyco-ops closed this issue

2026-07-29 08:25:57 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

coilyco-gaming/galaxy-gen#43

No description provided.

Rows
Columns