Migrate website image publishing to Forgejo OCI #78

New issue

Closed

opened 2026-07-27 02:41:32 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-07-27 02:41:32 +00:00

Collaborator

Outcome

Publish website to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner.

Program authority: coilysiren/inbox#276

Registry inventory: coilyco-flight-deck/infrastructure#653

Consumer rollout: coilyco-bridge/deploy#239

Target

forgejo.coilysiren.me/coilysiren/website:<immutable-source-tag>

Scope

Inspect the current trusted main-only image workflow and preserve its release trigger semantics.
Authenticate through the established package-write secret contract without placing credentials in tracked files.
Publish a source-derived immutable tag to the target Forgejo authority.
Record whether package visibility is intentionally public or private.
Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository.
Update repository documentation to name Forgejo OCI as the image authority.
Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover.
Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build.

Acceptance

A trusted main workflow publishes the target image to Forgejo OCI.
The issue records proof that the immutable manifest exists.
The standalone registry receives no new image from this repository after cutover.
Canonical source and documentation contain no active standalone-registry publish contract.
Repository validation passes.
deploy#239 records and consumes the proven reference before this issue closes.

Codex, via advisor surface

## Outcome Publish `website` to Forgejo OCI from this source repository, stop publishing it to the standalone k3s registry, and hand the proven immutable reference to the deployment owner. Program authority: https://forgejo.coilysiren.me/coilysiren/inbox/issues/276 Registry inventory: https://forgejo.coilysiren.me/coilyco-flight-deck/infrastructure/issues/653 Consumer rollout: https://forgejo.coilysiren.me/coilyco-bridge/deploy/issues/239 ## Target `forgejo.coilysiren.me/coilysiren/website:<immutable-source-tag>` ## Scope * Inspect the current trusted main-only image workflow and preserve its release trigger semantics. * Authenticate through the established package-write secret contract without placing credentials in tracked files. * Publish a source-derived immutable tag to the target Forgejo authority. * Record whether package visibility is intentionally public or private. * Remove active raw registry endpoints, local pull aliases, insecure-registry configuration, tag checks, and dual-publish behavior owned by this repository. * Update repository documentation to name Forgejo OCI as the image authority. * Report the exact immutable image reference on this issue and on deploy#239 before consumer cutover. * Account for the upload-race, staging-space, and request-timeout risks linked from the umbrella when this publisher uses a large or multi-architecture build. ## Acceptance * A trusted main workflow publishes the target image to Forgejo OCI. * The issue records proof that the immutable manifest exists. * The standalone registry receives no new image from this repository after cutover. * Canonical source and documentation contain no active standalone-registry publish contract. * Repository validation passes. * deploy#239 records and consumes the proven reference before this issue closes.  Codex, via advisor surface

coilyco-ops added the

consult

labels

2026-07-29 03:49:35 +00:00

coilyco-ops commented

2026-07-29 05:46:07 +00:00

Author

Collaborator

Completed and verified.

Source commits 730fe8b, 7706746, and fa00ea2 removed the old publisher contract, fixed the runner and build proxy path, and published under the managed package owner.
Infrastructure commits e5cee11 through 928f57a provisioned the repository-scoped deploy runner and corrected its tracked proxy configuration.
Trusted main publisher run 159 succeeded: https://forgejo.coilysiren.me/coilysiren/website/actions/runs/159
Published immutable image: forgejo.coilysiren.me/coilyco-bridge/website:fa00ea248f2e24df629b3aa7629078a48205e4a7
Deploy commit d333314 consumes that exact reference. Deploy run 3029 succeeded: https://forgejo.coilysiren.me/coilyco-bridge/deploy/actions/runs/3029
Live website/website is 1/1 Ready on the exact immutable image. The forgejo-registry ExternalSecret is Ready with SecretSynced.

The package owner differs from the original target because the source owner cannot publish packages. The managed coilyco-bridge owner is the proven package authority.

Completed and verified. * Source commits `730fe8b`, `7706746`, and `fa00ea2` removed the old publisher contract, fixed the runner and build proxy path, and published under the managed package owner. * Infrastructure commits `e5cee11` through `928f57a` provisioned the repository-scoped deploy runner and corrected its tracked proxy configuration. * Trusted main publisher run 159 succeeded: https://forgejo.coilysiren.me/coilysiren/website/actions/runs/159 * Published immutable image: `forgejo.coilysiren.me/coilyco-bridge/website:fa00ea248f2e24df629b3aa7629078a48205e4a7` * Deploy commit `d333314` consumes that exact reference. Deploy run 3029 succeeded: https://forgejo.coilysiren.me/coilyco-bridge/deploy/actions/runs/3029 * Live `website/website` is 1/1 Ready on the exact immutable image. The `forgejo-registry` ExternalSecret is Ready with `SecretSynced`. The package owner differs from the original target because the source owner cannot publish packages. The managed `coilyco-bridge` owner is the proven package authority.

coilyco-ops closed this issue

2026-07-29 05:46:08 +00:00