ops/forgejo-first-ci-and-release #3

New issue

Closed

opened 2026-05-09 23:22:40 +02:00 by codex · 1 comment

codex commented

2026-05-09 23:22:40 +02:00

Collaborator

Parent: #2
Wave: 1 Maintainer Foundation

Summary

Make Forgejo the operational source of truth for Kan-ductor while keeping GHCR as registry if still needed.

Scope

Align CI/release docs and workflow assumptions with git.pdurlej.com/pdurlej/kan-ductor.
Preserve image tags: sha-*, main, rs2000.
Document deploy promotion and rollback by immutable SHA tag.

Non-goals

No production deploy.
No registry migration unless explicitly approved.
No secret or PAT changes.

Acceptance

Maintainer can tell where production images come from.
Rollback path is documented as SHA tag switch.
GitHub is not described as the primary source of truth.

Tests / smoke

Static review of workflow/docs.
git remote -v and CI file inspection noted in PR.

Rollback

git revert <PR-commit>.

Owner gates

Merge by Piotr.
Any registry credential or production deploy is a hard stop.

Parent: #2 Wave: 1 Maintainer Foundation ## Summary Make Forgejo the operational source of truth for Kan-ductor while keeping GHCR as registry if still needed. ## Scope - Align CI/release docs and workflow assumptions with `git.pdurlej.com/pdurlej/kan-ductor`. - Preserve image tags: `sha-*`, `main`, `rs2000`. - Document deploy promotion and rollback by immutable SHA tag. ## Non-goals - No production deploy. - No registry migration unless explicitly approved. - No secret or PAT changes. ## Acceptance - Maintainer can tell where production images come from. - Rollback path is documented as SHA tag switch. - GitHub is not described as the primary source of truth. ## Tests / smoke - Static review of workflow/docs. - `git remote -v` and CI file inspection noted in PR. ## Rollback - `git revert <PR-commit>`. ## Owner gates - Merge by Piotr. - Any registry credential or production deploy is a hard stop.

codex referenced this issue

2026-05-09 23:27:13 +02:00

[meta] Kan-ductor maturity waves #2

codex referenced this issue from a pull request that will close it,

2026-05-09 23:38:04 +02:00

ci: add Forgejo release workflows #27

codex commented

2026-05-09 23:38:10 +02:00

Author

Collaborator

Implementation PR opened: #27 — ci: add Forgejo release workflows.

Notes:

No production deploy/restart, no DB migration, no secret mutation.
The PR intentionally keeps CI bounded because root pnpm lint and root pnpm typecheck are already red on main from unrelated baseline issues.
Required owner setup before operational use: Forgejo secrets GHCR_USERNAME and GHCR_TOKEN, plus confirmation that the runner label/capabilities match ubuntu-latest with Docker Buildx.

Implementation PR opened: #27 — `ci: add Forgejo release workflows`. Notes: - No production deploy/restart, no DB migration, no secret mutation. - The PR intentionally keeps CI bounded because root `pnpm lint` and root `pnpm typecheck` are already red on `main` from unrelated baseline issues. - Required owner setup before operational use: Forgejo secrets `GHCR_USERNAME` and `GHCR_TOKEN`, plus confirmation that the runner label/capabilities match `ubuntu-latest` with Docker Buildx.