fix(f3): make forgejo backup composite #316

Merged

pdurlej merged 2 commits from codex/f3/forgejo-composite-backup into main

2026-05-17 03:22:54 +02:00

codex commented

2026-05-17 03:16:13 +02:00

Collaborator

Canary status: missing — scripts/cutover backup helper change; rely on required Forgejo checks before merge

Canary Context Pack

Product story

Forgejo is the platform's source-of-truth surface. Before its F3 smoke, the operator needs a backup that can restore both repository/app filesystem state and the Forgejo database slice, not only one side of the service.

What changed

Added a Forgejo-specific backup class to scripts/cutover/backup-before-apply.sh.
The Forgejo backup now creates one tarball containing:
- forgejo-data.tar.gz from the Forgejo app volume;
- forgejo-db.sql.gz from pg_dump of the Forgejo Postgres database;
- manifest.txt with non-secret backup metadata.
Updated scripts/cutover/README.md to document the new class.

Why it changed

Generic Class E volume archive is too weak for Forgejo because app volume state and database state must be captured together for a credible pre-F3 restore point.

Files touched

scripts/cutover/backup-before-apply.sh
scripts/cutover/README.md

Runtime evidence

Read-only preflight before this PR:

home-platform-forgejo-1 is running, Docker health healthy.
Forgejo container version: 15.0.1.
Container-local /api/healthz returns status=pass for cache and database.
Forgejo app volume size: about 352M.

Known constraints

This PR does not run a production backup by itself.
The helper prints DB container/name/user metadata, but no DB password or secret values.
F3 smoke still requires operator-approved backup-first workflow with backup_ref.

Explicit out-of-scope

No Forgejo restore automation.
No Forgejo service restart.
No DB mutation.
No Traefik work.

Requested decision

Merge so release-root promote installs the safer backup helper before Forgejo F3 smoke.

Merge blockers

Script syntax failure.
Required checks failing.
Any reviewer concern that the helper might leak secrets or mutate DB state.

Follow-up CI fix in this PR

Also fixed .forgejo/workflows/canary-required.yml path classifier so scripts-only PRs with zero canary-path matches do not fail collect-diff under set -e/pipefail semantics.
Local proof: scripts-only file list => MATCH=0; workflow file list => MATCH=1.

Spec sources read

scripts/cutover/backup-before-apply.sh — backup helper implementation.
scripts/cutover/README.md — backup class documentation.
modules/forgejo/module.yaml — Forgejo runtime/dependency contract.
compose/apps/compose.yaml — Forgejo compose service state and DB dependency.
modules/forgejo/runbook.md — Forgejo recovery context.
.forgejo/workflows/canary-required.yml — fixed failed no-match classifier observed on PR #316.

Refs: #142

Canary status: missing — scripts/cutover backup helper change; rely on required Forgejo checks before merge ## Canary Context Pack ### Product story Forgejo is the platform's source-of-truth surface. Before its F3 smoke, the operator needs a backup that can restore both repository/app filesystem state and the Forgejo database slice, not only one side of the service. ### What changed - Added a Forgejo-specific backup class to `scripts/cutover/backup-before-apply.sh`. - The Forgejo backup now creates one tarball containing: - `forgejo-data.tar.gz` from the Forgejo app volume; - `forgejo-db.sql.gz` from `pg_dump` of the Forgejo Postgres database; - `manifest.txt` with non-secret backup metadata. - Updated `scripts/cutover/README.md` to document the new class. ### Why it changed Generic Class E volume archive is too weak for Forgejo because app volume state and database state must be captured together for a credible pre-F3 restore point. ### Files touched - `scripts/cutover/backup-before-apply.sh` - `scripts/cutover/README.md` ### Runtime evidence Read-only preflight before this PR: - `home-platform-forgejo-1` is `running`, Docker health `healthy`. - Forgejo container version: `15.0.1`. - Container-local `/api/healthz` returns `status=pass` for cache and database. - Forgejo app volume size: about `352M`. ### Known constraints - This PR does not run a production backup by itself. - The helper prints DB container/name/user metadata, but no DB password or secret values. - F3 smoke still requires operator-approved backup-first workflow with `backup_ref`. ### Explicit out-of-scope - No Forgejo restore automation. - No Forgejo service restart. - No DB mutation. - No Traefik work. ### Requested decision Merge so release-root promote installs the safer backup helper before Forgejo F3 smoke. ### Merge blockers - Script syntax failure. - Required checks failing. - Any reviewer concern that the helper might leak secrets or mutate DB state. ### Follow-up CI fix in this PR - Also fixed `.forgejo/workflows/canary-required.yml` path classifier so scripts-only PRs with zero canary-path matches do not fail `collect-diff` under `set -e`/pipefail semantics. - Local proof: scripts-only file list => `MATCH=0`; workflow file list => `MATCH=1`. ## Spec sources read - `scripts/cutover/backup-before-apply.sh` — backup helper implementation. - `scripts/cutover/README.md` — backup class documentation. - `modules/forgejo/module.yaml` — Forgejo runtime/dependency contract. - `compose/apps/compose.yaml` — Forgejo compose service state and DB dependency. - `modules/forgejo/runbook.md` — Forgejo recovery context. - `.forgejo/workflows/canary-required.yml` — fixed failed no-match classifier observed on PR #316. Refs: #142

codex added 1 commit

2026-05-17 03:16:13 +02:00

fix(f3): make forgejo backup composite

base-is-main / guard (pull_request) Successful in 2s

Details

canary-required / collect-diff (pull_request) Failing after 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Has been skipped

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 21s