fix(deploy): promote trusted release root for ops scripts #293

Merged

pdurlej merged 1 commit from codex/279/release-root-promote into main

2026-05-16 08:59:25 +02:00

codex commented

2026-05-16 08:29:50 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Merged ops scripts currently can stay absent from /opt/pdurlej-platform/current, even though RS2000 systemd/runbook helpers execute from that release root. That creates a false green merge: repo is updated, host is still executing an older script. This PR adds a trusted-main release-root promotion lane for non-module ops files without running compose apply or restarting services.

What changed

Added .forgejo/workflows/release-root-promote.yml for trusted main release-root promotion.
Added scripts/forgejo/promote-release-root, a root-run helper that creates /opt/pdurlej-platform/releases/<sha> and atomically repoints /opt/pdurlej-platform/current.
Documented one-time RS2000 sudoers/helper install and rollback in runbooks/forgejo-actions-runner.md.
Documented the release-root promotion contract in docs/ci/runner-contract.md.
Added static tests proving the workflow is trusted-main only and does not run runtime apply/restart commands.

Why it changed

Issue #279 showed that #278 merged watchdog instrumentation, but RS2000 kept executing the previous release root until manual promotion. Ops script drift is an agent-visible false signal and blocks clean release-batch work.

Files touched

.forgejo/workflows/release-root-promote.yml
scripts/forgejo/promote-release-root
tests/test_release_root_promote.py
docs/ci/runner-contract.md
runbooks/forgejo-actions-runner.md

Relevant context

#279 — release-root drift for non-module ops scripts
#260 — deploy-runner pickup RCA, which exposed the drift
ADR-0018 — agentic-first: fix root causes and keep signals clean
runbooks/forgejo-actions-runner.md — deploy runner trust boundary

Runtime evidence

Read-only preflight before this PR:

/opt/pdurlej-platform/current -> releases/f592fc56725ff9affabe1db3473f4e6102a36b4d
forgejo-deploy cannot write /opt/pdurlej-platform/releases directly
forgejo-deploy currently has no sudo capability

Local verification:

bash -n scripts/forgejo/promote-release-root
python3 -m pytest -q tests/test_release_root_promote.py tests/test_deploy_runner_watchdog.py tests/test_deploy_runner_scope_doctor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py
42 passed in 1.19s

python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/workflow-lint-release-root.md --json /tmp/workflow-lint-release-root.json
Forgejo workflow lint passed with 0 finding(s).

git diff --check

Known constraints

This PR adds the repo-side mechanism. RS2000 needs one-time installation of /usr/local/sbin/pdurlej-platform-promote-release-root and a narrow sudoers rule for forgejo-deploy. The runbook documents the exact setup.

Explicit out-of-scope

No compose changes.
No module auto-apply behavior changes.
No production service restarts.
No Forgejo runner scope changes.
No Infisical/PAT changes.

Requested decision

Merge if CI agrees. Operator has pre-approved merge for this RS2000 migration sequence; after merge, Codex will install the narrow helper/sudoers, promote trusted main, run one no-op auto-apply smoke, and post evidence.

Merge blockers

Any evidence the workflow can run from pull_request.
Any evidence PR head code can execute with deploy credentials.
Any evidence the workflow runs compose/apply/restart commands.
Any evidence the sudoers pattern is broader than the single helper.

Spec sources read

Issue #279 — release-root drift problem statement and acceptance criteria.
docs/forgejo-agent-operations.md — Forgejo identity/write contract.
.forgejo/workflows/platformctl-auto-apply.yml — existing deploy-host trusted-main pattern.
.forgejo/ci-policy.yaml — deploy runner policy.
runbooks/forgejo-actions-runner.md — runner setup and trust boundary.
docs/ci/runner-contract.md — deploy runner contract.
scripts/forgejo/deploy-runner-watchdog — systemd-executed script from release root.

Closes #279

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Merged ops scripts currently can stay absent from `/opt/pdurlej-platform/current`, even though RS2000 systemd/runbook helpers execute from that release root. That creates a false green merge: repo is updated, host is still executing an older script. This PR adds a trusted-main release-root promotion lane for non-module ops files without running compose apply or restarting services. ### What changed - Added `.forgejo/workflows/release-root-promote.yml` for trusted `main` release-root promotion. - Added `scripts/forgejo/promote-release-root`, a root-run helper that creates `/opt/pdurlej-platform/releases/<sha>` and atomically repoints `/opt/pdurlej-platform/current`. - Documented one-time RS2000 sudoers/helper install and rollback in `runbooks/forgejo-actions-runner.md`. - Documented the release-root promotion contract in `docs/ci/runner-contract.md`. - Added static tests proving the workflow is trusted-main only and does not run runtime apply/restart commands. ### Why it changed Issue #279 showed that #278 merged watchdog instrumentation, but RS2000 kept executing the previous release root until manual promotion. Ops script drift is an agent-visible false signal and blocks clean release-batch work. ### Files touched - `.forgejo/workflows/release-root-promote.yml` - `scripts/forgejo/promote-release-root` - `tests/test_release_root_promote.py` - `docs/ci/runner-contract.md` - `runbooks/forgejo-actions-runner.md` ### Relevant context - #279 — release-root drift for non-module ops scripts - #260 — deploy-runner pickup RCA, which exposed the drift - ADR-0018 — agentic-first: fix root causes and keep signals clean - `runbooks/forgejo-actions-runner.md` — deploy runner trust boundary ### Runtime evidence Read-only preflight before this PR: ```text /opt/pdurlej-platform/current -> releases/f592fc56725ff9affabe1db3473f4e6102a36b4d forgejo-deploy cannot write /opt/pdurlej-platform/releases directly forgejo-deploy currently has no sudo capability ``` Local verification: ```text bash -n scripts/forgejo/promote-release-root python3 -m pytest -q tests/test_release_root_promote.py tests/test_deploy_runner_watchdog.py tests/test_deploy_runner_scope_doctor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py control-plane/platformctl/tests/test_forgejo_workflow_lint_contract.py 42 passed in 1.19s python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --markdown /tmp/workflow-lint-release-root.md --json /tmp/workflow-lint-release-root.json Forgejo workflow lint passed with 0 finding(s). git diff --check ``` ### Known constraints This PR adds the repo-side mechanism. RS2000 needs one-time installation of `/usr/local/sbin/pdurlej-platform-promote-release-root` and a narrow sudoers rule for `forgejo-deploy`. The runbook documents the exact setup. ### Explicit out-of-scope - No compose changes. - No module auto-apply behavior changes. - No production service restarts. - No Forgejo runner scope changes. - No Infisical/PAT changes. ### Requested decision Merge if CI agrees. Operator has pre-approved merge for this RS2000 migration sequence; after merge, Codex will install the narrow helper/sudoers, promote trusted main, run one no-op auto-apply smoke, and post evidence. ### Merge blockers - Any evidence the workflow can run from `pull_request`. - Any evidence PR head code can execute with deploy credentials. - Any evidence the workflow runs compose/apply/restart commands. - Any evidence the sudoers pattern is broader than the single helper. ## Spec sources read - Issue #279 — release-root drift problem statement and acceptance criteria. - `docs/forgejo-agent-operations.md` — Forgejo identity/write contract. - `.forgejo/workflows/platformctl-auto-apply.yml` — existing deploy-host trusted-main pattern. - `.forgejo/ci-policy.yaml` — deploy runner policy. - `runbooks/forgejo-actions-runner.md` — runner setup and trust boundary. - `docs/ci/runner-contract.md` — deploy runner contract. - `scripts/forgejo/deploy-runner-watchdog` — systemd-executed script from release root. Closes #279

codex added 1 commit

2026-05-16 08:29:51 +02:00

fix(deploy): promote trusted release root for ops scripts

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

python-ci / Python 3.11 (pull_request) Successful in 35s

Details

python-ci / Python 3.12 (pull_request) Successful in 36s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 18s