ops(w8): add uptime-kuma runtime pilot workflow #514

Merged

pdurlej merged 1 commit from codex/w8-uptime-kuma-runtime-workflow into main

2026-05-27 08:05:51 +02:00

codex commented

2026-05-26 23:46:22 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

W8 uptime-kuma has an operator-approved runtime pilot, but the local Bitwarden SSH Agent refused access from Codex. This PR adds a narrow trusted-main Forgejo workflow so the already-configured RS2000 deploy-host runner can perform the approved pilot without exposing root SSH keys to the Mac session.

What changed

Added .forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml, a manual workflow_dispatch workflow fixed to uptime-kuma and louislam/uptime-kuma:2.3.2.

Why it changed

The existing platformctl-auto-apply correctly blocks stateful push apply without backup_ref, and backup-before-apply.sh currently needs RS2000 host access. This workflow performs backup, scoped image update, docker compose pull, docker compose up -d --no-deps uptime-kuma, and smoke in one bounded deploy-host run.

Files touched

.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml

Relevant context

W8 runtime approval phrase in operator chat: w8-uptime-kuma-runtime-approved
PR #513 staged desired metadata for uptime-kuma 2.3.2.
Existing helper: scripts/cutover/backup-before-apply.sh uptime-kuma.

Runtime evidence

No runtime mutation from this PR. Runtime mutation only occurs after merge and explicit workflow dispatch with exact approval phrase.

Known constraints

Fixed target image: louislam/uptime-kuma:2.3.2.
Fixed service: uptime-kuma.
Workflow runs only on deploy-host and refs/heads/main.
Rollback trap restores compose.env backup and recreates only uptime-kuma if the pilot fails after env mutation.

Explicit out-of-scope

No broad platform apply.
No --remove-orphans.
No other service restarts.
No workflow generalization beyond this W8 pilot.
No new secrets.

Requested decision

Merge if the workflow is narrow enough for the already-approved W8 runtime pilot.

Merge blockers

Any path that could mutate more than uptime-kuma.
Missing backup step.
Missing rollback path.
Missing smoke evidence upload.

Spec sources read

state/cycle/W8-uptime-kuma-upgrade-packet.md — runtime pilot contract.
modules/uptime-kuma/module.yaml — target module metadata and statefulness.
modules/uptime-kuma/runbook.md — container/service/volume details.
.forgejo/workflows/platformctl-auto-apply.yml — existing deploy-host constraints.
scripts/cutover/backup-before-apply.sh — backup helper contract.

Closes #506

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story W8 uptime-kuma has an operator-approved runtime pilot, but the local Bitwarden SSH Agent refused access from Codex. This PR adds a narrow trusted-main Forgejo workflow so the already-configured RS2000 `deploy-host` runner can perform the approved pilot without exposing root SSH keys to the Mac session. ### What changed Added `.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml`, a manual `workflow_dispatch` workflow fixed to `uptime-kuma` and `louislam/uptime-kuma:2.3.2`. ### Why it changed The existing `platformctl-auto-apply` correctly blocks stateful push apply without `backup_ref`, and `backup-before-apply.sh` currently needs RS2000 host access. This workflow performs backup, scoped image update, `docker compose pull`, `docker compose up -d --no-deps uptime-kuma`, and smoke in one bounded deploy-host run. ### Files touched - `.forgejo/workflows/w8-uptime-kuma-runtime-pilot.yml` ### Relevant context - W8 runtime approval phrase in operator chat: `w8-uptime-kuma-runtime-approved` - PR #513 staged desired metadata for `uptime-kuma` 2.3.2. - Existing helper: `scripts/cutover/backup-before-apply.sh uptime-kuma`. ### Runtime evidence No runtime mutation from this PR. Runtime mutation only occurs after merge and explicit workflow dispatch with exact approval phrase. ### Known constraints - Fixed target image: `louislam/uptime-kuma:2.3.2`. - Fixed service: `uptime-kuma`. - Workflow runs only on `deploy-host` and `refs/heads/main`. - Rollback trap restores `compose.env` backup and recreates only `uptime-kuma` if the pilot fails after env mutation. ### Explicit out-of-scope - No broad platform apply. - No `--remove-orphans`. - No other service restarts. - No workflow generalization beyond this W8 pilot. - No new secrets. ### Requested decision Merge if the workflow is narrow enough for the already-approved W8 runtime pilot. ### Merge blockers - Any path that could mutate more than `uptime-kuma`. - Missing backup step. - Missing rollback path. - Missing smoke evidence upload. ## Spec sources read - `state/cycle/W8-uptime-kuma-upgrade-packet.md` — runtime pilot contract. - `modules/uptime-kuma/module.yaml` — target module metadata and statefulness. - `modules/uptime-kuma/runbook.md` — container/service/volume details. - `.forgejo/workflows/platformctl-auto-apply.yml` — existing deploy-host constraints. - `scripts/cutover/backup-before-apply.sh` — backup helper contract. Closes #506

codex added 1 commit

2026-05-26 23:46:22 +02:00

ops(w8): add uptime-kuma runtime pilot workflow

canary-required / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

canary-required / canary (pull_request) Successful in 14s