coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish ACTIVITY-WP-0023: ESO FORGEJO_TOKEN and gap dispositions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 7s
Details

Browse source 
Ship ExternalSecret actcore-forgejo-admin and multi-policy ESO token
bootstrap so weekly prune credentials refresh without bootstrap inject.
Disposition issue-core path A and MarkiTect ROS as external owners;
close workplan finished.
This commit is contained in:
tegwick 2026-07-21 23:19:10 +02:00
parent d36adb0822
commit 21d46927f6
7 changed files with 147 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/issue-core-emission-boundary.md
View file

@ -64,17 +64,28 @@ activity-core.
Railiance production uses `state-hub` unless an overlay explicitly sets
`rest` for an experiment.
### Known production failure (2026-07-21) — rest path
### Known production failure (2026-07-21, reconfirmed 2026-07-21 T06) — rest path
`POST /issues/` returned **HTTP 503**:
`POST /issues/` returns **HTTP 503**:
```text
Failed to connect to backend 'forgejo-inbox': Failed to connect to Gitea API
```
`GITEA_BACKEND_TOKEN` on issue-core rejected by Forgejo. Fix is issue-core
token rotation (`warden route show issue-core-ingestion-api-key`), not
activity-core defaults.
**Disposition (ACTIVITY-WP-0023-T06):** activity-core keeps global default
`state-hub` and does **not** flip production to `rest`. Path A is owned by
**issue-core**: rotate/fix `GITEA_BACKEND_TOKEN` (Forgejo backend PAT for the
forgejo-inbox connector — not the activity-core `ISSUE_CORE_API_KEY`
ingestion key). After issue-core proves `POST /issues/` → **201**, operators may
opt in per definition / overlay only (WP-0022).
Smoke from worker (does not change sink env):
```bash
kubectl -n activity-core exec deploy/actcore-worker -- python -c '
# valid IssueCore body → expect 201 when path A is healthy, else 503 forgejo-inbox
'
```
## Promotion to rest (one definition at a time)

2
docs/runbook.md
View file

@ -364,7 +364,7 @@ mount of `~/railiance-platform` on the worker) with `apply: true` and posts
| Retention | newest **3** versions per package (`container`, `pypi`, `npm`, `generic`) |
| Org | `coulomb` |
| Protected | live cluster image tags + Helm values (`--live-images-file` / live scan) |
| Credential | `FORGEJO_TOKEN` in `actcore-runtime-secret` (OpenBao path `platform/workloads/forgejo/forgejo-admin` field `API_TOKEN`; `warden route show forgejo-admin-api-token`) |
| Credential | `FORGEJO_TOKEN` in `actcore-runtime-secret` via ExternalSecret `actcore-forgejo-admin` (OpenBao `platform/workloads/forgejo/forgejo-admin` field `API_TOKEN`; `warden route show forgejo-admin-api-token`). ESO token: `scripts/openbao-eso-token-apply.sh` (includes `workload-kv-read-forgejo-admin`). |
| Rollback | restore package versions from Nextcloud `forgejo dump` if a needed tag was removed |
**Enabled 2026-07-21** after dry-run + first apply evidence