coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ACTIVITY-WP-0020: dry-run clean after tool fix; add T07 protection gate
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 5s
Details

Browse source 
Dry-run now works (tool bug fixed in railiance-platform@6f7ca31): 29 candidates,
0 errors. Enable/apply blocked on new T07 — protection scan misses activity-core
& state-hub live tags; extend to source protected tags from live cluster before apply.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-07-16 02:50:21 +02:00
parent e4d6222d22
commit 8ae85742fb
1 changed files with 35 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

35
workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md
View file

@ -221,6 +221,41 @@ production with `FORGEJO_TOKEN` and approves enable.
Acceptance: one successful dry-run workflow in Temporal; schedule visible in
automation inventory; runbook lists cron, credential pointer, and rollback.
**2026-07-16 dry-run:** After fixing a version-enumeration bug in the prune tool
(Forgejo has no `/versions` sub-endpoint; the list endpoint returns one entry per
`(name, version)` — `railiance-platform@6f7ca31`, incl. network-timeout retry),
the dry-run is clean: **29 candidate deletions across 5 container packages**
(activity-core 16, state-hub 7, vergabe-teilnahme 3, reuse-surface 2,
forgejo-actions-probe 1), 0 errors. Protected `vergabe-teilnahme:064d295` and
deployed `reuse-surface:e3ae22e` are correctly **not** in `would_delete`.
**Blocked before enable/apply:** `protected_count` was only **1** — the protection
scan reads `helm/*-values.yaml`, but activity-core and state-hub (the two largest
deletion sets) are not pinned there; their live tag can't be confirmed safe from
this host. Enable/apply gated on **T07** (extend protection to live deployed tags).
---
### T07 — Extend protection to live deployed tags (pre-apply gate)
```task
id: ACTIVITY-WP-0020-T07
status: todo
priority: high
```
The Helm-values protection scan under-covers: it only protected 1 tag, missing
activity-core / state-hub (CI-deployed, not pinned in `railiance-apps/helm/`).
Extend the protection source so **every currently-running image tag** is protected
regardless of retention depth. Authoritative source is the live production
cluster(s) where these images run (railiance01/Forgejo-consuming), not just Git
values — query running `Deployment`/`StatefulSet`/`DaemonSet` container images
across namespaces (or the ArgoCD app inventory) and union with the Helm scan.
Acceptance: a dry-run shows all live tags for activity-core, state-hub, and other
production workloads present in `skipped_protected` (or absent from `would_delete`),
verified against the cluster. Only then are T05 enable and T06 apply unblocked.
---
### T06 — First apply run and backup impact evidence