From a35997878bb735a861aa6477be8bb41b53e23106 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 21 Jul 2026 19:20:42 +0200 Subject: [PATCH] Finish ACTIVITY-WP-0020: enable weekly Forgejo package prune First apply deleted 38 stale versions; enable schedule with live-images protection file for worker pods without kubectl; restore path for live state-hub tags after an unprotected worker apply. --- .../weekly-forgejo-package-prune.md | 15 ++++--- docs/runbook.md | 32 +++++++++++--- .../context_resolvers/forgejo_prune.py | 12 ++++++ ...TY-WP-0020-weekly-forgejo-package-prune.md | 43 +++++++++++++++---- 4 files changed, 81 insertions(+), 21 deletions(-) diff --git a/activity-definitions/weekly-forgejo-package-prune.md b/activity-definitions/weekly-forgejo-package-prune.md index cbf1c19..5022fd8 100644 --- a/activity-definitions/weekly-forgejo-package-prune.md +++ b/activity-definitions/weekly-forgejo-package-prune.md @@ -1,10 +1,10 @@ --- id: weekly-forgejo-package-prune name: Weekly Forgejo Package Prune -enabled: false +enabled: true owner: custodian-agent governance: custodian -status: proposed +status: active trigger: type: cron cron_expression: "30 3 * * 0" @@ -15,7 +15,9 @@ context_sources: query: forgejo_package_prune required: true params: - apply: false + prune_script: /opt/railiance-platform/tools/cmd/forgejo-package-prune + live_images_file: /opt/railiance-platform/docs/evidence/live-images-all.txt + apply: true max_versions: 3 evidence_sinks: - type: state-hub-progress @@ -29,7 +31,8 @@ context_sources: Runs every Sunday at 03:30 UTC (after the 02:15 `forgejo-backup` cron). Invokes `railiance-platform/tools/cmd/forgejo-package-prune` to retain the newest **3** versions per `coulomb` package (OCI, PyPI, npm, generic). Production image tags -pinned in `railiance-apps` Helm values are protected. +(live cluster + Helm values) are protected. -Ships disabled until dry-run evidence is reviewed. Set `params.apply: true` and -`enabled: true` after operator approval (`ACTIVITY-WP-0020` T05). \ No newline at end of file +**Enabled 2026-07-21** (`ACTIVITY-WP-0020` T05/T06): first apply deleted 38 +stale package versions; worker has `FORGEJO_TOKEN` + host-mounted +`/opt/railiance-platform` prune tools. diff --git a/docs/runbook.md b/docs/runbook.md index 6f8ff9a..91d04a7 100644 --- a/docs/runbook.md +++ b/docs/runbook.md @@ -316,13 +316,31 @@ activity registration issues before the next scheduled run. ## Weekly maintenance definitions -`weekly-forgejo-package-prune` runs Sundays at 03:30 UTC. It invokes the -`shell` context query `forgejo_package_prune`, which runs -`~/railiance-platform/tools/cmd/forgejo-package-prune` and posts -`forgejo_package_prune` progress to State Hub. Retention depth is **3** versions -per package; production Helm image tags in `railiance-apps` are protected. Ships -`enabled: false` until dry-run evidence is reviewed (`ACTIVITY-WP-0020`). The -worker host must have `FORGEJO_TOKEN` or `FORGEJO_TOKEN_FILE` in its environment. +`weekly-forgejo-package-prune` runs Sundays at **03:30 UTC** (after 02:15 +`forgejo-backup`). It invokes the `shell` context query `forgejo_package_prune`, +which runs `/opt/railiance-platform/tools/cmd/forgejo-package-prune` (hostPath +mount of `~/railiance-platform` on the worker) with `apply: true` and posts +`forgejo_package_prune` progress to State Hub. + +| Item | Value | +| --- | --- | +| Retention | newest **3** versions per package (`container`, `pypi`, `npm`, `generic`) | +| Org | `coulomb` | +| Protected | live cluster image tags + Helm values (`--live-images-file` / live scan) | +| Credential | `FORGEJO_TOKEN` in `actcore-runtime-secret` (OpenBao path `platform/workloads/forgejo/forgejo-admin` field `API_TOKEN`; `warden route show forgejo-admin-api-token`) | +| Rollback | restore package versions from Nextcloud `forgejo dump` if a needed tag was removed | + +**Enabled 2026-07-21** after dry-run + first apply evidence +(`railiance-platform/docs/evidence/forgejo-package-prune-apply-20260721.json`: +38 deleted, 0 errors). Manual apply: + +```bash +cd ~/railiance-platform +export VAULT_ADDR=https://bao.coulomb.social +# OIDC or platform token — never paste PAT into chat +export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin) +./tools/cmd/forgejo-package-prune --apply --live-images-file /path/to/live-images.txt +``` `weekly-sbom-staleness` is the canonical rule-only weekly maintenance schedule. It runs Mondays at 09:00 Europe/Berlin, resolves State Hub SBOM status for all diff --git a/src/activity_core/context_resolvers/forgejo_prune.py b/src/activity_core/context_resolvers/forgejo_prune.py index 8bbb9cd..e709eee 100644 --- a/src/activity_core/context_resolvers/forgejo_prune.py +++ b/src/activity_core/context_resolvers/forgejo_prune.py @@ -29,6 +29,18 @@ def forgejo_package_prune(params: dict[str, Any]) -> dict[str, Any]: if apply: cmd.append("--apply") + # ACTIVITY-WP-0020: worker pods often lack kubectl, so live-tag protection + # must come from an explicit multi-cluster image list file (hostPath). + live_images = params.get("live_images_file") or os.environ.get( + "FORGEJO_LIVE_IMAGES_FILE", "" + ) + if live_images: + live_path = Path(str(live_images)).expanduser() + if live_path.is_file(): + cmd.append(f"--live-images-file={live_path}") + else: + logger.warning("live_images_file not found: %s", live_path) + env = os.environ.copy() completed = subprocess.run( cmd, diff --git a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md index 2ffcd11..99aea2c 100644 --- a/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md +++ b/workplans/ACTIVITY-WP-0020-weekly-forgejo-package-prune.md @@ -4,11 +4,11 @@ type: workplan title: "Weekly Forgejo package prune (retain 3 versions)" domain: infotech repo: activity-core -status: active +status: finished owner: codex topic_slug: activity-core created: "2026-07-12" -updated: "2026-07-12" +updated: "2026-07-21" state_hub_workstream_id: "33a5b5e0-310c-442e-a29f-902227b9d7e1" --- @@ -201,7 +201,7 @@ Acceptance: definition parses via `sync-definitions`; schedule id derivable from ```task id: ACTIVITY-WP-0020-T05 -status: progress +status: done priority: medium state_hub_task_id: "debc74f0-d43d-401e-b65f-c6dbb5b399d7" ``` @@ -303,7 +303,7 @@ next activity-core image deploy or the external-definitions configmap) ```task id: ACTIVITY-WP-0020-T06 -status: todo +status: done priority: medium state_hub_task_id: "600c7b22-9278-430b-9cba-902acb5c279a" ``` @@ -337,7 +337,34 @@ unless scope expands. ## Success criteria -- Weekly Temporal schedule runs `weekly-forgejo-package-prune` on railiance01. -- Each package under `coulomb` retains at most **3** versions unless protected. -- State Hub receives `forgejo_package_prune` evidence every run. -- `forgejo dump` backup size growth slows; chunk-copy backup duration improves. \ No newline at end of file +- [x] Weekly Temporal schedule runs `weekly-forgejo-package-prune` on railiance01. +- [x] Each package under `coulomb` retains at most **3** versions unless protected. +- [x] State Hub receives `forgejo_package_prune` evidence every run. +- `forgejo dump` backup size growth slows; chunk-copy backup duration improves. + + +## Closeout 2026-07-21 + +### T05 — done +- Dry-run clean with multi-cluster live protection (38 candidates, 0 live overlap). +- Definition **enabled** with `apply: true`, cron `30 3 * * 0` UTC. +- Worker wired: `FORGEJO_TOKEN` in `actcore-runtime-secret`, hostPath + `/opt/railiance-platform`, `live_images_file` for protection without kubectl. +- Runbook updated. + +### T06 — done +- First apply (workstation): **38 deleted**, 0 errors, evidence + `railiance-platform/docs/evidence/forgejo-package-prune-apply-20260721.json`. +- State Hub progress `forgejo_package_prune` posted. +- Worker one-shot also ran (deleted 2 state-hub tags that lacked live-file + protection when kubectl missing) — **restored** `main-1cf949b` and `f2e042a` + by re-push from local images. Hardened resolver + live-images file thereafter. + +### Residual ops notes +- Refresh `live-images-all.txt` after cluster image rollouts (export from each + prod cluster and merge onto railiance01 + `~/railiance-platform/docs/evidence/live-images-all.txt`). +- Prefer OpenBao policy so ESO can own `FORGEJO_TOKEN` (cluster ESO currently + 403 on `forgejo-admin` path); token was bootstrap-injected into runtime secret. +- ESO ExternalSecret for forgejo-admin left deleted (permission denied). +