coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Finish ACTIVITY-WP-0020: enable weekly Forgejo package prune
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Build and Publish Container Image / build-and-push (push) Successful in 28s
Details

Browse source 
First apply deleted 38 stale versions; enable schedule with live-images
protection file for worker pods without kubectl; restore path for live
state-hub tags after an unprotected worker apply.
This commit is contained in:
tegwick 2026-07-21 19:20:42 +02:00
parent 2525f234e7
commit a35997878b
4 changed files with 81 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

32
docs/runbook.md
View file

@ -316,13 +316,31 @@ activity registration issues before the next scheduled run.
## Weekly maintenance definitions
`weekly-forgejo-package-prune` runs Sundays at 03:30 UTC. It invokes the
`shell` context query `forgejo_package_prune`, which runs
`~/railiance-platform/tools/cmd/forgejo-package-prune` and posts
`forgejo_package_prune` progress to State Hub. Retention depth is **3** versions
per package; production Helm image tags in `railiance-apps` are protected. Ships
`enabled: false` until dry-run evidence is reviewed (`ACTIVITY-WP-0020`). The
worker host must have `FORGEJO_TOKEN` or `FORGEJO_TOKEN_FILE` in its environment.
`weekly-forgejo-package-prune` runs Sundays at **03:30 UTC** (after 02:15
`forgejo-backup`). It invokes the `shell` context query `forgejo_package_prune`,
which runs `/opt/railiance-platform/tools/cmd/forgejo-package-prune` (hostPath
mount of `~/railiance-platform` on the worker) with `apply: true` and posts
`forgejo_package_prune` progress to State Hub.
| Item | Value |
| --- | --- |
| Retention | newest **3** versions per package (`container`, `pypi`, `npm`, `generic`) |
| Org | `coulomb` |
| Protected | live cluster image tags + Helm values (`--live-images-file` / live scan) |
| Credential | `FORGEJO_TOKEN` in `actcore-runtime-secret` (OpenBao path `platform/workloads/forgejo/forgejo-admin` field `API_TOKEN`; `warden route show forgejo-admin-api-token`) |
| Rollback | restore package versions from Nextcloud `forgejo dump` if a needed tag was removed |
**Enabled 2026-07-21** after dry-run + first apply evidence
(`railiance-platform/docs/evidence/forgejo-package-prune-apply-20260721.json`:
38 deleted, 0 errors). Manual apply:
```bash
cd ~/railiance-platform
export VAULT_ADDR=https://bao.coulomb.social
# OIDC or platform token — never paste PAT into chat
export FORGEJO_TOKEN=$(bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin)
./tools/cmd/forgejo-package-prune --apply --live-images-file /path/to/live-images.txt
```
`weekly-sbom-staleness` is the canonical rule-only weekly maintenance schedule.
It runs Mondays at 09:00 Europe/Berlin, resolves State Hub SBOM status for all