coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Publish images via CI; file staged-promotion overlay debt
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 52s
Details

Browse source 
flex-auth had no image workflow, so its production images were hand-built
on a workstation and pushed with workstation credentials -- an artifact
whose provenance was someone's working tree rather than a forge revision.
Ports activity-core's canonical image.yaml: the container-build runner
fetches a tarball of the pushed commit, builds, and pushes :latest and
:main-<short-sha>, then reports the immutable digest for the rollout step.

examples/** is a build-trigger path on purpose -- policy packages are
COPYed into the image and there is no hot reload, so a policy change is
an image change.

Runbook updated to say plainly that images are not built on workstations.

FLEX-WP-0011 filed for the rest of the gap: flex-auth runs two production
Deployments on railiance01 but has never been brought under the
staged-promotion contract (RAIL-BS-WP-0006). No railiance/app.toml, no
stage commands, no canary or approval evidence; the deploy/ directory is
a rescue of specs that existed nowhere, not the sanctioned overlay shape.
Pre-existing debt found during the FLEX-WP-0010 rollout, not a regression
from it, and not a blocker for routine policy rollouts -- flex-auth fails
closed. T03 also flags that the coulombcore drain plan still lists
flex-auth on a host it no longer runs on.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tegwick 2026-08-11 10:35:34 +02:00
parent 2456287e8c
commit e9911eb77f
3 changed files with 196 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
deploy/README.md
View file

@ -44,14 +44,18 @@ actually changed.
The policy packages are baked into the image, not mounted from a ConfigMap,
so a policy change requires a rebuild — there is no hot reload.
```bash
# 1. Build and push from a clean checkout of the commit you intend to ship
docker build -t forgejo.coulomb.social/coulomb/flex-auth:<tag> -f Containerfile .
docker push forgejo.coulomb.social/coulomb/flex-auth:<tag>
**Do not build images on a workstation.** The fleet builds in CI so that an
artifact's provenance is a forge revision rather than someone's working tree.
`.forgejo/workflows/image.yaml` handles it, and `examples/**` is one of its
trigger paths precisely because policy changes are image changes.
# 2. Resolve the digest and pin it — deploy by digest, never by tag
docker inspect --format='{{index .RepoDigests 0}}' \
forgejo.coulomb.social/coulomb/flex-auth:<tag>
```bash
# 1. Push the commit you intend to ship; CI builds it on the container-build
# runner and pushes :latest and :main-<short-sha>
git push origin main
# 2. Take the immutable digest from the workflow's "Report immutable digest"
# step -- deploy by digest, never by tag
# 3. Edit the image digest in the relevant manifest, then apply
kubectl apply -f deploy/flex-auth-<consumer>.yaml