From 2fcc91f2aa00a8aff027912f79e513ba361b014a Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 7 Jul 2026 22:07:59 +0200 Subject: [PATCH] REUSE-WP-0019-T03: record repo secret addition, close T03 REUSE_SURFACE_TOKEN repo secret added to Forgejo Actions per explicit user sign-off. Live-verified via manual workflow dispatch: recompose-fallback.yaml ran to success and the live hub's composed_at advanced to the dispatch time, confirming the full scheduled-fallback path end to end. T03 fully complete. Co-Authored-By: Claude Sonnet 5 --- ...P-0019-forgejo-automation-and-telemetry.md | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md b/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md index 902c4aa..0c50927 100644 --- a/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md +++ b/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md @@ -240,14 +240,20 @@ proven patterns rather than improvising):** `reuse-surface:main-09d5b0f` both landed in the Forgejo container registry via the packages API -**Blocked, needs separate explicit sign-off (same boundary as the K8s -Secret write in T02):** adding the `REUSE_SURFACE_TOKEN` repo secret to -Forgejo Actions (needed by `recompose-fallback.yaml` to call the -authenticated compose endpoint) was denied by the auto-mode classifier as -a secret-provisioning action distinct from "migrate to Forgejo" — did not -attempt to work around it. The fallback workflow is deployed and will fail -safely (not silently) until that secret is added; the webhook is the -primary mechanism and is already fully live, so this is a low-priority gap. +**`REUSE_SURFACE_TOKEN` repo secret added 2026-07-07 (explicit user +sign-off "Go ahead and add the repo secret"):** fetched the token via +`warden access reuse-surface-hub-write-token --exec` (never printed) and +`PUT` it to Forgejo's repo Actions secrets API (`201`). Live-verified by +manually dispatching `recompose-fallback.yaml` +(`POST .../actions/workflows/recompose-fallback.yaml/dispatches`) — run +completed `success`, and `GET /v1/federated` on the live hub showed +`composed_at` advance to the exact dispatch time, confirming the full +scheduled-fallback path works end to end, not just that the workflow +didn't error. + +T03 is now fully complete: org webhook live (railiance-apps), this repo's +CI on Forgejo Actions (all three workflows verified green), and the +scheduled fallback verified working end to end. **Not done — moved out of this workplan's scope:** updating `docs/deploy/reuse-kubernetes.md`/`railiance-apps` to make @@ -314,7 +320,7 @@ state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b" ## Acceptance - [x] No hardcoded forge host in code or sources.yaml; `migrate-host` tested (T01, 2026-07-07) -- [x] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place (T02/T03, 2026-07-07 — webhook live-verified end to end; scheduled fallback deployed, blocked only on a repo secret pending separate sign-off) +- [x] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place (T02/T03, 2026-07-07 — both live-verified end to end) - [x] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`) (T03, 2026-07-07 — `ci.yml`/`ci-smoke.yaml`/`image.yaml` all verified green on the live push) - [ ] Reuse events recordable via hub API and CLI; `report reuse` aggregates them - [ ] R-axis evidence rules for observed reuse documented in the maturity standard