diff --git a/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md b/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md index f5f3ab2..902c4aa 100644 --- a/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md +++ b/workplans/REUSE-WP-0019-forgejo-automation-and-telemetry.md @@ -189,21 +189,73 @@ production ingress template edit outside this workplan's scope. ```task id: REUSE-WP-0019-T03 -status: wait +status: done priority: medium state_hub_task_id: "aa9e9f80-b878-490c-832e-515d8cbbbb60" ``` -Blocked on T02 deploy and Forgejo instance availability. +**Org-level Forgejo webhook — done by `railiance-apps` (2026-07-07), +credited not claimed:** after I flagged the `/health` ingress bug to +`railiance-apps` via State Hub message, they picked up this piece too: +`tools/reuse-forgejo-webhook.sh` + `make reuse-forgejo-webhook` +(idempotent, reads the same `REUSE_SURFACE_FORGEJO_WEBHOOK_SECRET` I put +in the K8s Secret directly from the live cluster, never prints it). +Verified live: `GET /api/v1/orgs/coulomb/hooks` shows hook id `1`, active, +`push` events only, pointed at `https://reuse.coulomb.social/v1/webhooks/forgejo`. -- Org-level Forgejo webhook (single config, all repos) → hub - `/v1/webhooks/forgejo`, push events only -- Fallback: Forgejo Actions scheduled workflow (cron) in this repo calling - `POST /v1/recompose`; also serves repos during any Gitea-remnant window -- Migrate this repo's CI `.gitea/workflows/ci.yml` → `.forgejo/workflows/ci.yml` - (Forgejo Actions; verify runner labels); document the pattern for siblings -- Verify end-to-end: index change in a sibling repo → hub `composed_at` - advances without manual compose +**Migrated this repo's own CI, following the existing tier-3 playbook +(`the-custodian/docs/forgejo-repo-migration-pilot-glas-harness.md`, +`railiance-enablement/docs/forgejo-actions-workflow-templates.md` — used +proven patterns rather than improvising):** + +- Created `coulomb/reuse-surface` on Forgejo (`private: false`, matching + every other migrated repo including `state-hub`/`activity-core` — + confirmed via API before asking, then got explicit user sign-off on the + visibility choice specifically, since the auto-mode classifier correctly + flagged "public" as an inferred parameter beyond the general migrate + instruction) +- `.forgejo/workflows/ci.yml`: ported `.gitea/workflows/ci.yml` verbatim + in behavior, but using archive checkout (`wget`+`tar` + `apt install + python3`) instead of `actions/checkout@v4` — this runner's + `ubuntu-latest` label maps to `docker://node:20-bookworm` with no Python + preinstalled and no proven checkout-action support on this substrate +- `.forgejo/workflows/ci-smoke.yaml`: routing probe, copied from the + canonical template (matches sibling convention) +- `.forgejo/workflows/image.yaml`: container build/push to + `forgejo.coulomb.social/coulomb/reuse-surface` (canonical single-repo + template, org secrets `REGISTRY_USER`/`REGISTRY_TOKEN` already existed) +- `.forgejo/workflows/recompose-fallback.yaml`: scheduled (every 6h) `POST + /v1/federated/compose` as a backstop per design principle 3 ("degrade to + schedule") — the webhook above is the primary path; no separate + `/v1/recompose` route exists (see T02 note) +- Removed `.gitea/workflows/ci.yml` (dead once `origin` moves; matches how + `state-hub`/`activity-core`/etc. left no `.gitea/workflows/` behind) +- `origin` → `forgejo-remote:coulomb/reuse-surface.git`, old remote + renamed to `gitea` (kept, read-only, frozen at commit `ac81490` — safety + contract from the migration playbook: never delete the Gitea copy) +- **Live-verified all three workflows green** on the actual push: `ci.yml` + (`validate-registry`, real pytest+validate suite) success; `ci-smoke.yaml` + (`host-smoke` + `container-smoke`) success; `image.yaml` + (`build-and-push`) success — confirmed `reuse-surface:latest` and + `reuse-surface:main-09d5b0f` both landed in the Forgejo container + registry via the packages API + +**Blocked, needs separate explicit sign-off (same boundary as the K8s +Secret write in T02):** adding the `REUSE_SURFACE_TOKEN` repo secret to +Forgejo Actions (needed by `recompose-fallback.yaml` to call the +authenticated compose endpoint) was denied by the auto-mode classifier as +a secret-provisioning action distinct from "migrate to Forgejo" — did not +attempt to work around it. The fallback workflow is deployed and will fail +safely (not silently) until that secret is added; the webhook is the +primary mechanism and is already fully live, so this is a low-priority gap. + +**Not done — moved out of this workplan's scope:** updating +`docs/deploy/reuse-kubernetes.md`/`railiance-apps` to make +`forgejo.coulomb.social` the canonical *production deploy* image registry +(vs. the current live pod, which still runs the `gitea.coulomb.social` +image built in T02 and is working fine). Didn't force another production +redeploy in this same pass; the Forgejo image pipeline is proven and ready +whenever a future deploy wants to switch registries. ## Reuse Telemetry Store And Recording @@ -261,12 +313,12 @@ state_hub_task_id: "a9f44d45-91e2-4b43-909f-30a5f906cf3b" ## Acceptance -- [ ] No hardcoded forge host in code or sources.yaml; `migrate-host` tested -- [ ] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place -- [ ] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`) +- [x] No hardcoded forge host in code or sources.yaml; `migrate-host` tested (T01, 2026-07-07) +- [x] Push to a sibling repo's `registry/indexes/` recomposes the hub index without manual action (webhook), with scheduled fallback in place (T02/T03, 2026-07-07 — webhook live-verified end to end; scheduled fallback deployed, blocked only on a repo secret pending separate sign-off) +- [x] This repo's CI runs on Forgejo Actions (`.forgejo/workflows/`) (T03, 2026-07-07 — `ci.yml`/`ci-smoke.yaml`/`image.yaml` all verified green on the live push) - [ ] Reuse events recordable via hub API and CLI; `report reuse` aggregates them - [ ] R-axis evidence rules for observed reuse documented in the maturity standard -- [ ] Hub freshness visible (`composed_at`, stale flag) in API and stats +- [x] Hub freshness visible (`composed_at`, stale flag) in API and stats (T02, 2026-07-07) ## Out of scope