CUST-WP-0059: Forgejo CI/publish cutover — retire residual gitea workflows

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md

@@ -0,0 +1,130 @@
+---
+id: CUST-WP-0059
+type: workplan
+title: "Forgejo CI/publish cutover — retire residual gitea workflows"
+domain: infotech
+status: active
+owner: codex
+topic_slug: custodian
+planning_priority: medium
+planning_order: 59
+created: "2026-07-16"
+updated: "2026-07-16"
+---
+
+# Forgejo CI/publish cutover — retire residual gitea workflows
+
+## Origin
+
+Follow-up from fixing the state-hub deployment pulling from `gitea.coulomb.social`
+(2026-07-16). Investigation showed **state-hub CI already publishes to Forgejo**
+(`.forgejo/workflows/image.yaml` → `forgejo.coulomb.social/coulomb/state-hub:latest`
++ `:main-<sha>`; ran today → `main-df19c46`). The real residual was two repos whose
+CI still targeted gitea, plus a deployment-tag misalignment.
+
+Gitea is frozen/read-only (package push disabled per RAIL-HO-WP-0005 T11), so these
+gitea workflows no longer run — meaning kaizen-agentic effectively had **no working
+CI/publish** until this cutover.
+
+## Scope
+
+- **issue-core**: had a redundant `.gitea/workflows/publish-python-package.yml`
+  (a working `.forgejo` equivalent already existed) → retired.
+- **kaizen-agentic**: had gitea `ci.yml` (black/flake8/pytest) + gitea publish, but
+  only a routing-probe `.forgejo/ci-smoke.yaml` → added real Forgejo `ci.yml` +
+  `publish-python-package.yml`, retired the gitea ones.
+- **state-hub**: deployment pinned a stale gitea-era tag (`f2e042a`) that Forgejo CI
+  never produces (`main-<sha>`/`latest`) — running deploy fixed manually 2026-07-16;
+  chart/promotion convention alignment tracked here.
+
+Out of scope: container-image build repos already on Forgejo (state-hub image.yaml,
+vergabe-teilnahme, reuse-surface, etc.); gitea server decommission (kept as cold
+fallback until 2026-08-07 per RAIL-HO-WP-0005 T12).
+
+## Task: Retire issue-core redundant gitea publish workflow
+
+```task
+id: CUST-WP-0059-T01
+status: done
+priority: medium
+```
+
+`git rm issue-core/.gitea/workflows/publish-python-package.yml` — the Forgejo
+`publish-python-package.yml` (twine → `/api/packages/coulomb/pypi`) already exists
+and is authoritative. **Done 2026-07-16.**
+
+## Task: Add kaizen-agentic Forgejo publish workflow
+
+```task
+id: CUST-WP-0059-T02
+status: done
+priority: high
+```
+
+Added `kaizen-agentic/.forgejo/workflows/publish-python-package.yml`, modeled on
+issue-core's working Forgejo publish (archive fetch, `python -m build`, twine
+upload to `forgejo.coulomb.social/api/packages/coulomb/pypi`, secrets
+`FORGEJO_PYPI_USER`/`FORGEJO_PYPI_TOKEN`, `runs-on: ubuntu-latest`). **Done.**
+
+## Task: Add kaizen-agentic Forgejo test CI workflow
+
+```task
+id: CUST-WP-0059-T03
+status: done
+priority: high
+```
+
+Added `kaizen-agentic/.forgejo/workflows/ci.yml` preserving the retired gitea
+`ci.yml` coverage (black/flake8/pytest via archive fetch on `ubuntu-latest`).
+Replaces the routing-only `ci-smoke.yaml` for actual test coverage. **Done.**
+
+## Task: Retire kaizen-agentic gitea workflows
+
+```task
+id: CUST-WP-0059-T04
+status: done
+priority: medium
+```
+
+`git rm kaizen-agentic/.gitea/workflows/ci.yml` and
+`.gitea/workflows/publish-python-package.yml` (replaced by the Forgejo workflows
+above). **Done 2026-07-16.**
+
+## Task: Verify Forgejo CI + publish actually run
+
+```task
+id: CUST-WP-0059-T05
+status: todo
+priority: high
+needs_human: true
+```
+
+Confirm the new Forgejo workflows run end-to-end: (1) `FORGEJO_PYPI_USER` /
+`FORGEJO_PYPI_TOKEN` secrets are present (repo or org scope) on issue-core and
+kaizen-agentic; (2) the `ubuntu-latest` runner label resolves on Forgejo Actions;
+(3) a `v*` tag publishes to the Forgejo PyPI registry; (4) kaizen `ci.yml` passes
+(archive fetch + `pip install -e .[dev]` + black/flake8/pytest work on the runner —
+note the runner may lack git, hence archive fetch, and full-SHA archive URLs can
+hang per the state-hub image.yaml note). Fix runner label / secret gaps as found.
+
+**Done when:** a tagged kaizen-agentic release publishes to Forgejo PyPI and its
+Forgejo `ci` run is green.
+
+## Task: Align state-hub deployment tag with Forgejo CI output
+
+```task
+id: CUST-WP-0059-T06
+status: todo
+priority: medium
+```
+
+The state-hub Helm chart `appVersion` and the deployed release pin `f2e042a`
+(gitea-era; manually copied to Forgejo on 2026-07-16 to fix the live pull). Forgejo
+CI produces `main-<sha>` + `latest`. Align the deployment/promotion convention to
+reference a Forgejo CI tag (pin a `main-<sha>` per promotion; update chart
+`appVersion`), and document the promote flow so future builds are tracked without
+manual image copies. Avoid a blind bump to `latest`/newest `main-<sha>` — that is a
+code upgrade past `f2e042a` and must be tested, not a registry fix.
+
+**Done when:** state-hub's chart/release references a Forgejo CI-produced tag and the
+promote flow is documented.