--- id: CUST-WP-0059 type: workplan title: "Forgejo CI/publish cutover — retire residual gitea workflows" domain: infotech status: finished owner: codex topic_slug: custodian planning_priority: medium planning_order: 59 created: "2026-07-16" updated: "2026-07-18" state_hub_workstream_id: "2a9f433a-d105-578a-9864-3e2154283b8f" --- # Forgejo CI/publish cutover — retire residual gitea workflows ## Origin Follow-up from fixing the state-hub deployment pulling from `gitea.coulomb.social` (2026-07-16). Investigation showed **state-hub CI already publishes to Forgejo** (`.forgejo/workflows/image.yaml` → `forgejo.coulomb.social/coulomb/state-hub:latest` + `:main-`; ran today → `main-df19c46`). The real residual was two repos whose CI still targeted gitea, plus a deployment-tag misalignment. Gitea is frozen/read-only (package push disabled per RAIL-HO-WP-0005 T11), so these gitea workflows no longer run — meaning kaizen-agentic effectively had **no working CI/publish** until this cutover. ## Scope - **issue-core**: had a redundant `.gitea/workflows/publish-python-package.yml` (a working `.forgejo` equivalent already existed) → retired. - **kaizen-agentic**: had gitea `ci.yml` (black/flake8/pytest) + gitea publish, but only a routing-probe `.forgejo/ci-smoke.yaml` → added real Forgejo `ci.yml` + `publish-python-package.yml`, retired the gitea ones. - **state-hub**: deployment pinned a stale gitea-era tag (`f2e042a`) that Forgejo CI never produces (`main-`/`latest`) — running deploy fixed manually 2026-07-16; chart/promotion convention alignment tracked here. Out of scope: container-image build repos already on Forgejo (state-hub image.yaml, vergabe-teilnahme, reuse-surface, etc.); gitea server decommission (kept as cold fallback until 2026-08-07 per RAIL-HO-WP-0005 T12). ## Task: Retire issue-core redundant gitea publish workflow ```task id: CUST-WP-0059-T01 status: done priority: medium state_hub_task_id: "aeab3296-2965-5fee-bbd9-46c6e1b7fb6c" ``` `git rm issue-core/.gitea/workflows/publish-python-package.yml` — the Forgejo `publish-python-package.yml` (twine → `/api/packages/coulomb/pypi`) already exists and is authoritative. **Done 2026-07-16.** ## Task: Add kaizen-agentic Forgejo publish workflow ```task id: CUST-WP-0059-T02 status: done priority: high state_hub_task_id: "3e76154b-67f8-5331-819e-cb8d26cc905b" ``` Added `kaizen-agentic/.forgejo/workflows/publish-python-package.yml`, modeled on issue-core's working Forgejo publish (archive fetch, `python -m build`, twine upload to `forgejo.coulomb.social/api/packages/coulomb/pypi`, secrets `FORGEJO_PYPI_USER`/`FORGEJO_PYPI_TOKEN`, `runs-on: ubuntu-latest`). **Done.** ## Task: Add kaizen-agentic Forgejo test CI workflow ```task id: CUST-WP-0059-T03 status: done priority: high state_hub_task_id: "bc6d1c4d-ae97-5cca-a63a-c3c92373322d" ``` Added `kaizen-agentic/.forgejo/workflows/ci.yml` preserving the retired gitea `ci.yml` coverage (black/flake8/pytest via archive fetch on `ubuntu-latest`). Replaces the routing-only `ci-smoke.yaml` for actual test coverage. **Done.** ## Task: Retire kaizen-agentic gitea workflows ```task id: CUST-WP-0059-T04 status: done priority: medium state_hub_task_id: "f12654b5-72f4-565b-8f26-8086012d354f" ``` `git rm kaizen-agentic/.gitea/workflows/ci.yml` and `.gitea/workflows/publish-python-package.yml` (replaced by the Forgejo workflows above). **Done 2026-07-16.** ## Task: Verify Forgejo CI + publish actually run ```task id: CUST-WP-0059-T05 status: done priority: high state_hub_task_id: "4999ae16-6e4c-515a-84d7-56ae877beeb2" ``` **Done 2026-07-18.** End-to-end verification on Forgejo: 1. **Runner label:** `ubuntu-latest` → `railiance01-build-01` / `node:20-bookworm` (works; smoke + real CI both schedule). 2. **Secret gap fixed:** org secrets `FORGEJO_PYPI_USER` / `FORGEJO_PYPI_TOKEN` were missing (only `REGISTRY_*` existed). Created on org `coulomb` using the tegwick package-capable PAT (same identity that published issue-core 0.2.1). 3. **CI substrate fix:** default image has python3 but no pip. Updated `kaizen-agentic` (and issue-core publish) workflows to `apt-get install python3 python3-pip` + short-SHA archive checkout (reuse-surface pattern). 4. **flake8 blockers:** fixed pre-existing E501/F401/F541 so CI can go green. 5. **Evidence:** - kaizen `ci.yml` run #29 **success** on `d64e500` (black + flake8 + pytest) - kaizen `publish-python-package.yml` run #30 **success** on tag `v1.4.0` - package index `200`: `/api/packages/coulomb/pypi/simple/kaizen-agentic/` → `kaizen-agentic 1.4.0` (creator tegwick, 2026-07-18T16:11:30Z) - issue-core remains `200` at `/api/packages/coulomb/pypi/simple/issue-core/` ## Task: Align state-hub deployment tag with Forgejo CI output ```task id: CUST-WP-0059-T06 status: done priority: medium state_hub_task_id: "0ff075d8-ee23-5d8d-bd69-4284f0211a08" ``` **Done 2026-07-16:** promote-flow documented at `state-hub/deploy/railiance/apps/charts/state-hub/PROMOTE.md` — CI publishes `main-`+`latest` to Forgejo; promotions pin an immutable `main-` via `helm upgrade --set image.tag=… --atomic` and bump chart `appVersion`. The chart already defaults `image.repository` to Forgejo; the one-off `f2e042a` copy is recorded, with the next promotion directed to move onto a `main-`. The state-hub Helm chart `appVersion` and the deployed release pin `f2e042a` (gitea-era; manually copied to Forgejo on 2026-07-16 to fix the live pull). Forgejo CI produces `main-` + `latest`. Align the deployment/promotion convention to reference a Forgejo CI tag (pin a `main-` per promotion; update chart `appVersion`), and document the promote flow so future builds are tracked without manual image copies. Avoid a blind bump to `latest`/newest `main-` — that is a code upgrade past `f2e042a` and must be tested, not a registry fix. **Done when:** state-hub's chart/release references a Forgejo CI-produced tag and the promote flow is documented.