the-custodian/workplans/CUST-WP-0059-forgejo-ci-publish-cutover-tail.md

id	type	title	domain	status	owner	topic_slug	planning_priority	planning_order	created	updated	state_hub_workstream_id
CUST-WP-0059	workplan	Forgejo CI/publish cutover — retire residual gitea workflows	infotech	finished	codex	custodian	medium	59	2026-07-16	2026-07-18	2a9f433a-d105-578a-9864-3e2154283b8f

Forgejo CI/publish cutover — retire residual gitea workflows

Origin

Follow-up from fixing the state-hub deployment pulling from gitea.coulomb.social (2026-07-16). Investigation showed state-hub CI already publishes to Forgejo (.forgejo/workflows/image.yaml → forgejo.coulomb.social/coulomb/state-hub:latest

• :main-<sha>; ran today → main-df19c46). The real residual was two repos whose CI still targeted gitea, plus a deployment-tag misalignment.

Gitea is frozen/read-only (package push disabled per RAIL-HO-WP-0005 T11), so these gitea workflows no longer run — meaning kaizen-agentic effectively had no working CI/publish until this cutover.

Scope

• issue-core: had a redundant .gitea/workflows/publish-python-package.yml (a working .forgejo equivalent already existed) → retired.
• kaizen-agentic: had gitea ci.yml (black/flake8/pytest) + gitea publish, but only a routing-probe .forgejo/ci-smoke.yaml → added real Forgejo ci.yml + publish-python-package.yml, retired the gitea ones.
• state-hub: deployment pinned a stale gitea-era tag (f2e042a) that Forgejo CI never produces (main-<sha>/latest) — running deploy fixed manually 2026-07-16; chart/promotion convention alignment tracked here.

Out of scope: container-image build repos already on Forgejo (state-hub image.yaml, vergabe-teilnahme, reuse-surface, etc.); gitea server decommission (kept as cold fallback until 2026-08-07 per RAIL-HO-WP-0005 T12).

Task: Retire issue-core redundant gitea publish workflow

id: CUST-WP-0059-T01
status: done
priority: medium
state_hub_task_id: "aeab3296-2965-5fee-bbd9-46c6e1b7fb6c"

git rm issue-core/.gitea/workflows/publish-python-package.yml — the Forgejo publish-python-package.yml (twine → /api/packages/coulomb/pypi) already exists and is authoritative. Done 2026-07-16.

Task: Add kaizen-agentic Forgejo publish workflow

id: CUST-WP-0059-T02
status: done
priority: high
state_hub_task_id: "3e76154b-67f8-5331-819e-cb8d26cc905b"

Added kaizen-agentic/.forgejo/workflows/publish-python-package.yml, modeled on issue-core's working Forgejo publish (archive fetch, python -m build, twine upload to forgejo.coulomb.social/api/packages/coulomb/pypi, secrets FORGEJO_PYPI_USER/FORGEJO_PYPI_TOKEN, runs-on: ubuntu-latest). Done.

Task: Add kaizen-agentic Forgejo test CI workflow

id: CUST-WP-0059-T03
status: done
priority: high
state_hub_task_id: "bc6d1c4d-ae97-5cca-a63a-c3c92373322d"

Added kaizen-agentic/.forgejo/workflows/ci.yml preserving the retired gitea ci.yml coverage (black/flake8/pytest via archive fetch on ubuntu-latest). Replaces the routing-only ci-smoke.yaml for actual test coverage. Done.

Task: Retire kaizen-agentic gitea workflows

id: CUST-WP-0059-T04
status: done
priority: medium
state_hub_task_id: "f12654b5-72f4-565b-8f26-8086012d354f"

git rm kaizen-agentic/.gitea/workflows/ci.yml and .gitea/workflows/publish-python-package.yml (replaced by the Forgejo workflows above). Done 2026-07-16.

Task: Verify Forgejo CI + publish actually run

id: CUST-WP-0059-T05
status: done
priority: high
state_hub_task_id: "4999ae16-6e4c-515a-84d7-56ae877beeb2"

Done 2026-07-18. End-to-end verification on Forgejo:

1. Runner label: ubuntu-latest → railiance01-build-01 / node:20-bookworm (works; smoke + real CI both schedule).
2. Secret gap fixed: org secrets FORGEJO_PYPI_USER / FORGEJO_PYPI_TOKEN were missing (only REGISTRY_* existed). Created on org coulomb using the tegwick package-capable PAT (same identity that published issue-core 0.2.1).
3. CI substrate fix: default image has python3 but no pip. Updated kaizen-agentic (and issue-core publish) workflows to apt-get install python3 python3-pip + short-SHA archive checkout (reuse-surface pattern).
4. flake8 blockers: fixed pre-existing E501/F401/F541 so CI can go green.
5. Evidence:
   • kaizen ci.yml run #29 success on d64e500 (black + flake8 + pytest)
   • kaizen publish-python-package.yml run #30 success on tag v1.4.0
   • package index 200: /api/packages/coulomb/pypi/simple/kaizen-agentic/ → kaizen-agentic 1.4.0 (creator tegwick, 2026-07-18T16:11:30Z)
   • issue-core remains 200 at /api/packages/coulomb/pypi/simple/issue-core/

Task: Align state-hub deployment tag with Forgejo CI output

id: CUST-WP-0059-T06
status: done
priority: medium
state_hub_task_id: "0ff075d8-ee23-5d8d-bd69-4284f0211a08"

Done 2026-07-16: promote-flow documented at state-hub/deploy/railiance/apps/charts/state-hub/PROMOTE.md — CI publishes main-<sha>+latest to Forgejo; promotions pin an immutable main-<sha> via helm upgrade --set image.tag=… --atomic and bump chart appVersion. The chart already defaults image.repository to Forgejo; the one-off f2e042a copy is recorded, with the next promotion directed to move onto a main-<sha>.

The state-hub Helm chart appVersion and the deployed release pin f2e042a (gitea-era; manually copied to Forgejo on 2026-07-16 to fix the live pull). Forgejo CI produces main-<sha> + latest. Align the deployment/promotion convention to reference a Forgejo CI tag (pin a main-<sha> per promotion; update chart appVersion), and document the promote flow so future builds are tracked without manual image copies. Avoid a blind bump to latest/newest main-<sha> — that is a code upgrade past f2e042a and must be tested, not a registry fix.

Done when: state-hub's chart/release references a Forgejo CI-produced tag and the promote flow is documented.