ai/mission-control
Watch
1
0
Fork
You've already forked mission-control
 0
Code Issues 4 Pull requests 7 Projects Releases 91 Packages 2 Wiki Activity

feat(ci): automatically deploy published Mission Control releases #37

Merged
morten-olsen merged 3 commits from mc/93f5be9d-af49-40ca-bae6-2176088b7802 into main 2026-10-08 18:45:06 +02:00
Conversation 3 Commits 3 Files changed 10 +1067
paperclip commented 2026-10-08 17:50:00 +02:00
Contributor

Summary

Publishing a stable Mission Control release updates the server and agent digest pins together in Forgejo homelab/apps main, removing the manual deployment bump. Both image workflows must succeed for the same resolved source SHA. The updater validates published release metadata, tag/main ancestry and immutable linux/amd64 digests, renders the fresh chart, then writes only image.tag and agentImage in one commit.

A normal non-force Git push guards the entire rendered main revision. Any competing main commit, including globals/template changes with an unchanged values blob, causes a fresh read and render. Retries are bounded to three writes; older releases skip, identical pairs are no-ops, and same-version changed digests fail.

The authorized existing Renovate token is injected only into trusted updater/access steps. Fixed-origin metadata rejects redirects; only the fixed Git push receives a URL-scoped authentication header through its environment. Credentials stay out of arguments, URLs, files and output. New steps have bounded CPU, memory and ephemeral storage.

Evidence

  • 20 focused tests pass, including a real bare-Git globals-only concurrency regression, authorization denial and uncertain acknowledgement with synthetic credentials. ESLint and diff checks pass; strict Woodpecker lint validates all 11 workflows and the checker validates 55 event renderings.
  • Prior head b44086e: CI188/190 green. DevOps/Security found no blocking implementation findings; SRE identified the revision race, now fixed in d1f4c7f. Fresh same-head CI and all three reviews are required before merge.
  • Prior actual read-only adapter verified published v0.13.0 source/digests and chart fields from apps f1f2b389; chart lint/schema/render tests and all-object server dry-run passed. No apps or cluster mutations.
  • Confirmed spec: aefe6183-b67c-4604-8694-67759f92855f, comments 6d498572-08e1-4732-b1ab-66ac57ff2891 and de1d9d17-6b2f-4c78-9406-abac6c3812f7.

Merge danger

Two-way for the workflow: revert disables future updates. Already-produced apps commits require their own Git revert; published releases are irreversible. Future qualifying releases restart the existing single SQLite server using Recreate. No migration, storage, exposure or credential change.

Verification and rollback

After merge: green main build and access-verified, followed by an approved real release. Verify both same-SHA image publications, updater success, exact two-field apps commit, mirror, ArgoCD expected revision Synced/Healthy, actual server/agent digests, readiness/health and a newly launched agent. Live acceptance remains pending.

Rollback: pause/drain updater runs, revert only the apps pair preserving unrelated commits, follow mirror/ArgoCD/workload back to known-good digests; revert this PR to disable the updater. No automatic restore. Software Engineer retains implementation and rollout ownership.

## Summary Publishing a stable Mission Control release updates the server and agent digest pins together in Forgejo homelab/apps main, removing the manual deployment bump. Both image workflows must succeed for the same resolved source SHA. The updater validates published release metadata, tag/main ancestry and immutable linux/amd64 digests, renders the fresh chart, then writes only image.tag and agentImage in one commit. A normal non-force Git push guards the entire rendered main revision. Any competing main commit, including globals/template changes with an unchanged values blob, causes a fresh read and render. Retries are bounded to three writes; older releases skip, identical pairs are no-ops, and same-version changed digests fail. The authorized existing Renovate token is injected only into trusted updater/access steps. Fixed-origin metadata rejects redirects; only the fixed Git push receives a URL-scoped authentication header through its environment. Credentials stay out of arguments, URLs, files and output. New steps have bounded CPU, memory and ephemeral storage. ## Evidence - 20 focused tests pass, including a real bare-Git globals-only concurrency regression, authorization denial and uncertain acknowledgement with synthetic credentials. ESLint and diff checks pass; strict Woodpecker lint validates all 11 workflows and the checker validates 55 event renderings. - Prior head b44086e: CI188/190 green. DevOps/Security found no blocking implementation findings; SRE identified the revision race, now fixed in d1f4c7f. Fresh same-head CI and all three reviews are required before merge. - Prior actual read-only adapter verified published v0.13.0 source/digests and chart fields from apps f1f2b389; chart lint/schema/render tests and all-object server dry-run passed. No apps or cluster mutations. - Confirmed spec: aefe6183-b67c-4604-8694-67759f92855f, comments 6d498572-08e1-4732-b1ab-66ac57ff2891 and de1d9d17-6b2f-4c78-9406-abac6c3812f7. ## Merge danger Two-way for the workflow: revert disables future updates. Already-produced apps commits require their own Git revert; published releases are irreversible. Future qualifying releases restart the existing single SQLite server using Recreate. No migration, storage, exposure or credential change. ## Verification and rollback After merge: green main build and access-verified, followed by an approved real release. Verify both same-SHA image publications, updater success, exact two-field apps commit, mirror, ArgoCD expected revision Synced/Healthy, actual server/agent digests, readiness/health and a newly launched agent. Live acceptance remains pending. Rollback: pause/drain updater runs, revert only the apps pair preserving unrelated commits, follow mirror/ArgoCD/workload back to known-good digests; revert this PR to disable the updater. No automatic restore. Software Engineer retains implementation and rollout ownership.
feat(ci): deploy published releases through apps GitOps
Some checks failed
ci/woodpecker/push/quality Pipeline was successful
Details
ci/woodpecker/pr/quality Pipeline was successful
Details
ci/woodpecker/pr/image-agent Pipeline was successful
Details
ci/woodpecker/push/docs Pipeline was successful
Details
ci/woodpecker/pr/docs Pipeline was successful
Details
ci/woodpecker/pr/image Pipeline was canceled
Details
61759dd376
fix(ci): render release bumps with current GitOps globals
All checks were successful
ci/woodpecker/push/docs Pipeline was successful
Details
ci/woodpecker/pr/image-agent Pipeline was successful
Details
ci/woodpecker/push/quality Pipeline was successful
Details
ci/woodpecker/pr/quality Pipeline was successful
Details
ci/woodpecker/pr/docs Pipeline was successful
Details
ci/woodpecker/pr/image Pipeline was successful
Details
b44086ebe7
fix(ci): guard release bumps against rendered apps revision
All checks were successful
ci/woodpecker/push/quality Pipeline was successful
Details
ci/woodpecker/pr/image Pipeline was successful
Details
ci/woodpecker/pr/quality Pipeline was successful
Details
ci/woodpecker/pr/image-agent Pipeline was successful
Details
ci/woodpecker/push/docs Pipeline was successful
Details
ci/woodpecker/pr/docs Pipeline was successful
Details
d1f4c7fd02
paperclip reviewed 2026-10-08 18:37:30 +02:00
paperclip left a comment

Security re-review pinned to d1f4c7fd02, increment b44086e..d1f4c7f and full origin/main...HEAD. Reviewed confirmed spec aefe6183-b67c-4604-8694-67759f92855f, change-review (including smell baseline), Homelab AGENTS.md/security-operations/security-perimeter and apps AGENTS.md. Mission Control has no applicable root AGENTS.md/CONTRIBUTING/CODING_STANDARDS in this checkout. Separate review/security-d1f4c7f branch; author checkout untouched.

Standards

No blocking findings.

  • Non-blocking / HIGH authority context (previously approved, not a new vulnerability claim): compromise of the trusted updater process exposes the existing all-repository Renovate token and therefore repository write authority beyond the two-field allowlist, potentially affecting GitOps-controlled workloads. Morten explicitly authorized this existing credential and scope; this diff adds no credentials/scopes, cluster access, exposure, RBAC or privileged-container changes. The fixed updater image is digest pinned.
  • Verified authenticated metadata is limited to fixed apps permission GET and identity GET, redirects rejected; validated identity becomes commit attribution/Basic username. Only fixed HTTPS apps Git push gets URL-scoped Basic extraHeader through environment. Push arguments/URL contain no credential; helpers/hooks/prompts/redirects and inherited GIT_* tracing/config environment are disabled for that push. Ordinary child environments drop DEPLOY_TOKEN and GIT_*; tool/dependency installation drops DEPLOY_TOKEN. Raw subprocess output is captured rather than emitted; denial produces a fixed message and uncertain failures force reread. No real credential was read or used by this review.
  • Non-blocking / validation limit: childEnvironment filters credential/GIT variables; it is not a complete environment or global Git-config isolation boundary. This relies on the trusted pinned CI image and trusted runtime configuration, as does execution of the updater itself. Synthetic tests verify arguments/header/environment controls and absence from Git config/commit message, not actual remote HTTP credential delivery or every runtime side channel. No scope expansion or redesign requested.

Spec

No blocking findings.

  • Revision concurrency now guards the entire rendered tree: checkout HEAD equals snapshot.revision, commit HEAD^ must equal that revision, staged-path check permits only the fixed values file, and a normal non-force push uses HEAD:refs/heads/main. The real bare-Git globals-only regression demonstrates rejection/reread/rerender even with unchanged values blob. Existing scalar/key checks preserve the exact pair and unrelated content.
  • Confirmed stable published-release/main-source and same-CI-SHA checks, both image workflow dependencies, immutable digest validation, forward-only/no-op behavior, three-write bound, and uncertain-acknowledgement reread remain intact. Source/release checks repeat immediately before each write.
  • Non-blocking / UNKNOWN live acceptance: real trusted-main token access and real tag-event Git push/rollout have not been exercised. A read-only permissions GET is not proof that the push succeeds. Owner must verify this before calling deployment complete. Main migration026 means the first actual migration/release remains explicitly subject to Morten's approval.

Evidence and limits

Independent anonymous CI API read: GET https://woodpecker.olsen.cloud/api/repos/32/pipelines/195 -> number195, status success, commit d1f4c7fd02; docs/image-agent/image/quality all success. Owner parent evidence a795f7be-bab9-44cf-89b7-5c15067a3f1d records 80 files/685 tests and focused20/strict workflow checks in handoff. Local focused command pnpm test scripts/deploy-release.test.ts scripts/deploy-release-git.test.ts not rerun: pnpm and installed Vitest absent in this isolated checkout; exact-head CI success was independently seen. Static code/test review plus independent CI/live baseline, not live-release acceptance.
Independent kubectl get deployment mission-control -n prod -o jsonpath='{.status.readyReplicas}/{.spec.replicas}' -> 1/1. kubectl get application mission-control -n argocd -o jsonpath='{.status.sync.revision} {.status.sync.status} {.status.health.status}' -> f1f2b38909bc9d643f0f1be23c11d4382788f419 Synced Healthy. No mutation, logs, Secrets or ConfigMaps read. Git diff --check passed; checkout clean.

Required live acceptance and rollback

Software Engineer retains parent. After other required validators finish, verify green trusted-main access step; obtain Morten's explicit first migration/release approval. Follow one published eligible release: both successful same-source image workflows and registry digests, updater status/revision, exact two-field commit, preserved unrelated changes, mirror, ArgoCD expected revision, actual paired image digests, readiness/health and newly launched agent. Report failures without raw credential-bearing subprocess output.
Rollback: pause/drain updater runs, normal GitOps revert of just the pair preserving intervening commits, follow mirror/ArgoCD and workload back to known-good compatible digests; revert workflow to disable future updates if needed. Data/schema restore or migration choices stay with Morten.

Standards: 0 blocking, 2 non-blocking (worst HIGH approved authority context). Spec: 0 blocking, 1 non-blocking (worst UNKNOWN live acceptance).

Review by the Security Engineer role, an agent in Mission Control, for the task Improve mission control deployment.

Security re-review pinned to d1f4c7fd0219f4c2950a875491854f8deb967095, increment b44086e..d1f4c7f and full origin/main...HEAD. Reviewed confirmed spec aefe6183-b67c-4604-8694-67759f92855f, change-review (including smell baseline), Homelab AGENTS.md/security-operations/security-perimeter and apps AGENTS.md. Mission Control has no applicable root AGENTS.md/CONTRIBUTING/CODING_STANDARDS in this checkout. Separate review/security-d1f4c7f branch; author checkout untouched. ## Standards No blocking findings. - Non-blocking / HIGH authority context (previously approved, not a new vulnerability claim): compromise of the trusted updater process exposes the existing all-repository Renovate token and therefore repository write authority beyond the two-field allowlist, potentially affecting GitOps-controlled workloads. Morten explicitly authorized this existing credential and scope; this diff adds no credentials/scopes, cluster access, exposure, RBAC or privileged-container changes. The fixed updater image is digest pinned. - Verified authenticated metadata is limited to fixed apps permission GET and identity GET, redirects rejected; validated identity becomes commit attribution/Basic username. Only fixed HTTPS apps Git push gets URL-scoped Basic extraHeader through environment. Push arguments/URL contain no credential; helpers/hooks/prompts/redirects and inherited GIT_* tracing/config environment are disabled for that push. Ordinary child environments drop DEPLOY_TOKEN and GIT_*; tool/dependency installation drops DEPLOY_TOKEN. Raw subprocess output is captured rather than emitted; denial produces a fixed message and uncertain failures force reread. No real credential was read or used by this review. - Non-blocking / validation limit: childEnvironment filters credential/GIT variables; it is not a complete environment or global Git-config isolation boundary. This relies on the trusted pinned CI image and trusted runtime configuration, as does execution of the updater itself. Synthetic tests verify arguments/header/environment controls and absence from Git config/commit message, not actual remote HTTP credential delivery or every runtime side channel. No scope expansion or redesign requested. ## Spec No blocking findings. - Revision concurrency now guards the entire rendered tree: checkout HEAD equals snapshot.revision, commit HEAD^ must equal that revision, staged-path check permits only the fixed values file, and a normal non-force push uses HEAD:refs/heads/main. The real bare-Git globals-only regression demonstrates rejection/reread/rerender even with unchanged values blob. Existing scalar/key checks preserve the exact pair and unrelated content. - Confirmed stable published-release/main-source and same-CI-SHA checks, both image workflow dependencies, immutable digest validation, forward-only/no-op behavior, three-write bound, and uncertain-acknowledgement reread remain intact. Source/release checks repeat immediately before each write. - Non-blocking / UNKNOWN live acceptance: real trusted-main token access and real tag-event Git push/rollout have not been exercised. A read-only permissions GET is not proof that the push succeeds. Owner must verify this before calling deployment complete. Main migration026 means the first actual migration/release remains explicitly subject to Morten's approval. ## Evidence and limits Independent anonymous CI API read: GET https://woodpecker.olsen.cloud/api/repos/32/pipelines/195 -> number195, status success, commit d1f4c7fd0219f4c2950a875491854f8deb967095; docs/image-agent/image/quality all success. Owner parent evidence a795f7be-bab9-44cf-89b7-5c15067a3f1d records 80 files/685 tests and focused20/strict workflow checks in handoff. Local focused command `pnpm test scripts/deploy-release.test.ts scripts/deploy-release-git.test.ts` not rerun: pnpm and installed Vitest absent in this isolated checkout; exact-head CI success was independently seen. Static code/test review plus independent CI/live baseline, not live-release acceptance. Independent `kubectl get deployment mission-control -n prod -o jsonpath='{.status.readyReplicas}/{.spec.replicas}'` -> 1/1. `kubectl get application mission-control -n argocd -o jsonpath='{.status.sync.revision} {.status.sync.status} {.status.health.status}'` -> f1f2b38909bc9d643f0f1be23c11d4382788f419 Synced Healthy. No mutation, logs, Secrets or ConfigMaps read. Git diff --check passed; checkout clean. ## Required live acceptance and rollback Software Engineer retains parent. After other required validators finish, verify green trusted-main access step; obtain Morten's explicit first migration/release approval. Follow one published eligible release: both successful same-source image workflows and registry digests, updater status/revision, exact two-field commit, preserved unrelated changes, mirror, ArgoCD expected revision, actual paired image digests, readiness/health and newly launched agent. Report failures without raw credential-bearing subprocess output. Rollback: pause/drain updater runs, normal GitOps revert of just the pair preserving intervening commits, follow mirror/ArgoCD and workload back to known-good compatible digests; revert workflow to disable future updates if needed. Data/schema restore or migration choices stay with Morten. Standards: 0 blocking, 2 non-blocking (worst HIGH approved authority context). Spec: 0 blocking, 1 non-blocking (worst UNKNOWN live acceptance). --- _Review by the **Security Engineer** role, an agent in Mission Control, for the task [Improve mission control deployment](https://mission-control.olsen.cloud/home-it/tasks/93f5be9d-af49-40ca-bae6-2176088b7802)._
paperclip reviewed 2026-10-08 18:37:53 +02:00
paperclip left a comment

DevOps re-review of PR37 at d1f4c7fd02, specifically b44086e..d1f4c7f; also reconfirmed the full release workflow/policy against confirmed specification aefe6183-b67c-4604-8694-67759f92855f. Own clean checkout: review/devops-d1f4c7f. Read Homelab AGENTS.md (Git and deployment/boundaries), current apps origin/main AGENTS.md, change-review (including smells), delivery-path and shared CI skill. Mission Control has no root AGENTS.md or CONTRIBUTING.md.

Standards

No blocking findings. The new updater runner is digest pinned with resource bounds; workflow/token documentation changed with transport. Push is fixed to https://code.olsen.cloud/homelab/apps.git and HEAD:refs/heads/main, with no force, redirect following, credential helper or hooks. Authenticated /api/v1/user supplies the actual PAT login for Basic Git auth and commit identity. Ordinary children strip DEPLOY_TOKEN and inherited GIT_*; push alone receives a URL-scoped header via environment, with captured/sanitized errors. Only the values file is staged and committed. No GitHub remote/write, chart/sync-wave/prune change or cluster credentials added. Existing latest-tag image build plugins are unchanged by this increment; their reproducibility remains the existing platform limitation, not a newly introduced transport defect.

Validation: independently ran woodpecker-cli lint --strict .woodpecker/*.yaml: all 11 valid. HEAD verified d1f4c7f; git status clean. Static review plus owner-confirmed build: parent comment a795f7be-bab9-44cf-89b7-5c15067a3f1d confirms CI195 PR SUCCESS (quality/docs/server image/agent image) and CI194 branch SUCCESS at this exact SHA, 80 files/685 tests, plus 20 focused tests/local quality and 55 event renderings. I could not independently fetch CI195: curl failed to connect to woodpecker.olsen.cloud:443. Focused local test command mise exec -- pnpm exec vitest run scripts/deploy-release.test.ts scripts/deploy-release-git.test.ts did not execute tests: pnpm unavailable and project node_modules absent. Do not represent these as independently run/passed. Owner must reconfirm unchanged PR head and green CI immediately before merge.

Spec

No blocking findings. Commit checks both precommit HEAD==snapshot.revision and postcommit HEAD^==snapshot.revision; ordinary non-force push rejects an intervening main revision even when the values blob is unchanged. Fresh fetch/reset/replan/render on rejection preserves unrelated commits. Real bare-Git test introduces exactly that globals-only race and checks rerender/new parent, retained competitor and no credential in config/log/arguments. Synthetic denied/uncertain transport tests complement policy tests covering three-write bound, final reread, already-current/superseded recovery and visible exhaustion.

Reconfirmed unchanged gates: deploy depends on both tag image workflows in the same pipeline/SHA; canonical stable tag, published non-draft/non-prerelease release, exact release/tag/CI source and main ancestry checks, recheck before each write, linux/amd64 manifest/config digest checks, forward-only numeric ordering, identical no-op and same-version changed-digest failure. Only image.tag/agentImage change, with preserved formatting and render validation using the exact target revision's globals. Binary assets do not gate deployment.

Non-blocking acceptance clarification: trusted-main --check-access proves API-reported homelab/apps push permission, not successful Git HTTP authentication or branch-policy acceptance. Code now obtains the real identity, but synthetic transport regressions cannot prove the production token/Forgejo combination. Require the trusted-main access workflow to succeed before publishing the first release; record actual Git transport success during the approved real release. No secret/permission widening or bypass is authorized.

Required live acceptance (Software Engineer owns): obtain Morten's explicit first-release and migration026 approval (main independently advanced to 2b87a06); quote both tag publication results and updater outcome, resolved digest pair, exact apps commit/parent/two-key diff, Forgejo push-mirror target revision/error and GitHub matching revision, ArgoCD expected revision plus actual Deployment server image/MC_AGENT_IMAGE, readiness/health and newly launched agent digest. Verify no manual Renovate/values edit was needed. Owner baseline remains server0.13.0 ready1/1, ArgoCD f1f2b389 Synced Healthy; no live release acceptance has occurred, and I have no private cluster access. Healthy alone is insufficient. The root Helm release's effective globals must match the renderer's Git globals for acceptance; apps/root changes require their separately controlled Helm rollout per delivery-path.

Rollback: pause/drain updater runs; revert only the image pair to recorded known-good digests through normal Forgejo GitOps, preserving intervening commits; follow mirror/ArgoCD and inspect actual fields/health. Disable faulty updater separately if needed; reverting workflow does not undo an existing apps commit. Resume only after delayed newer runs cannot reverse rollback. Migration/data compatibility or restore decisions stay with Morten.

Standards: 0 blocking findings; existing plugin pinning limitation noted. Spec: 0 blocking findings, 1 non-blocking acceptance clarification (API access verification is not actual Git push proof).

Review by the DevOps Engineer role, an agent in Mission Control, for the task Improve mission control deployment.

DevOps re-review of PR37 at d1f4c7fd0219f4c2950a875491854f8deb967095, specifically b44086e..d1f4c7f; also reconfirmed the full release workflow/policy against confirmed specification aefe6183-b67c-4604-8694-67759f92855f. Own clean checkout: review/devops-d1f4c7f. Read Homelab AGENTS.md (Git and deployment/boundaries), current apps origin/main AGENTS.md, change-review (including smells), delivery-path and shared CI skill. Mission Control has no root AGENTS.md or CONTRIBUTING.md. ## Standards No blocking findings. The new updater runner is digest pinned with resource bounds; workflow/token documentation changed with transport. Push is fixed to https://code.olsen.cloud/homelab/apps.git and HEAD:refs/heads/main, with no force, redirect following, credential helper or hooks. Authenticated /api/v1/user supplies the actual PAT login for Basic Git auth and commit identity. Ordinary children strip DEPLOY_TOKEN and inherited GIT_*; push alone receives a URL-scoped header via environment, with captured/sanitized errors. Only the values file is staged and committed. No GitHub remote/write, chart/sync-wave/prune change or cluster credentials added. Existing latest-tag image build plugins are unchanged by this increment; their reproducibility remains the existing platform limitation, not a newly introduced transport defect. Validation: independently ran woodpecker-cli lint --strict .woodpecker/*.yaml: all 11 valid. HEAD verified d1f4c7f; git status clean. Static review plus owner-confirmed build: parent comment a795f7be-bab9-44cf-89b7-5c15067a3f1d confirms CI195 PR SUCCESS (quality/docs/server image/agent image) and CI194 branch SUCCESS at this exact SHA, 80 files/685 tests, plus 20 focused tests/local quality and 55 event renderings. I could not independently fetch CI195: curl failed to connect to woodpecker.olsen.cloud:443. Focused local test command mise exec -- pnpm exec vitest run scripts/deploy-release.test.ts scripts/deploy-release-git.test.ts did not execute tests: pnpm unavailable and project node_modules absent. Do not represent these as independently run/passed. Owner must reconfirm unchanged PR head and green CI immediately before merge. ## Spec No blocking findings. Commit checks both precommit HEAD==snapshot.revision and postcommit HEAD^==snapshot.revision; ordinary non-force push rejects an intervening main revision even when the values blob is unchanged. Fresh fetch/reset/replan/render on rejection preserves unrelated commits. Real bare-Git test introduces exactly that globals-only race and checks rerender/new parent, retained competitor and no credential in config/log/arguments. Synthetic denied/uncertain transport tests complement policy tests covering three-write bound, final reread, already-current/superseded recovery and visible exhaustion. Reconfirmed unchanged gates: deploy depends on both tag image workflows in the same pipeline/SHA; canonical stable tag, published non-draft/non-prerelease release, exact release/tag/CI source and main ancestry checks, recheck before each write, linux/amd64 manifest/config digest checks, forward-only numeric ordering, identical no-op and same-version changed-digest failure. Only image.tag/agentImage change, with preserved formatting and render validation using the exact target revision's globals. Binary assets do not gate deployment. Non-blocking acceptance clarification: trusted-main --check-access proves API-reported homelab/apps push permission, not successful Git HTTP authentication or branch-policy acceptance. Code now obtains the real identity, but synthetic transport regressions cannot prove the production token/Forgejo combination. Require the trusted-main access workflow to succeed before publishing the first release; record actual Git transport success during the approved real release. No secret/permission widening or bypass is authorized. Required live acceptance (Software Engineer owns): obtain Morten's explicit first-release and migration026 approval (main independently advanced to 2b87a06); quote both tag publication results and updater outcome, resolved digest pair, exact apps commit/parent/two-key diff, Forgejo push-mirror target revision/error and GitHub matching revision, ArgoCD expected revision plus actual Deployment server image/MC_AGENT_IMAGE, readiness/health and newly launched agent digest. Verify no manual Renovate/values edit was needed. Owner baseline remains server0.13.0 ready1/1, ArgoCD f1f2b389 Synced Healthy; no live release acceptance has occurred, and I have no private cluster access. Healthy alone is insufficient. The root Helm release's effective globals must match the renderer's Git globals for acceptance; apps/root changes require their separately controlled Helm rollout per delivery-path. Rollback: pause/drain updater runs; revert only the image pair to recorded known-good digests through normal Forgejo GitOps, preserving intervening commits; follow mirror/ArgoCD and inspect actual fields/health. Disable faulty updater separately if needed; reverting workflow does not undo an existing apps commit. Resume only after delayed newer runs cannot reverse rollback. Migration/data compatibility or restore decisions stay with Morten. Standards: 0 blocking findings; existing plugin pinning limitation noted. Spec: 0 blocking findings, 1 non-blocking acceptance clarification (API access verification is not actual Git push proof). --- _Review by the **DevOps Engineer** role, an agent in Mission Control, for the task [Improve mission control deployment](https://mission-control.olsen.cloud/home-it/tasks/93f5be9d-af49-40ca-bae6-2176088b7802)._
morten-olsen deleted branch mc/93f5be9d-af49-40ca-bae6-2176088b7802 2026-10-08 18:45:06 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
morten-olsen
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ai/mission-control!37
No description provided.