fix(ci): verify operator releases through the outward mirror #4

Merged

morten-olsen merged 1 commit from fix/aed0777d-outbound-release-records into main

2026-10-29 21:24:10 +01:00

morten-olsen commented

2026-10-29 21:19:03 +01:00

Owner

Summary

The operator publisher cannot verify private Forgejo from a GitHub hosted runner. Read the refs already pushed outward by Forgejo's existing mirror instead:

approved Forgejo tag → authenticated push mirror → GitHub tag/SHA/main checks → existing publishers

Local --plan still reads authoritative Forgejo. Tag equality, main ancestry, fresh chart/version floors and stage-specific artifact overwrite checks remain. A new read-only hosted probe runs on branch/main checks before publication. Full history is fetched wherever ancestry is checked. Runbook updated in this commit. HOMEIT-434.

Evidence

Before: Postgres Release 40943734697 failed at private Forgejo lookup before image/release creation. The home perimeter intentionally allows Forgejo HTTPS only privately.
After, local: 29 safety tests pass, including real Git mirror publication checks that reject any private Forgejo command, missing/wrong tags, unmerged commits, version reuse and unstable source snapshots. Actual public-mirror read-only probe succeeds for this repository. Workflow YAML parses; diff checks pass.
Hosted, exact head: Release 40947844714 success, Lint 40947844707 success, Tests 40947844636 success, E2E Tests 40947844468 success. The actual source probe passed; all publisher jobs skipped. No publication or rollout is included.

Merge danger

Door: two-way
Main merges validate only and cannot publish an artifact or tag. Reverting restores the unreachable private-source check; existing source tags/artifacts remain.

Blast radius: pipeline
Only this operator's verification jobs and runbook change; runtime code/chart objects, access, credentials, token scopes and public routes are unchanged.

Rollback and verification

Roll back: revert this commit to stop the new check path; do not move/delete source tags or rerun a partial publisher.
Verify after rollout: exact merged-main hosted probe/quality builds green, main publication jobs and Pages skipped, source/mirror refs equal and no mirror error, historical artifacts and live workload pins/digests unchanged. Positive image/release/Pages publication still needs revised exact version/commit approval.
Reviewers: owner self-review. Morten explicitly directed “Skip security engineer” in task comment 01a1894d-3958-794a-bb47-5df201eaa8d2 and selected the existing outward-mirror trust model as sole user of both forges. No additional role handoff.

## Summary The operator publisher cannot verify private Forgejo from a GitHub hosted runner. Read the refs already pushed outward by Forgejo's existing mirror instead: ```text approved Forgejo tag → authenticated push mirror → GitHub tag/SHA/main checks → existing publishers ``` Local `--plan` still reads authoritative Forgejo. Tag equality, main ancestry, fresh chart/version floors and stage-specific artifact overwrite checks remain. A new read-only hosted probe runs on branch/main checks before publication. Full history is fetched wherever ancestry is checked. Runbook updated in this commit. HOMEIT-434. ## Evidence - **Before:** Postgres Release 40943734697 failed at private Forgejo lookup before image/release creation. The home perimeter intentionally allows Forgejo HTTPS only privately. - **After, local:** 29 safety tests pass, including real Git mirror publication checks that reject any private Forgejo command, missing/wrong tags, unmerged commits, version reuse and unstable source snapshots. Actual public-mirror read-only probe succeeds for this repository. Workflow YAML parses; diff checks pass. - **Hosted, exact head:** Release 40947844714 success, Lint 40947844707 success, Tests 40947844636 success, E2E Tests 40947844468 success. The actual source probe passed; all publisher jobs skipped. No publication or rollout is included. ## Merge danger **Door:** two-way Main merges validate only and cannot publish an artifact or tag. Reverting restores the unreachable private-source check; existing source tags/artifacts remain. **Blast radius:** pipeline Only this operator's verification jobs and runbook change; runtime code/chart objects, access, credentials, token scopes and public routes are unchanged. ## Rollback and verification - **Roll back:** revert this commit to stop the new check path; do not move/delete source tags or rerun a partial publisher. - **Verify after rollout:** exact merged-main hosted probe/quality builds green, main publication jobs and Pages skipped, source/mirror refs equal and no mirror error, historical artifacts and live workload pins/digests unchanged. Positive image/release/Pages publication still needs revised exact version/commit approval. - **Reviewers:** owner self-review. Morten explicitly directed “Skip security engineer” in task comment 01a1894d-3958-794a-bb47-5df201eaa8d2 and selected the existing outward-mirror trust model as sole user of both forges. No additional role handoff.

morten-olsen added 1 commit

2026-10-29 21:19:03 +01:00