Publish and deploy the public documentation bundle #2

New issue

Closed

opened 2026-09-24 19:04:16 -05:00 by kiyi · 1 comment

kiyi commented

2026-09-24 19:04:16 -05:00

Member

Track the public Documentation release and deployment. Keep this issue open until the site is verified live. Status as of 2026-09-25:

Confirm the site and source-security checks on the merged main commit.
Publish the scanned image from main; signed image release records digest sha256:84cb656784f22ade024943fad8a947c9b6eab5a5865b43562955e3f05d9552e7.
Pin that digest in manifests/prod/workload.yaml and zarf.yaml through reviewed PR 7, merged as 280337a428. Local npm run check, npm run check:deployment:published, and npm run build passed.
Run the protected signed-bundle pipeline; signed bundle release is published.
Verify DNS, the existing tenant gateway and wildcard certificate, and no conflicting VirtualService for doc.app.gitchegumi.com.
Dispatch Deploy signed documentation bundle from this repository on protected main with the exact release tag. Verify signature/hash, fresh security decision, target preflight, rollout, public HTTPS, and no SSO redirect. Record the deployed version and rollback release.

The first deploy run stopped before downloading release metadata files: managed credential issuance and 117 required/11 forbidden Kubernetes permission checks passed, then the scoped release-read request for app.json returned HTTP 500 from Forgejo. The same asset downloaded in the signed-in kiyi browser. Correlate this run with Forgejo attachment-handler and reverse-proxy logs before treating the release as deployable. The repository README contains the pipeline procedure.

Track the public Documentation release and deployment. Keep this issue open until the site is verified live. Status as of 2026-09-25: - [x] Confirm the site and source-security checks on the merged `main` commit. - [x] Publish the scanned image from `main`; [signed image release](https://git.gitchegumi.com/Homelab/Documentation/releases/tag/image-838c25bf814569d74922763b2e958c64ea6d65c4-4954) records digest `sha256:84cb656784f22ade024943fad8a947c9b6eab5a5865b43562955e3f05d9552e7`. - [x] Pin that digest in `manifests/prod/workload.yaml` and `zarf.yaml` through [reviewed PR 7](https://git.gitchegumi.com/Homelab/Documentation/pulls/7), merged as `280337a428`. Local `npm run check`, `npm run check:deployment:published`, and `npm run build` passed. - [x] Run the protected signed-bundle pipeline; [signed bundle release](https://git.gitchegumi.com/Homelab/Documentation/releases/tag/ci-280337a428763a867645656f4395c14eb76730be-5066) is published. - [x] Verify DNS, the existing tenant gateway and wildcard certificate, and no conflicting VirtualService for `doc.app.gitchegumi.com`. - [x] Dispatch **Deploy signed documentation bundle** from this repository on protected `main` with the exact release tag. Verify signature/hash, fresh security decision, target preflight, rollout, public HTTPS, and no SSO redirect. Record the deployed version and rollback release. The first [deploy run](https://git.gitchegumi.com/Homelab/Documentation/actions/runs/36/jobs/1/attempt/1) stopped before downloading release metadata files: managed credential issuance and 117 required/11 forbidden Kubernetes permission checks passed, then the scoped release-read request for `app.json` returned HTTP 500 from Forgejo. The same asset downloaded in the signed-in `kiyi` browser. Correlate this run with Forgejo attachment-handler and reverse-proxy logs before treating the release as deployable. The repository README contains the pipeline procedure.

kiyi added this to the Homelab Roadmap project

2026-09-24 19:04:26 -05:00

kiyi referenced this issue

2026-09-24 23:09:06 -05:00

Make public documentation read like homelab notes #6