Record Core Actions inputs and recovery procedure #11

Merged

gitchegumi merged 4 commits from kiyi/core-workflow-delivery into main 2026-09-26 14:17:54 -05:00

Conversation 1 Commits 4 Files changed 1 +13 -1

kiyi commented 2026-09-26 01:44:53 -05:00

Member

Copy link

Changes

Record the owner-selected Core maintenance procedure and verified progress, dated 2026-09-26:

• Store only the private Core config/bundle YAML in OpenBao KV v2. Signing, release-read and registry credentials remain in Forgejo organization secrets.
• Use Forgejo OIDC and a temporary two-hour token for the dedicated Core maintenance identity. Record owner-confirmed backend issuance and its approved cluster-admin scope.
• Scan, build, sign, retain a private recovery release and optionally deploy the same archive in one manual job. Build-only is the default.
• Depend on OpenBao without a standing deployment credential, alternate secret store or additional backup gate.
• Record run 4403: source scanning, workflow OIDC login, YAML read and bundle creation succeeded. Archive image matching then failed; image scanning, signing, recovery publication and live maintenance acceptance remain pending.

The implementation is in private Homelab/platform, tracked by issue 47; its archive-matching fix is proposed in PR 66. Detailed configuration remains in that owning repository. This public page contains no secret values or private implementation links.

Validation

• npm run check passed (typecheck, links and deployment guards).
• npm run build passed.
• Public diff and whitespace checks passed.

Latest update: 1d5416f1df1433d6540b4ec6959bfce298b8773b. The owner merge from main is preserved. No new Core deployment is claimed.

## Changes Record the owner-selected Core maintenance procedure and verified progress, dated 2026-09-26: - Store only the private Core config/bundle YAML in OpenBao KV v2. Signing, release-read and registry credentials remain in Forgejo organization secrets. - Use Forgejo OIDC and a temporary two-hour token for the dedicated Core maintenance identity. Record owner-confirmed backend issuance and its approved cluster-admin scope. - Scan, build, sign, retain a private recovery release and optionally deploy the same archive in one manual job. Build-only is the default. - Depend on OpenBao without a standing deployment credential, alternate secret store or additional backup gate. - Record run 4403: source scanning, workflow OIDC login, YAML read and bundle creation succeeded. Archive image matching then failed; image scanning, signing, recovery publication and live maintenance acceptance remain pending. The implementation is in private Homelab/platform, tracked by issue 47; its archive-matching fix is proposed in PR 66. Detailed configuration remains in that owning repository. This public page contains no secret values or private implementation links. ## Validation - `npm run check` passed (typecheck, links and deployment guards). - `npm run build` passed. - Public diff and whitespace checks passed. Latest update: `1d5416f1df1433d6540b4ec6959bfce298b8773b`. The owner merge from `main` is preserved. No new Core deployment is claimed.

kiyi added 1 commit 2026-09-26 01:44:53 -05:00

Record Core Actions inputs and recovery procedure d9c6d4e4c8

kiyi added 1 commit 2026-09-26 10:12:01 -05:00

Record configured OpenBao Core delivery identity and inputs 8f43267945

gitchegumi approved these changes 2026-09-26 12:10:23 -05:00

portegumi referenced this pull request from a commit 2026-09-26 14:03:33 -05:00

Merge main into Core workflow delivery documentation

portegumi added 1 commit 2026-09-26 14:03:33 -05:00

Merge main into Core workflow delivery documentation ... ae98d7ccf6

Resolve the shared Forgejo Actions section: retain main mitigation identity and platform trigger policy, keep PR #11 Core maintenance procedure, and clarify Forgejo secrets are CI credentials only.

kiyi added 1 commit 2026-09-26 14:10:21 -05:00

docs: record Core hosted build progress from run 4403 1d5416f1df

gitchegumi merged commit f0f6644221 into main 2026-09-26 14:17:54 -05:00

gitchegumi deleted branch kiyi/core-workflow-delivery 2026-09-26 14:17:54 -05:00

gitchegumi referenced this pull request from a commit 2026-09-26 14:17:54 -05:00

Merge pull request 'Record Core Actions inputs and recovery procedure' (#11) from kiyi/core-workflow-delivery into main

Sign in to join this conversation.

Reviewers

No reviewers

gitchegumi

Labels

Clear labels

  

app-migration

  

bug

Something is not working

  

ci-cd

  

cluster

  

Documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

gpu

  

invalid

Something is wrong

  

networking

  

question

More information is needed

  

security

  

Storage

  

wontfix

This won't be fixed

No labels

app-migration

bug

ci-cd

cluster

Documentation

duplicate

enhancement

gpu

invalid

networking

question

security

Storage

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Homelab/Documentation!11

No description provided.