Use reviewed workflow channel for documentation image builds #58

Merged

gitchegumi merged 1 commit from kiyi/documentation-image-channel into main

2026-10-17 12:44:33 -05:00

kiyi commented

2026-10-17 12:35:01 -05:00

Member

All existing workflow/job names, manual dispatch inputs, runner labels, worker-pod networking, registry/signing settings and actor gates are preserved. Record the failure and actual caller state in the documentation. The older bundle/deploy callers still need review before the next bundle release.

Validation: npm run check passed; caller YAML comparison confirmed only uses/library_ref changed; git diff --check passed; Gitleaks 8.30.1 scanned staged changes using default rules with full redaction and found no leaks. Published blobs match local validated files; author and committer are kiyi kiyi@gitchegumi.com. npm run build remains blocked locally by the existing Turbopack CSS subprocess failure; hosted site checks are required before merge.

After merge and passing checks, a fresh separately approved Build scanned documentation image dispatch on main is required. No build, publication or deployment was dispatched as part of this PR.

Tracks #56. Failed run: https://git.gitchegumi.com/Homelab/Documentation/actions/runs/337/jobs/1/attempt/1

Documentation image run 337 attempt 1 failed before building or publishing an image: the v1.24.0 source scan rejected changed upstream Semgrep rules. Switch only the image caller to the reviewed Homelab/workflows@stable-v1 adapter and omit optional library_ref. On 2026-10-17 this channel selected v1.44.2 (snapshot c010d2e350531b949146412e977415542482c8e6). All existing workflow/job names, manual dispatch inputs, runner labels, worker-pod networking, registry/signing settings and actor gates are preserved. Record the failure and actual caller state in the documentation. The older bundle/deploy callers still need review before the next bundle release. Validation: npm run check passed; caller YAML comparison confirmed only uses/library_ref changed; git diff --check passed; Gitleaks 8.30.1 scanned staged changes using default rules with full redaction and found no leaks. Published blobs match local validated files; author and committer are kiyi <kiyi@gitchegumi.com>. npm run build remains blocked locally by the existing Turbopack CSS subprocess failure; hosted site checks are required before merge. After merge and passing checks, a fresh separately approved Build scanned documentation image dispatch on main is required. No build, publication or deployment was dispatched as part of this PR. Tracks #56. Failed run: https://git.gitchegumi.com/Homelab/Documentation/actions/runs/337/jobs/1/attempt/1

kiyi added 1 commit

2026-10-17 12:35:02 -05:00

Use reviewed workflow channel for documentation image builds

Documentation site checks / validate (pull_request) Successful in 1m37s

Details

Source security / security (pull_request) Successful in 2m23s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

bfb42ea21a

kiyi referenced this pull request

2026-10-17 12:35:24 -05:00

Render the DNS ingress flow and add an overall architecture chart #56

portegumi reviewed

2026-10-17 12:36:36 -05:00

portegumi left a comment

Reviewed the authenticated head bfb42ea21a. The image caller now selects Homelab/workflows/build-container.yml@stable-v1, omits library_ref, and retains the manual dispatch, actor gate, runner labels, worker-pod network, registry and signing inputs in its current source. The README and delivery note separate this caller change from a new scanned image, signed bundle, and deployment; this PR does not itself change UDS routing, policy or deployment resources.

I cannot yet issue a source approval: Forgejo's changed-files response returned no patches for any of the three files, so the base-to-head change could not be independently compared; the authenticated PR tools also do not expose the selected upstream adapter's source/input contract. Public-page retrieval of the base and adapter failed, so the claimed preservation of the prior caller contract and stable-v1 compatibility remains unverified. This is an evidence-delivery gap, not a demonstrated source defect or a request to bypass scans. Please make the exact base-to-head diff and immutable selected adapter contract available for follow-up review. Source security and documentation site checks on this head are pending and remain separate merge gates. No build, release or merge is authorized by this review.

Reviewed the authenticated head bfb42ea21ae20d7e00b741a08505ba0166a2319a. The image caller now selects Homelab/workflows/build-container.yml@stable-v1, omits library_ref, and retains the manual dispatch, actor gate, runner labels, worker-pod network, registry and signing inputs in its current source. The README and delivery note separate this caller change from a new scanned image, signed bundle, and deployment; this PR does not itself change UDS routing, policy or deployment resources. I cannot yet issue a source approval: Forgejo's changed-files response returned no patches for any of the three files, so the base-to-head change could not be independently compared; the authenticated PR tools also do not expose the selected upstream adapter's source/input contract. Public-page retrieval of the base and adapter failed, so the claimed preservation of the prior caller contract and stable-v1 compatibility remains unverified. This is an evidence-delivery gap, not a demonstrated source defect or a request to bypass scans. Please make the exact base-to-head diff and immutable selected adapter contract available for follow-up review. Source security and documentation site checks on this head are pending and remain separate merge gates. No build, release or merge is authorized by this review.