Adopt shared npm validation and pin the published chart image #60

Merged

gitchegumi merged 1 commit from kiyi/documentation-npm-validation into main

2026-10-17 14:23:48 -05:00

kiyi commented

2026-10-17 14:15:36 -05:00

Member

Migrate the paired bundle/deploy callers from v1.24.0 to stable-v1, omit optional library_ref, and bind registry scan inputs to the existing REGISTRY_USERNAME/REGISTRY_PASSWORD pair with vars.REGISTRY_HOST. Preserve workflow names, job IDs, triggers, release inputs, production target, actor gates, managed credentials and OIDC.

The bundle still selected the older image. Pin both workload.yaml and zarf.yaml to the published documentation-image-v0.0.1 chart image: git.gitchegumi.com/homelab/documentation@sha256:6ae179adf61bf21b224330eeb0cbee4ada47f4deab031da1426993c26087cc55. Reconcile README/delivery status with the public release and failed bundle runs. The owning pipeline must still verify the signed image evidence and refresh image scanning before bundle publication.

Validation: npm run check, npm run check:deployment:published, caller-contract comparison, diff checks and default-rule Gitleaks 8.30.1 staged scanning pass. The shared npm/Node tests passed in workflows PR #120. All seven published blobs match local validated files; author and committer are kiyi kiyi@gitchegumi.com. Full local npm run build still hits the existing Turbopack CSS subprocess failure, so the hosted site build remains required. No local Docker build was attempted.

After merge and passing checks, start a fresh separately approved Build signed documentation bundle run on main; do not rerun the old source commit. No manual workflow or deployment was dispatched.

Tracks #56 and Homelab/workflows#119. Library implementation: Homelab/workflows#120. Image release: https://git.gitchegumi.com/Homelab/Documentation/releases/tag/documentation-image-v0.0.1

Bundle runs 349 and 350 failed before npm installation because their inline setup-node tried to create the non-writable /opt/hostedtoolcache. Adopt the shared npm-ci.yml adapter now present in promoted stable-v1 v1.44.5 (snapshot dc4f42cecd4c0d82eaf7572892f704e515d92a86). Preserve npm, Node 22, validate job/status names, the existing check/build sequence and the bundle-only published-image check. Replace the duplicated source validation implementation with the same reusable caller. Migrate the paired bundle/deploy callers from v1.24.0 to stable-v1, omit optional library_ref, and bind registry scan inputs to the existing REGISTRY_USERNAME/REGISTRY_PASSWORD pair with vars.REGISTRY_HOST. Preserve workflow names, job IDs, triggers, release inputs, production target, actor gates, managed credentials and OIDC. The bundle still selected the older image. Pin both workload.yaml and zarf.yaml to the published documentation-image-v0.0.1 chart image: git.gitchegumi.com/homelab/documentation@sha256:6ae179adf61bf21b224330eeb0cbee4ada47f4deab031da1426993c26087cc55. Reconcile README/delivery status with the public release and failed bundle runs. The owning pipeline must still verify the signed image evidence and refresh image scanning before bundle publication. Validation: npm run check, npm run check:deployment:published, caller-contract comparison, diff checks and default-rule Gitleaks 8.30.1 staged scanning pass. The shared npm/Node tests passed in workflows PR #120. All seven published blobs match local validated files; author and committer are kiyi <kiyi@gitchegumi.com>. Full local npm run build still hits the existing Turbopack CSS subprocess failure, so the hosted site build remains required. No local Docker build was attempted. After merge and passing checks, start a fresh separately approved Build signed documentation bundle run on main; do not rerun the old source commit. No manual workflow or deployment was dispatched. Tracks #56 and Homelab/workflows#119. Library implementation: Homelab/workflows#120. Image release: https://git.gitchegumi.com/Homelab/Documentation/releases/tag/documentation-image-v0.0.1

kiyi added 1 commit

2026-10-17 14:15:36 -05:00

Adopt shared npm validation and pin the published chart image

Source security / security (pull_request) Successful in 2m1s

Details

Source security / pipeline (pull_request) Successful in 0s

Details

Documentation site checks / validate-1 (pull_request) Successful in 2m53s

Details

Documentation site checks / validate (pull_request) Successful in 0s

Details

2b3fc59512

kiyi commented

2026-10-17 14:16:31 -05:00

Author

Member

Initial PR expansion retains Documentation site checks / validate and adds Forgejo’s generated reusable execution check Documentation site checks / validate-1. The existing required Source security / security name is unchanged. Confirm the parent validation result and generated execution check together before merge; no branch-protection status names were edited.

kiyi referenced this pull request from Homelab/workflows

2026-10-17 14:16:43 -05:00

Support existing npm checks with writable Node cache setup #119

kiyi referenced this pull request

2026-10-17 14:17:18 -05:00

Render the DNS ingress flow and add an overall architecture chart #56

portegumi approved these changes

2026-10-17 14:17:37 -05:00

portegumi left a comment

Reviewed exact head 2b3fc59512: source/site checks now call the shared npm validator with Node 22; bundle validation retains the additional published-image check; bundle/deploy preserve production target, actor restriction, managed/OIDC credential boundary and registry scan credential pair. The workload and Zarf inventory use the identical immutable image digest. No gateway, VirtualService, exemption, or UDS policy resource changed, so this does not create a new routing owner. Source review has no blocking finding. This is source approval only: the four head-bound checks are pending, including the generated validate-1 execution check, and I have not independently verified the published image's signature/scan assets or the selected stable-v1 adapter bytes. Require successful hosted validation/security and release-image evidence before any merge or separately authorized bundle publication; no deployment is authorized.

CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.

Reviewed exact head 2b3fc59512a140b681d0cf9b701649e83c7333e3: source/site checks now call the shared npm validator with Node 22; bundle validation retains the additional published-image check; bundle/deploy preserve production target, actor restriction, managed/OIDC credential boundary and registry scan credential pair. The workload and Zarf inventory use the identical immutable image digest. No gateway, VirtualService, exemption, or UDS policy resource changed, so this does not create a new routing owner. Source review has no blocking finding. This is source approval only: the four head-bound checks are pending, including the generated validate-1 execution check, and I have not independently verified the published image's signature/scan assets or the selected stable-v1 adapter bytes. Require successful hosted validation/security and release-image evidence before any merge or separately authorized bundle publication; no deployment is authorized. CI at submission: pending. This is a source-review approval, not a scan verdict; required checks still block merge.