feat(runners): add guarded Kubernetes deployment canary #34

Merged

gitchegumi merged 1 commit from kiyi/k8s-deployment-canary into main

2026-09-09 18:26:19 -05:00

kiyi commented

2026-09-09 17:52:14 -05:00

Member

Validation: all 120 unit tests pass, including 24 operation/environment combinations; YAML/Bash syntax and all 16 mocked scanner cases pass. No bundle build or live deployment performed.

After review and merge, the owner should publish workflow release v1.7.0 using Publish workflow release, then merge Homelab/actual-budget#21 and follow its manual compatibility, credential-validation and dev-deployment steps. Tracks Homelab/workflows#2 and Homelab/platform#32; live compatibility remains pending.

Real-workload acceptance needs the existing signed-bundle credential boundary on deploy-k8s while preserving the OpenBao-bound caller identity. Add a static Kubernetes reusable route that permits read-only credential validation and OpenBao-backed dev deployment only. Normal deploy-bundle.yml stays unchanged; a parity test requires the new route to retain its existing gates, signature verification, scans, deployment lock and credential cleanup. Validation: all 120 unit tests pass, including 24 operation/environment combinations; YAML/Bash syntax and all 16 mocked scanner cases pass. No bundle build or live deployment performed. After review and merge, the owner should publish workflow release v1.7.0 using Publish workflow release, then merge Homelab/actual-budget#21 and follow its manual compatibility, credential-validation and dev-deployment steps. Tracks Homelab/workflows#2 and Homelab/platform#32; live compatibility remains pending.

kiyi added 1 commit

2026-09-09 17:52:14 -05:00

feat(runners): add guarded Kubernetes deployment canary

Workflow acceptance / acceptance (pull_request) Successful in 46s

Details

Repository security / security-1 (pull_request) Successful in 1m30s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 2m1s

Details

5977bd1143

kiyi referenced this pull request

2026-09-09 17:56:56 -05:00

Plan the Linux Forgejo runner migration to Kubernetes #2

portegumi approved these changes

2026-09-09 18:24:58 -05:00

portegumi left a comment

All 120 local unit tests and scaffold checks (YAML/Bash plus 16 mocked cases) pass. Independently widening the gate to permit openbao:prod fails the regression; mutation restored. All four exact-head hosted checks pass. Security artifact 376 from run 502 has passed=true, zero blockers and zero scanner errors.

No code-review findings. Per the owner, this PR is intended for release v1.7.0. Actual Budget #21 correctly targets that release and must wait for its publication. No release dispatched, credentials issued, deployment or merge performed.

Approved. The static deploy-k8s route preserves the existing reusable deployment workflow after accounting for its name, runner label and added operation gate. Only validate:dev, validate:prod and openbao:dev pass. The normal route is unchanged, including owner/protected-dispatch checks, signed-archive verification, rescanning, concurrency and credential cleanup. All 120 local unit tests and scaffold checks (YAML/Bash plus 16 mocked cases) pass. Independently widening the gate to permit openbao:prod fails the regression; mutation restored. All four exact-head hosted checks pass. Security artifact 376 from run 502 has passed=true, zero blockers and zero scanner errors. No code-review findings. Per the owner, this PR is intended for release v1.7.0. Actual Budget #21 correctly targets that release and must wait for its publication. No release dispatched, credentials issued, deployment or merge performed.