Add manual stable-v1 workflow promotion and audited rollback #94
No reviewers
Labels
No labels
app-migration
bug
ci-cd
cluster
Documentation
duplicate
enhancement
gpu
invalid
networking
question
security
Storage
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
Homelab/workflows!94
Loading…
Reference in a new issue
No description provided.
Delete branch "kiyi/stable-v1-channel"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Bundle callers currently have to coordinate numbered workflow and library_ref pins. This adds a protected manual Promote workflow channel workflow accepting a published
v1.X.Yrelease, with explicit rollback reasons for older compatible releases. Refs #93.Promotion builds deterministic frozen adapters: the reusable YAML checks out its selected immutable release SHA, preserves existing workflow/job/scan names and credential contracts, and records channel provenance. Numbered releases stay immutable. Exact-commit source gates, interface compatibility checks and a fresh source/runtime canary must pass before an atomic leased update of
stable-v1plus its immutable audit tag. A post-promotion smoke run exercises the actual stable alias; failures retain evidence and require an audited rollback. Preinstalled tool images retain their own embedded payload provenance.The one-time caller migration helper changes only owned workflow/library_ref scalars. Hosted promotion/rollback, queued-run/rerun acceptance and consumer adoption remain to be completed; this PR does not create or move a live channel or dispatch delivery workflows. Channel callers require a fresh run instead of rerunning an old attempt.
Validation: full Python suite passed (365 tests, one local native-Trivy integration skip), final channel tests (11) and migration tests (3) passed, generated adapter shell syntax/provenance execution and native Git atomic promotion/rollback fixtures passed, YAML/Bash checks, Ruff and native staged Gitleaks 8.30.1 passed. Forgejo dispatch/run fields were checked against the instance Swagger documentation.
Reviewed-source procedure
Reviewed the 11 changed files at
e600b0c3b9. The channel compiler binds library checkouts to the selected release SHA, preserves the reviewed workflow/job contracts, and the publisher stages an immutable canary snapshot before an atomic leased stable-v1/audit-tag update. I did not find a source-level blocker in this pass. This is a COMMENT, not approval: at review time Workflow acceptance passed, but Library checks and Repository security were still running on this head. Please retain the documented first-use gates (tag protection, automatic-token write authorization, hosted promotion/rollback and queued/rerun behavior) before channel adoption; none of those live behaviors is proven by this PR's local tests or PR checks. Re-evaluate the exact head and all three checks for approval when they finish. No promotion or merge is authorized by this review.Source approval for exact head
e600b0c3b9. Reviewed all 11 changed files (including the promotion workflow, compiler, migration helper, tests and operator procedure), ran 14 focused channel/migration tests, and compiled all 21 real v1.35.0 reusable workflows with immutable library checkouts; v1.34.0-to-v1.35.0 interface compatibility passed. No source-level blocker found. This approval supersedes my earlier COMMENT, which withheld approval only for pending CI. Current status at submission: Workflow acceptance / acceptance (pull_request): success, Repository security / security-1 (pull_request): success, Library checks / tests (pull_request): success. Those checks must pass before merge; this approval does not certify a live promotion/rollback or authorize channel adoption. The documented tag-protection, token-write, canary, queued/rerun and consumer-migration acceptance remain first-use gates.