feat(ci): add Tekton release pipeline mirroring Forgejo Actions release #150
No reviewers
Labels
No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/OpenSpec
Kind/Security
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
RFC - Request For Comments
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Status/Abandoned
Status/Blocked
Status/Need More Info
hermes-attempted
hermes-needs-clarification
hermes-ready
hermes-review
hermes-wip
human-required
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
agentic-forges/forgejo-mcp!150
Loading…
Reference in a new issue
No description provided.
Delete branch "refs/pull/150/head"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Ports
.forgejo/workflows/release.ymlto op1st-pipelines Tekton via Pipelines-as-Code, triggered onrefs/tags/v*push. Runs in parallel with the existing Forgejo Actions release workflow — no removal in this PR.Tracks bead
forgejo-mcp-d4b. Related:forgejo-mcp-td8(canonical CI gate decision).What's in the PR
Pipeline
.tekton/on-tag-push-release.yaml— PipelineRun, PaC trigger on[push]matching[refs/tags/v*]. Workspace 8Gi..tekton/tasks/goreleaser-release.yaml— install syft + goreleaser, run release (GORELEASER_FORCE_TOKEN=gitea), smoke-test linux/amd64 binary version banner..tekton/tasks/cosign-sign-release.yaml—sign-blobofchecksums.txt, upload.sigto Codeberg release. Skipped (warn) ifcosign-release-keySecret absent — mirrors Forgejo workflow's fail-open behavior..tekton/tasks/mcpb-pack.yaml— pack.mcpbper(goos, goarch)(linux/darwin × amd64/arm64), version-stampextension/manifest.json, upload each to Codeberg release.Shape:
fetch-source → resolve-tag → goreleaser-release → { cosign-sign-release ∥ mcpb-pack }Docs
docs/design/release-pipeline-migration.md— ADR: rationale, alternatives rejected (hard cutover, cross-repoworkflow_call, Tekton Chains in place ofcosign sign-blob, single mega-image), secrets, trigger semantics, cutover criteria, rollback.docs/plans/tekton-release-runbook.md— operator runbook: provisioning, cutting a release, observing runs, common failure modes.Secrets required in
op1st-pipelinesforgejo-release-tokentokenwrite:repositorycosign-release-keycosign.key,cosign.password,cosign.pubsign-blobof checksumsProvisioning commands in the ADR.
Test plan
forgejo-release-token+cosign-release-keySecrets inop1st-pipelines.tkn pr logs --last -f— confirm goreleaser-release Task succeeds.checksums.txt.sig+ 4×.mcpbappear on the Codeberg release.cosign verify-blob --key cosign.pub --signature checksums.txt.sig checksums.txtsucceeds..forgejo/workflows/release.yml.Out of scope
forgejo-mcp-td8).op1st Pipelines as Code/code-scans-4wtn2 is running.
Starting Pipelinerun code-scans-4wtn2 in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines code-scans-4wtn2 -fop1st Pipelines as Code/on-pull-request- has failed.
There was an error creating the PipelineRun: on-pull-request-
cannot use the API on the provider platform to create a in_progress status:
op1st Pipelines as Code/code-scans-4wtn2 has successfully validated your commit.
Task Statuses:
fetch-source
gitleaks-version
gitleaks
op1st Pipelines as Code/on-pull-request-9ptgc is running.
Starting Pipelinerun on-pull-request-9ptgc in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines on-pull-request-9ptgc -fop1st Pipelines as Code/code-scans-fz92v is running.
Starting Pipelinerun code-scans-fz92v in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines code-scans-fz92v -fop1st Pipelines as Code/code-scans-fz92v has successfully validated your commit.
Task Statuses:
fetch-source
gitleaks-version
gitleaks
op1st Pipelines as Code/on-pull-request-9ptgc has successfully validated your commit.
Task Statuses:
fetch-source
build-and-test
op1st Pipelines as Code/on-pull-request-s89hh is running.
Starting Pipelinerun on-pull-request-s89hh in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines on-pull-request-s89hh -fop1st Pipelines as Code/code-scans-lw4gk is running.
Starting Pipelinerun code-scans-lw4gk in namespace op1st-pipelines
You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:
tkn pr logs -n op1st-pipelines code-scans-lw4gk -fop1st Pipelines as Code/code-scans-lw4gk has successfully validated your commit.
Task Statuses:
fetch-source
gitleaks-version
gitleaks
op1st Pipelines as Code/on-pull-request-s89hh has successfully validated your commit.
Task Statuses:
fetch-source
build-and-test
Secret validation — complete
Read-only inspection of
op1st-pipelinesnamespace (key names only, no values decoded):op1st-release-token(Opaque, keys:token,username, reflected fromop1st-gitops/op1st-release-token)cosign-signing-key(Opaque, keys:cosign.key,cosign.password,cosign.pub)Other Codeberg secrets in the namespace ruled out:
codeberg-pusher—kubernetes.io/dockerconfigjson, wrong shapecodeberg-runner-openshift-pac— PaC per-repo,read:repository + write:repository.statusscope onlycodeberg-org-op1st-pipelines— PaC controller identity (org token + webhook HMAC)Operator-confirmable preconditions (verified, cannot be checked from cluster):
op1st-release-token.tokencarrieswrite:repositoryongoern/forgejo-mcpcosign-signing-key.cosign.pubbytes matchsecrets/cosign.pub@791ef6dPipeline is ready. Next
v*tag push triggers the Tekton run alongside the existing.forgejo/workflows/release.yml. Cutover stays deferred until 2 consecutive Tekton releases satisfy the ADR criteria.