agentic-forges/forgejo-mcp

Watch

Fork 0

fix: 🔒️ restore fail-closed cosign signing, remove bootstrap SKIP_SIGN #158

Merged

goern merged 0 commits from refs/pull/158/head into main

2026-05-26 00:13:35 +00:00

goern commented

2026-05-25 22:36:46 +00:00

(Migrated from codeberg.org)

Summary

Removes the SKIP_SIGN param (and its pipelineSpec declaration) that was a single-use bootstrap exception for release-tools/v1.0.0
Removes the validate-skip-sign guard task that enforced v1.0.0-only usage
Removes all when: conditions on cosign-sign and attach-sbom — both tasks now run unconditionally on every release-tools tag push
cosign-sign runAfter simplified to [push-by-digest] only

Restores the A3 fail-closed posture from spec.md: if cosign-signing-key Secret is absent, cosign-sign fails and promote-tag never runs.

Pre-merge requirement

Operator must verify release-tools/v1.0.1 (or later) published successfully with signing enabled and cosign verify passes against the manifest before merging this PR. This PR is the code complement to that operational verification.

Closes forgejo-mcp-00o

## Summary - Removes the `SKIP_SIGN` param (and its `pipelineSpec` declaration) that was a single-use bootstrap exception for `release-tools/v1.0.0` - Removes the `validate-skip-sign` guard task that enforced v1.0.0-only usage - Removes all `when:` conditions on `cosign-sign` and `attach-sbom` — both tasks now run unconditionally on every release-tools tag push - `cosign-sign` `runAfter` simplified to `[push-by-digest]` only Restores the A3 fail-closed posture from spec.md: if `cosign-signing-key` Secret is absent, `cosign-sign` fails and `promote-tag` never runs. ## Pre-merge requirement **Operator must verify** `release-tools/v1.0.1` (or later) published successfully with signing enabled and `cosign verify` passes against the manifest before merging this PR. This PR is the code complement to that operational verification. Closes forgejo-mcp-00o

op1st-gitops commented

2026-05-25 22:36:49 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-zpxqr is running.

Starting Pipelinerun code-scans-zpxqr in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-zpxqr -f

op1st Pipelines as Code/code-scans-zpxqr is running. Starting Pipelinerun <b>[code-scans-zpxqr](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-zpxqr)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-zpxqr) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-zpxqr -f</code>

op1st-gitops commented

2026-05-25 22:36:49 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-rkh6l is running.

Starting Pipelinerun on-pull-request-rkh6l in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-rkh6l -f

op1st Pipelines as Code/on-pull-request-rkh6l is running. Starting Pipelinerun <b>[on-pull-request-rkh6l](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-rkh6l)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-rkh6l) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-rkh6l -f</code>

op1st-gitops commented

2026-05-25 22:37:10 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-zpxqr has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: code-scans-zpxqr

Task Statuses:

Status	Duration	Name
Succeeded	11 seconds	fetch-source
Succeeded	7 seconds	gitleaks-version
Succeeded	10 seconds	gitleaks

op1st Pipelines as Code/code-scans-zpxqr has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-zpxqr">code-scans-zpxqr</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-zpxqr/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>7 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-zpxqr/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-zpxqr/logs/gitleaks) </td></tr> </table>

op1st-gitops commented

2026-05-25 22:38:12 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-rkh6l has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: on-pull-request-rkh6l

Task Statuses:

Status	Duration	Name
Succeeded	13 seconds	fetch-source
Succeeded	1 minute	build-and-test

op1st Pipelines as Code/on-pull-request-rkh6l has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-rkh6l">on-pull-request-rkh6l</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-rkh6l/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-rkh6l/logs/build-and-test) </td></tr> </table>

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!158

No description provided.

Rows
Columns