agentic-forges/forgejo-mcp
Watch
5
0
Fork
You've already forked forgejo-mcp
 0
Code Issues 9 Pull requests 6 Projects Releases 32 Packages 1 Activity

docs: 📝 archive signed-sbom-attestation + showboat demo (release-tools-image) #193

Merged
goern merged 0 commits from refs/pull/193/head into main 2026-06-02 13:42:11 +00:00
Conversation 14 Commits - Files changed -
goern commented 2026-06-02 13:15:51 +00:00 (Migrated from codeberg.org)
Copy link

What

Completes the OpenSpec lifecycle for the change merged in #189. Runs openspec archive signed-sbom-attestation (tasks.md step 3.2): syncs the live release-tools-image spec and adds a reproducible showboat demo proving the signed-SBOM-attestation contract.

This is the implementation/archive PR that follows #189. No code — the Tekton task + README already landed under forgejo-mcp-aa6 (commit b2619fc).

Changes

  • Spec sync — openspec/specs/release-tools-image/spec.md, requirement "SBOM attached as registry artifact": now mandates a signed cosign attest --type cyclonedx and a cosign verify-attestation --type cyclonedx retrieval contract, replacing the removed/unsigned cosign attach sbom / download sbom path. Two scenarios (signed attestation verifiable; deprecated attach path forbidden).
  • Showboat demo — openspec/specs/release-tools-image/signed-sbom-attestation.demo.md: real captured output of a full syft → cosign attest --type cyclonedx → cosign verify-attestation roundtrip (ephemeral ttl.sh registry + throwaway key — the identical cosign/syft commands the pipeline runs), plus a real probe of the published image.
  • Archive — change moved to openspec/changes/archive/2026-06-02-signed-sbom-attestation/.

Demo evidence (all real, captured 2026-06-02)

Spec scenario Evidence
Signed SBOM attestation verifiable verify-attestation --type cyclonedx → claims validated, tlog verified, sig verified; predicate predicateType: https://cyclonedx.org/bom, bomFormat: CycloneDX
Deprecated attach path not used Tekton task shows cosign attest --type=cyclonedx; no active cosign attach sbom (only historical comments)

⚠️ Discovered during this work — key split (not fixed here)

The GitOps key was split mid-session into cosign-signing-key-artifacts.pub (blob) + cosign-signing-key-images.pub (images). This makes the spec's --key cosign-images.pub correct going forward. Side effect: README §4 verify-blob still fetches the old cosign-signing-key.pub (now 404). Filed as forgejo-mcp-0zl — separate follow-up, out of scope for this spec-archive PR.

Validation

openspec validate release-tools-image --type spec --strict   # → valid

Published release-tools:latest predates the migration, so it carries no CycloneDX attestation yet — the demo documents that gap; the first post-aa6 tag reproduces the roundtrip against cosign-signing-key-images.pub.

Closes forgejo-mcp-3y1. Follows #189.

## What Completes the OpenSpec lifecycle for the change merged in #189. Runs `openspec archive signed-sbom-attestation` (tasks.md step 3.2): syncs the live `release-tools-image` spec and adds a reproducible showboat demo proving the signed-SBOM-attestation contract. **This is the implementation/archive PR that follows #189.** No code — the Tekton task + README already landed under `forgejo-mcp-aa6` (commit `b2619fc`). ## Changes - **Spec sync** — `openspec/specs/release-tools-image/spec.md`, requirement *"SBOM attached as registry artifact"*: now mandates a **signed** `cosign attest --type cyclonedx` and a `cosign verify-attestation --type cyclonedx` retrieval contract, replacing the removed/unsigned `cosign attach sbom` / `download sbom` path. Two scenarios (signed attestation verifiable; deprecated attach path forbidden). - **Showboat demo** — `openspec/specs/release-tools-image/signed-sbom-attestation.demo.md`: real captured output of a full `syft → cosign attest --type cyclonedx → cosign verify-attestation` roundtrip (ephemeral `ttl.sh` registry + throwaway key — the *identical* cosign/syft commands the pipeline runs), plus a real probe of the published image. - **Archive** — change moved to `openspec/changes/archive/2026-06-02-signed-sbom-attestation/`. ## Demo evidence (all real, captured 2026-06-02) | Spec scenario | Evidence | |---|---| | Signed SBOM attestation verifiable | `verify-attestation --type cyclonedx` → claims validated, tlog verified, sig verified; predicate `predicateType: https://cyclonedx.org/bom`, `bomFormat: CycloneDX` | | Deprecated attach path not used | Tekton task shows `cosign attest --type=cyclonedx`; **no** active `cosign attach sbom` (only historical comments) | ## ⚠️ Discovered during this work — key split (not fixed here) The GitOps key was split mid-session into `cosign-signing-key-artifacts.pub` (blob) + `cosign-signing-key-images.pub` (images). This makes the spec's `--key cosign-images.pub` **correct going forward**. Side effect: README §4 verify-blob still fetches the old `cosign-signing-key.pub` (now 404). Filed as **forgejo-mcp-0zl** — separate follow-up, out of scope for this spec-archive PR. ## Validation ``` openspec validate release-tools-image --type spec --strict # → valid ``` Published `release-tools:latest` predates the migration, so it carries no CycloneDX attestation yet — the demo documents that gap; the first post-aa6 tag reproduces the roundtrip against `cosign-signing-key-images.pub`. --- Closes forgejo-mcp-3y1. Follows #189.
op1st-gitops commented 2026-06-02 13:16:04 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-qds5g is running.

Starting Pipelinerun forgejo-mcp-code-scans-qds5g in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-qds5g -f

op1st Pipelines as Code/forgejo-mcp-code-scans-qds5g is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-qds5g](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-qds5g)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-qds5g) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-qds5g -f</code>
op1st-gitops commented 2026-06-02 13:16:04 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-52pcz is running.

Starting Pipelinerun forgejo-mcp-openspec-validate-pr-52pcz in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-52pcz -f

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-52pcz is running. Starting Pipelinerun <b>[forgejo-mcp-openspec-validate-pr-52pcz](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-52pcz)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-52pcz) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-52pcz -f</code>
op1st-gitops commented 2026-06-02 13:16:04 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-b8zkh is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-b8zkh in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-b8zkh -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-b8zkh is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-b8zkh](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-b8zkh)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-b8zkh) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-b8zkh -f</code>
op1st-gitops commented 2026-06-02 13:16:33 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-qds5g has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 16 seconds

fetch-source

Succeeded 9 seconds

gitleaks-version

Succeeded 12 seconds

gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-qds5g has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-qds5g">forgejo-mcp-code-scans-qds5g</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>16 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-qds5g/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>9 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-qds5g/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>12 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-qds5g/logs/gitleaks) </td></tr> </table>
op1st-gitops commented 2026-06-02 13:16:34 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-52pcz has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 17 seconds

fetch-source

Succeeded 13 seconds

validate

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-52pcz has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-52pcz">forgejo-mcp-openspec-validate-pr-52pcz</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>17 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-52pcz/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>13 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-52pcz/logs/validate) </td></tr> </table>
op1st-gitops commented 2026-06-02 13:17:07 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-6zrzj is running.

Starting Pipelinerun forgejo-mcp-code-scans-6zrzj in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-6zrzj -f

op1st Pipelines as Code/forgejo-mcp-code-scans-6zrzj is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-6zrzj](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-6zrzj)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-6zrzj) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-6zrzj -f</code>
op1st-gitops commented 2026-06-02 13:17:07 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-8pg9w is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-8pg9w in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-8pg9w -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-8pg9w is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-8pg9w](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-8pg9w)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-8pg9w) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-8pg9w -f</code>
op1st-gitops commented 2026-06-02 13:17:07 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr- has failed.
There was an error creating the PipelineRun: forgejo-mcp-openspec-validate-pr-

cannot use the API on the provider platform to create a in_progress status:

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr- has <b>failed</b>. There was an error creating the PipelineRun: <b>forgejo-mcp-openspec-validate-pr-</b> cannot use the API on the provider platform to create a in_progress status:
op1st-gitops commented 2026-06-02 13:17:12 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-b8zkh

Task Statuses:

StatusDurationName
Succeeded 15 seconds

fetch-source

Failed 50 seconds

build-and-test

Succeeded 14 seconds

commit-title-check

Failure snippet:

task build-and-test has the status "TaskRunCancelled": 
TaskRun "forgejo-mcp-on-pull-request-b8zkh-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.
op1st Pipelines as Code/forgejo-mcp-on-pull-request-b8zkh <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-b8zkh">forgejo-mcp-on-pull-request-b8zkh</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-b8zkh/logs/fetch-source) </td></tr> <tr> <td>Failed</td> <td>50 seconds</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-b8zkh/logs/build-and-test) </td></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-b8zkh/logs/commit-title-check) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>build-and-test</b> has the status <b>"TaskRunCancelled"</b>: <pre>TaskRun "forgejo-mcp-on-pull-request-b8zkh-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.</pre>
op1st-gitops commented 2026-06-02 13:17:49 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-code-scans-6zrzj has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 20 seconds

fetch-source

Succeeded 15 seconds

gitleaks-version

Succeeded 21 seconds

gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-6zrzj has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-6zrzj">forgejo-mcp-code-scans-6zrzj</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>20 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-6zrzj/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-6zrzj/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>21 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-6zrzj/logs/gitleaks) </td></tr> </table>
op1st-gitops commented 2026-06-02 13:19:09 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-on-pull-request-8pg9w has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 17 seconds

fetch-source

Succeeded 1 minute

build-and-test

Succeeded 17 seconds

commit-title-check

op1st Pipelines as Code/forgejo-mcp-on-pull-request-8pg9w has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-8pg9w">forgejo-mcp-on-pull-request-8pg9w</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>17 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-8pg9w/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-8pg9w/logs/build-and-test) </td></tr> <tr> <td>Succeeded</td> <td>17 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-8pg9w/logs/commit-title-check) </td></tr> </table>
goern commented 2026-06-02 13:40:00 +00:00 (Migrated from codeberg.org)
Copy link

/test forgejo-mcp-openspec-validate-pr

Re-running: the prior red status on this context was a PaC infrastructure error (cannot use the API on the provider platform to create a in_progress status) from a duplicate PipelineRun during a rapid double-push — not a spec validation failure. The real run (-52pcz) validated successfully (openspec validate --all --strict → 16/16, check-demos → 0 errors), reproduced locally.

/test forgejo-mcp-openspec-validate-pr Re-running: the prior red status on this context was a PaC infrastructure error (`cannot use the API on the provider platform to create a in_progress status`) from a duplicate PipelineRun during a rapid double-push — not a spec validation failure. The real run (`-52pcz`) validated successfully (`openspec validate --all --strict` → 16/16, `check-demos` → 0 errors), reproduced locally.
op1st-gitops commented 2026-06-02 13:40:24 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hh2gs is running.

Starting Pipelinerun forgejo-mcp-openspec-validate-pr-hh2gs in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-hh2gs -f

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hh2gs is running. Starting Pipelinerun <b>[forgejo-mcp-openspec-validate-pr-hh2gs](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hh2gs)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hh2gs) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-openspec-validate-pr-hh2gs -f</code>
op1st-gitops commented 2026-06-02 13:40:51 +00:00 (Migrated from codeberg.org)
Copy link

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hh2gs has successfully validated your commit.

Task Statuses:

StatusDurationName
Succeeded 15 seconds

fetch-source

Succeeded 11 seconds

validate

op1st Pipelines as Code/forgejo-mcp-openspec-validate-pr-hh2gs has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hh2gs">forgejo-mcp-openspec-validate-pr-hh2gs</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hh2gs/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [validate](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-openspec-validate-pr-hh2gs/logs/validate) </td></tr> </table>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/OpenSpec
OpenSpec change proposal / spec-driven work

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
RFC - Request For Comments
Request For Comments — design/spec open for feedback before implementation

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
hermes-attempted
Hermes attempted but produced no changes

  
hermes-needs-clarification
Quality gate flagged, needs human input

  
hermes-ready
Ready for hermes to process

  
hermes-review
Hermes PR awaiting review

  
hermes-wip
Hermes is working on this

  
human-required
Hermes gave up after 3 attempts

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/OpenSpec
Kind/Security
Kind/Testing
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
RFC - Request For Comments
Reviewed/Confirmed
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Status/Abandoned
Status/Blocked
Status/Need More Info
hermes-attempted
hermes-needs-clarification
hermes-ready
hermes-review
hermes-wip
human-required
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
agentic-forges/forgejo-mcp!193
No description provided.