agentic-forges/forgejo-mcp

Watch

Fork 0

fix: 🐛 push image version tag directly, never delete a staging tag #202

Merged

goern merged 0 commits from refs/pull/202/head into main

2026-06-02 17:09:25 +00:00

goern commented

2026-06-02 17:05:04 +00:00

(Migrated from codeberg.org)

Problem

Release publishing silently dropped the :vX.Y.Z and :latest container tags. On Forgejo/Codeberg, deleting any tag deletes the underlying manifest — so promote-image-tag's skopeo delete :build-tmp cleanup also wiped the version tags that shared that digest.

v2.27.0 was the first release to run the delete step (added in f026f8c). Result: the image manifest sha256:5293ae… and both :v2.27.0/:latest tags were removed; only the cosign .sig/.att artifacts (separate manifests) survived. Confirmed against the registry, and differentially against operate-first/release-tools (published before the delete step → tags intact).

Fix

Shared by both publish pipelines (forgejo-mcp app image + release-tools):

push-image-by-digest pushes :vX.Y.Z directly (new TAG param); no :build-tmp staging tag is ever created.
promote-image-tag only adds :latest (stable releases); it no longer copies :vX.Y.Z or deletes any tag.
delete-tag-on-failure (new) runs in finally, gated on attach-sbom not succeeding, to remove the briefly-unsigned :vX.Y.Z — preserving the fail-closed "never advertise unsigned" guarantee.

Both PipelineRuns validated with oc create --dry-run=server.

Refs: forgejo-mcp-9r4

Note: v2.27.0's image still needs a rebuild (cut v2.27.1 after merge, or a manual PipelineRun) — re-running the v2.27.0 tag would use the old pipeline.

## Problem Release publishing silently dropped the `:vX.Y.Z` and `:latest` container tags. On Forgejo/Codeberg, deleting *any* tag deletes the underlying **manifest** — so `promote-image-tag`'s `skopeo delete :build-tmp` cleanup also wiped the version tags that shared that digest. v2.27.0 was the first release to run the delete step (added in `f026f8c`). Result: the image manifest `sha256:5293ae…` and both `:v2.27.0`/`:latest` tags were removed; only the cosign `.sig`/`.att` artifacts (separate manifests) survived. Confirmed against the registry, and differentially against `operate-first/release-tools` (published before the delete step → tags intact). ## Fix Shared by both publish pipelines (`forgejo-mcp` app image + `release-tools`): - **push-image-by-digest** pushes `:vX.Y.Z` directly (new `TAG` param); no `:build-tmp` staging tag is ever created. - **promote-image-tag** only *adds* `:latest` (stable releases); it no longer copies `:vX.Y.Z` or deletes any tag. - **delete-tag-on-failure** (new) runs in `finally`, gated on `attach-sbom` not succeeding, to remove the briefly-unsigned `:vX.Y.Z` — preserving the fail-closed "never advertise unsigned" guarantee. Both PipelineRuns validated with `oc create --dry-run=server`. Refs: `forgejo-mcp-9r4` > Note: v2.27.0's image still needs a rebuild (cut v2.27.1 after merge, or a manual PipelineRun) — re-running the v2.27.0 tag would use the old pipeline.

op1st-gitops commented

2026-06-02 17:05:42 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-code-scans-zvzc7 is running.

Starting Pipelinerun forgejo-mcp-code-scans-zvzc7 in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-zvzc7 -f

op1st Pipelines as Code/forgejo-mcp-code-scans-zvzc7 is running. Starting Pipelinerun <b>[forgejo-mcp-code-scans-zvzc7](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zvzc7)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zvzc7) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-code-scans-zvzc7 -f</code>

op1st-gitops commented

2026-06-02 17:05:42 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lkd4t is running.

Starting Pipelinerun forgejo-mcp-on-pull-request-lkd4t in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-lkd4t -f

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lkd4t is running. Starting Pipelinerun <b>[forgejo-mcp-on-pull-request-lkd4t](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lkd4t)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lkd4t) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines forgejo-mcp-on-pull-request-lkd4t -f</code>

op1st-gitops commented

2026-06-02 17:06:09 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-code-scans-zvzc7 has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: forgejo-mcp-code-scans-zvzc7

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	10 seconds	gitleaks-version
Succeeded	11 seconds	gitleaks

op1st Pipelines as Code/forgejo-mcp-code-scans-zvzc7 has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zvzc7">forgejo-mcp-code-scans-zvzc7</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zvzc7/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zvzc7/logs/gitleaks-version) </td></tr> <tr> <td>Succeeded</td> <td>11 seconds</td><td> [gitleaks](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-code-scans-zvzc7/logs/gitleaks) </td></tr> </table>

op1st-gitops commented

2026-06-02 17:07:37 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lkd4t has successfully validated your commit.

Namespace: op1st-pipelines
PipelineRun: forgejo-mcp-on-pull-request-lkd4t

Task Statuses:

Status	Duration	Name
Succeeded	15 seconds	fetch-source
Succeeded	1 minute	build-and-test
Succeeded	14 seconds	commit-title-check

op1st Pipelines as Code/forgejo-mcp-on-pull-request-lkd4t has <b>successfully</b> validated your commit. <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lkd4t">forgejo-mcp-on-pull-request-lkd4t</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>15 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lkd4t/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>1 minute</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lkd4t/logs/build-and-test) </td></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [commit-title-check](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/forgejo-mcp-on-pull-request-lkd4t/logs/commit-title-check) </td></tr> </table>

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!202

No description provided.

Rows
Columns