feat: pull images from the Forgejo registry #6

Merged

goern merged 1 commit from feat/images-from-forgejo into main

2026-07-28 20:18:42 +00:00

goern commented

2026-07-28 20:17:54 +00:00

Owner

Completes the registry half of the move off codeberg.org. All twelve image references now resolve to forgejo.b4mad.net/feeldata.

Copied, not rebuilt

stage and prod pin SHA tags corresponding to specific source commits. A rebuild from today's main would ship different content under the guise of a migration, and rebuilding those old commits wouldn't reproduce the same digests anyway. skopeo copy --all preserves manifests and digests exactly.

Every copy was verified by comparing the raw-manifest sha256 on both registries — all identical.

The two `:latest` tags are now pinned

Nothing on Forgejo would ever advance them: the build pipelines only push SHA tags, so :latest was already a frozen pointer inherited from Codeberg.

Ref	Now	Why
`scripts:latest`	`:2a64d5b663883aa27c61fed586831e353b079e52`	that SHA tag carries the identical digest
`graphql:latest`	digest `sha256:92f6da3a…`	built 2026-02-08; no SHA-tagged sibling survives on either registry, so there is no commit tag to point at

⚠️ Pods will roll

The image reference string changes even though the content does not, so Deployments will restart. Every running digest was confirmed against its Forgejo copy first:

api          d03e3005…   graphql  dfb01883…   web  6acdfd8a…
maintenance  eb0c9964…   scripts  e3314ebb…

This is a restart, not an upgrade. prod has prune + selfHeal, so it applies on merge.

Verification

Rendered stage, prod, dev, plans-sync and both business-operations overlays and confirmed every resulting image is pullable from Forgejo. That check caught a real gap mid-review: scripts:2a64d5b6… had the right digest on Forgejo but not the tag, which has since been copied.

Anonymous pull works (packages inherit the public org), so no imagePullSecret is needed — same as Codeberg.

Prerequisite already done

b4mad-release-bot holds write:package but was not a member of the feeldata org, so pushes failed as a bare authentication required. It is now in a new DevSecOps team mirroring the toolbxs one.

Not in this PR

The promote pipeline still pushes to the Codeberg registry (push-to-codeberg task). Repointed separately — note its codeberg-b4mad-packages credential is stale and fails auth today.
The Codeberg registry secrets stay until that lands.

Completes the registry half of the move off codeberg.org. All twelve image references now resolve to `forgejo.b4mad.net/feeldata`. ## Copied, not rebuilt `stage` and `prod` pin SHA tags corresponding to specific source commits. A rebuild from today's `main` would ship *different content* under the guise of a migration, and rebuilding those old commits wouldn't reproduce the same digests anyway. `skopeo copy --all` preserves manifests and digests exactly. Every copy was verified by comparing the raw-manifest sha256 on both registries — all identical. ## The two `:latest` tags are now pinned Nothing on Forgejo would ever advance them: the build pipelines only push SHA tags, so `:latest` was already a frozen pointer inherited from Codeberg. | Ref | Now | Why | |---|---|---| | `scripts:latest` | `:2a64d5b663883aa27c61fed586831e353b079e52` | that SHA tag carries the identical digest | | `graphql:latest` | **digest** `sha256:92f6da3a…` | built 2026-02-08; no SHA-tagged sibling survives on either registry, so there is no commit tag to point at | ## ⚠️ Pods will roll The image reference *string* changes even though the content does not, so Deployments will restart. Every running digest was confirmed against its Forgejo copy first: ``` api d03e3005… graphql dfb01883… web 6acdfd8a… maintenance eb0c9964… scripts e3314ebb… ``` This is a restart, not an upgrade. `prod` has `prune` + `selfHeal`, so it applies on merge. ## Verification Rendered `stage`, `prod`, `dev`, `plans-sync` and both `business-operations` overlays and confirmed **every** resulting image is pullable from Forgejo. That check caught a real gap mid-review: `scripts:2a64d5b6…` had the right digest on Forgejo but not the tag, which has since been copied. Anonymous pull works (packages inherit the public org), so no `imagePullSecret` is needed — same as Codeberg. ## Prerequisite already done `b4mad-release-bot` holds `write:package` but was not a member of the `feeldata` org, so pushes failed as a bare `authentication required`. It is now in a new `DevSecOps` team mirroring the `toolbxs` one. ## Not in this PR - The promote pipeline still **pushes** to the Codeberg registry (`push-to-codeberg` task). Repointed separately — note its `codeberg-b4mad-packages` credential is stale and fails auth today. - The Codeberg registry secrets stay until that lands.

goern added 1 commit

2026-07-28 20:17:54 +00:00

feat: ✨ pull images from the Forgejo registry a6228bfb74

Completes the registry half of the move off codeberg.org. All twelve image
references now resolve to forgejo.b4mad.net/feeldata.

The images were COPIED, not rebuilt: stage and prod pin SHA tags that
correspond to specific source commits, so a rebuild would ship different
content under the guise of a migration. skopeo copy --all preserves manifests
and digests, and every copy was verified to have a raw-manifest sha256
identical to its Codeberg original.

Two floating :latest tags are now pinned, since nothing on Forgejo would ever
advance them — the build pipelines only push SHA tags:

- scripts:latest -> 2a64d5b663883aa27c61fed586831e353b079e52, the SHA tag
  carrying the identical digest.
- graphql:latest -> pinned by DIGEST. That image was built 2026-02-08 and no
  SHA-tagged sibling survives on either registry, so there is no commit tag to
  point at. The digest preserves exactly what prod has been running.

Pods will roll: the image reference string changes even though the content
does not. Every running digest was confirmed to match its Forgejo copy first
(api d03e3005, graphql dfb01883, web 6acdfd8a, maintenance eb0c9964,
scripts e3314ebb), so this is a restart, not an upgrade.

The Codeberg registry secrets stay for now: the promote pipeline still pushes
there and is repointed separately.

goern merged commit 9f3e3b6f8d into main

2026-07-28 20:18:42 +00:00

goern deleted branch feat/images-from-forgejo

2026-07-28 20:18:42 +00:00

goern referenced this pull request from a commit

2026-07-28 20:18:43 +00:00

Merge pull request 'feat: pull images from the Forgejo registry' (#6) from feat/images-from-forgejo into main

goern referenced this pull request from a commit

2026-07-28 20:24:43 +00:00

fix: 🐛 make the stage db-migrate Job a PreSync hook

goern referenced this pull request

2026-07-28 20:24:54 +00:00