ci: trigger pipelines from Forgejo instead of Codeberg #5

Merged

goern merged 2 commits from ci/trigger-to-forgejo into main

2026-07-28 19:49:06 +00:00

goern commented

2026-07-28 19:44:23 +00:00

Owner

Moves the PaC trigger for feeldata2.app from codeberg.org to forgejo.b4mad.net, and adds the credentials it needs.

Why now

ArgoCD reads manifests from Forgejo since dac43be, but every build pipeline still pushed its image-tag commit to codeberg.org. Those commits land on a repo nobody deploys from, so dev and prod have been frozen at their current tags. CI→CD is already severed; this is half the fix.

What changed

dev-infra/repository.yaml — renamed to forgejo-feeldata-app, pointed at forgejo.b4mad.net/feeldata/feeldata2.app.
git_provider.type: forgejo is now set explicitly. The old CR left it unset, which silently defaults to github and worked only because the Codeberg payload happened to parse. Do not carry that omission over.
secrets/forgejo-b4mad — PaC provider.token + webhook.secret. The provider token is the existing b4mad-gitops gitops-token, which already holds write:repository and write:issue — no new token was minted. PaC v0.42.2 enforces Forgejo webhook HMAC, so webhook.secret must match the hook on feeldata2.app.
secrets/promote-git-credentials — repointed to forgejo.b4mad.net. This secret was hand-created in the cluster on 2026-02-11 and never tracked in git; it is brought under GitOps here rather than hand-edited again.

codeberg-b4mad is kept deliberately as the trigger rollback path. codeberg-b4mad-packages stays live because container images still push to the Codeberg registry — the Forgejo package registry for feeldata is still empty.

Verification

kustomize build environments/dev → 41 objects, clean
kubeseal --validate → the live controller can decrypt both new seals
Repository CR passes oc apply --dry-run=server with type: forgejo
The token string appears in no committed file

⚠️ Merge ordering

Must land together with feeldata2.app#ci/trigger-and-manifests-to-forgejo. The six PaC-triggered builds authenticate the manifests push with {{ git_auth_secret }}, which carries credentials for whichever forge fired the run — either change alone breaks the push.

Recommended: deactivate the Codeberg org webhook first so CI is quiet, then merge both, then activate the Forgejo webhook. That avoids any window where one forge triggers and the other holds the credentials.

Merging also overwrites the live promote-git-credentials, which is the cutover moment for the manual promote pipelines.

Moves the PaC trigger for `feeldata2.app` from codeberg.org to forgejo.b4mad.net, and adds the credentials it needs. ## Why now ArgoCD reads `manifests` from Forgejo since `dac43be`, but every build pipeline still pushed its image-tag commit to **codeberg.org**. Those commits land on a repo nobody deploys from, so dev and prod have been frozen at their current tags. CI→CD is already severed; this is half the fix. ## What changed - **`dev-infra/repository.yaml`** — renamed to `forgejo-feeldata-app`, pointed at `forgejo.b4mad.net/feeldata/feeldata2.app`. `git_provider.type: forgejo` is now set **explicitly**. The old CR left it unset, which silently defaults to `github` and worked only because the Codeberg payload happened to parse. Do not carry that omission over. - **`secrets/forgejo-b4mad`** — PaC `provider.token` + `webhook.secret`. The provider token is the existing `b4mad-gitops` `gitops-token`, which already holds `write:repository` and `write:issue` — no new token was minted. PaC v0.42.2 **enforces** Forgejo webhook HMAC, so `webhook.secret` must match the hook on `feeldata2.app`. - **`secrets/promote-git-credentials`** — repointed to `forgejo.b4mad.net`. This secret was hand-created in the cluster on 2026-02-11 and never tracked in git; it is brought under GitOps here rather than hand-edited again. `codeberg-b4mad` is kept deliberately as the trigger rollback path. `codeberg-b4mad-packages` stays live because container images still push to the Codeberg registry — the Forgejo package registry for `feeldata` is still empty. ## Verification - `kustomize build environments/dev` → 41 objects, clean - `kubeseal --validate` → the live controller can decrypt both new seals - Repository CR passes `oc apply --dry-run=server` with `type: forgejo` - The token string appears in no committed file ## ⚠️ Merge ordering Must land **together with** `feeldata2.app#ci/trigger-and-manifests-to-forgejo`. The six PaC-triggered builds authenticate the manifests push with `{{ git_auth_secret }}`, which carries credentials for whichever forge fired the run — either change alone breaks the push. Recommended: deactivate the Codeberg org webhook **first** so CI is quiet, then merge both, then activate the Forgejo webhook. That avoids any window where one forge triggers and the other holds the credentials. Merging also overwrites the live `promote-git-credentials`, which is the cutover moment for the manual promote pipelines.

goern added 2 commits

2026-07-28 19:44:23 +00:00

ci: 🔧 trigger pipelines from Forgejo instead of Codeberg 5f43f17850

Renames the PaC Repository CR to forgejo-feeldata-app and points it at
forgejo.b4mad.net/feeldata/feeldata2.app.

Sets git_provider.type: forgejo explicitly. The old CR left it unset, which
silently defaults to github and worked only because the Codeberg payload
happened to parse — do not carry that omission over.

Requires a forgejo-b4mad secret (provider.token, webhook.secret) in
feeldata-dev, which is added separately with the sealed values.

feat: ✨ add Forgejo PaC credentials for feeldata-dev a52eb7d462

forgejo-b4mad carries the PaC provider token and webhook HMAC secret for
forgejo.b4mad.net. The provider token is the existing b4mad-gitops
gitops-token, which already holds write:repository and write:issue -- no new
token was minted. PaC v0.42.2 enforces Forgejo webhook signatures, so
webhook.secret must match the hook registered on feeldata2.app.

promote-git-credentials is repointed from codeberg.org to forgejo.b4mad.net
so the manually-triggered promote pipelines can push manifest updates. It was
hand-created in the cluster on 2026-02-11 and never tracked in git; adding it
here brings it under GitOps rather than repeating that drift.

codeberg-b4mad is deliberately kept as the rollback path for the trigger, and
codeberg-b4mad-packages stays live because container images still push to the
Codeberg registry.

goern merged commit 34a201d422 into main

2026-07-28 19:49:06 +00:00

goern deleted branch ci/trigger-to-forgejo

2026-07-28 19:49:06 +00:00

goern referenced this pull request from a commit

2026-07-28 19:49:07 +00:00

Merge pull request 'ci: trigger pipelines from Forgejo instead of Codeberg' (#5) from ci/trigger-to-forgejo into main