Restore native Forgejo CI with isolated ephemeral runners

adam commented

2026-10-03 22:17:50 -04:00

Owner

Restore project validation on Forgejo using the existing pinned inputs and full native workflow gates. Jobs run in fresh repository-scoped ephemeral VMs; deployment and cache publishing credentials stay outside the guests. Owned source fetches retain the same revisions.

The ARM runner passed live private checkout, scoped Nix fetching, artifact upload with independent stored-content hashing, anonymous denial, and a dependent job in a second fresh VM. Native x86 and full project workflow results are required before changing the protected merge gate. Main tips and administrator push/merge blocks remain unchanged.

GitHub workflows remain as historical records. Go module identities and historical provenance links are preserved. Host fixture checks do not establish deployed-host acceptance; production physical provisioning remains separately gated.

Includes the isolated VM, HTTPS relay, one-job controller, digest-bound host installer and operational recovery procedure. Validation: 91 infrastructure policy tests, 46 provisioning CI tests, and actionlint for all ported workflows. The one-time host installer avoids per-job sudo or hardware operations. Restricted control tokens are stored through systemd LoadCredential and never shared with guests.

Restore project validation on Forgejo using the existing pinned inputs and full native workflow gates. Jobs run in fresh repository-scoped ephemeral VMs; deployment and cache publishing credentials stay outside the guests. Owned source fetches retain the same revisions. The ARM runner passed live private checkout, scoped Nix fetching, artifact upload with independent stored-content hashing, anonymous denial, and a dependent job in a second fresh VM. Native x86 and full project workflow results are required before changing the protected merge gate. Main tips and administrator push/merge blocks remain unchanged. GitHub workflows remain as historical records. Go module identities and historical provenance links are preserved. Host fixture checks do not establish deployed-host acceptance; production physical provisioning remains separately gated. Includes the isolated VM, HTTPS relay, one-job controller, digest-bound host installer and operational recovery procedure. Validation: 91 infrastructure policy tests, 46 provisioning CI tests, and actionlint for all ported workflows. The one-time host installer avoids per-job sudo or hardware operations. Restricted control tokens are stored through systemd LoadCredential and never shared with guests.

adam added 2 commits

2026-10-03 22:17:50 -04:00

Stage Forgejo hosting and migration tooling 47347c03e7

Stage Forgejo primary hosting and preserve pinned source revisions e02f66579c

adam added 1 commit

2026-10-03 22:20:36 -04:00

Preserve host issue allocator when attaching historical reviews d857bad4a1

adam changed title from ~~Stage Forgejo primary hosting and journaled migration tooling~~ to Restore native Forgejo CI with isolated ephemeral runners

2026-10-04 02:23:28 -04:00

adam added 2 commits

2026-10-04 02:23:29 -04:00

Add isolated native Forgejo CI runners and port validation workflows 3ddb00999d

Keep Forgejo workflow changes in the full CI selection boundary

Validate infrastructure / Infrastructure policy (pull_request) Has been cancelled

Details

Validate infrastructure / forgejo (pull_request) Has been cancelled

Details

e4191f0cfe

adam added 1 commit

2026-10-04 02:46:23 -04:00