37 lines
2.4 KiB
Markdown
37 lines
2.4 KiB
Markdown
# Isolated public-candidate acceptance
|
|
|
|
The Gitea workflow `.gitea/workflows/public-candidate-acceptance.yml` moves the expensive release
|
|
proof off a developer workstation and onto a Docker-capable server runner. It is manual-only and
|
|
accepts an exact canonical commit SHA. It does not invoke `unraid-deploy.yml`, the deploy controller
|
|
or the production Compose project.
|
|
|
|
The job creates a curated public export, validates its content manifest, scans it with Gitleaks,
|
|
then creates a temporary parentless Git commit so release provenance describes the exact exported
|
|
tree. From that tree it:
|
|
|
|
1. builds API, Console, Node Agent and Runtime Worker images with OCI identity;
|
|
2. produces the release manifest, checksums, CycloneDX inventory and image provenance;
|
|
3. scans every exact image ID with checksum-pinned Trivy and rejects ambiguous reports or any
|
|
HIGH/CRITICAL finding;
|
|
4. starts API, Console, PostgreSQL and Redis with the production overlay under a unique
|
|
`modelforge-rc-*` Compose project;
|
|
5. uses newly generated secrets, loopback-only ephemeral host ports and project-scoped volumes;
|
|
6. proves liveness, readiness, version identity, Console serving and both sides of the operator
|
|
authentication boundary; and
|
|
7. always removes the temporary containers, networks, volumes and four candidate image tags. An
|
|
independent `if: always()` workflow cleanup repeats the exact project-label cleanup after a
|
|
failure, cancellation or timeout; it never runs a host-wide Docker prune.
|
|
|
|
No Node Agent or Runtime Worker is started by this clean-install gate. Consequently it creates no
|
|
compute identity and cannot interact with the production GPU node. A later GPU qualification must
|
|
enrol a disposable `rc-canary` identity with `production_eligible=false` and retain that separate
|
|
evidence.
|
|
|
|
After the workflow exists on the default branch, dispatch it directly and enter the exact pushed
|
|
commit. Before merge, dispatch the existing **Managed validation** workflow on the candidate branch
|
|
with profile `build`; that profile calls the same acceptance workflow with `gitea.sha`. Use the
|
|
actual intended Console API origin for a publishable artifact; the managed-branch route uses
|
|
`https://modelforge.example.test` and therefore produces non-publishable infrastructure rehearsal
|
|
artifacts. Evidence is retained for 90 days. A failed scan or install is evidence of a blocker, not
|
|
permission to bypass the gate.
|