[Ops] Configure package publisher and populate protected registries #38

New Issue

2026-08-04T04:30:26+02:00

zemion commented

2026-08-04 04:30:26 +02:00

Purpose

Complete the one-time credential and registry-population step for the protected module package workflows delivered in f7590a7.

All 66 packageable repositories now publish immutable wheels and, where present, WebUI npm packages from protected v* tags. The runtime distribution resolves exact versions, verifies embedded identities and hashes, and signs the resulting package-lock digest. Server-side v* protection is already configured for all package repositories and the meta repository.

Required human-controlled setup

Create a dedicated non-administrator Gitea package-publisher account or token owner.
Create a least-privilege token with package read/write access. Do not reuse the administrator or general release token.
Add organization Actions secrets GOVOPLAN_PACKAGE_USERNAME and GOVOPLAN_PACKAGE_TOKEN for GovOPlaN.
Run python tools/gitea/gitea-configure-package-releases.py and verify it reports both protection and credential names configured.

Initial population

Dispatch module-package-release.yml for the protected tags selected by requirements-release.txt, in dependency order, and for other module versions intended for govoplan[full].
Dispatch or create the corresponding protected meta release tag so the optional govoplan developer package is published.
Verify Gitea PyPI and npm return the exact package versions.
Run runtime-distribution.yml and retain release-packages.json, package-artifacts.lock.json, and the signed distribution manifest as evidence.

Acceptance criteria

No publication workflow uses a broad administrator token.
Every selected wheel and WebUI artifact is immutable and retrievable from the native Gitea registry.
Runtime assembly succeeds from registry artifacts and the signed manifest binds the package-lock SHA-256.
govoplan and govoplan[full] resolve for the package versions that have been released.

## Purpose Complete the one-time credential and registry-population step for the protected module package workflows delivered in `f7590a7`. All 66 packageable repositories now publish immutable wheels and, where present, WebUI npm packages from protected `v*` tags. The runtime distribution resolves exact versions, verifies embedded identities and hashes, and signs the resulting package-lock digest. Server-side `v*` protection is already configured for all package repositories and the meta repository. ## Required human-controlled setup - Create a dedicated non-administrator Gitea package-publisher account or token owner. - Create a least-privilege token with package read/write access. Do not reuse the administrator or general release token. - Add organization Actions secrets `GOVOPLAN_PACKAGE_USERNAME` and `GOVOPLAN_PACKAGE_TOKEN` for `GovOPlaN`. - Run `python tools/gitea/gitea-configure-package-releases.py` and verify it reports both protection and credential names configured. ## Initial population - Dispatch `module-package-release.yml` for the protected tags selected by `requirements-release.txt`, in dependency order, and for other module versions intended for `govoplan[full]`. - Dispatch or create the corresponding protected meta release tag so the optional `govoplan` developer package is published. - Verify Gitea PyPI and npm return the exact package versions. - Run `runtime-distribution.yml` and retain `release-packages.json`, `package-artifacts.lock.json`, and the signed distribution manifest as evidence. ## Acceptance criteria - No publication workflow uses a broad administrator token. - Every selected wheel and WebUI artifact is immutable and retrievable from the native Gitea registry. - Runtime assembly succeeds from registry artifacts and the signed manifest binds the package-lock SHA-256. - `govoplan` and `govoplan[full]` resolve for the package versions that have been released.

zemion added the

codex/needs-human area/release

priority

p1

labels 2026-08-04 04:30:26 +02:00

zemion referenced this issue

2026-08-04 04:30:27 +02:00

[User Story] One-command Core bootstrap, module lifecycle, scale-out, and environment promotion #13

zemion commented

2026-08-04 13:19:01 +02:00

Codex State: needs-info

Summary

All 67 package-repository v* protections are correctly configured.
The package credentials currently exist only as repository Actions secrets on GovOPlaN/govoplan. The organization Actions API still reports both required organization secrets as missing, so module workflows cannot inherit them.

Next / Blocked

Re-enter GOVOPLAN_PACKAGE_USERNAME and GOVOPLAN_PACKAGE_TOKEN under GovOPlaN organization Settings -> Actions -> Secrets. Do not paste either value into the issue or chat.
After the organization checker succeeds, package workflows can be dispatched and the repository-scoped duplicates removed.

Suggested status label: status/needs-info

## Codex State: needs-info ### Summary - All 67 package-repository v* protections are correctly configured. - The package credentials currently exist only as repository Actions secrets on GovOPlaN/govoplan. The organization Actions API still reports both required organization secrets as missing, so module workflows cannot inherit them. ### Next / Blocked - Re-enter GOVOPLAN_PACKAGE_USERNAME and GOVOPLAN_PACKAGE_TOKEN under GovOPlaN organization Settings -> Actions -> Secrets. Do not paste either value into the issue or chat. - After the organization checker succeeds, package workflows can be dispatched and the repository-scoped duplicates removed. Suggested status label: `status/needs-info`

zemion commented

2026-08-04 14:37:41 +02:00

Codex State: progress

Summary

Organization package credentials and protected-tag rules now pass for all 67 repositories.
Access run 491 published a wheel and WebUI package; Core recovery run 498 hash-verified the existing wheel and published the missing @govoplan/core-webui@0.1.14 package.
Hash-safe partial-publication recovery and an exact meta-package dispatcher are on main; package jobs 502-540 cover all 39 currently tagged missing selections.

Changed Files

tools/repo/templates/module-package-release.yml
tools/gitea/gitea-dispatch-package-set.py

Verification

gitea-configure-package-releases.py: all repositories protected and both organization secret names present
Gitea Actions runs 491 and 498: success

Next / Blocked

Wait for package jobs 502-540 and fix any tag-specific build failures.
Resolve the 26 meta-package selections whose exact version tags do not exist; do not publish them from main or invent mutable refs.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Organization package credentials and protected-tag rules now pass for all 67 repositories. - Access run 491 published a wheel and WebUI package; Core recovery run 498 hash-verified the existing wheel and published the missing @govoplan/core-webui@0.1.14 package. - Hash-safe partial-publication recovery and an exact meta-package dispatcher are on main; package jobs 502-540 cover all 39 currently tagged missing selections. ### Changed Files - `tools/repo/templates/module-package-release.yml` - `tools/gitea/gitea-dispatch-package-set.py` ### Verification - `gitea-configure-package-releases.py: all repositories protected and both organization secret names present` - `Gitea Actions runs 491 and 498: success` ### Next / Blocked - Wait for package jobs 502-540 and fix any tag-specific build failures. - Resolve the 26 meta-package selections whose exact version tags do not exist; do not publish them from main or invent mutable refs. Suggested status label: `status/in-progress`

zemion commented

2026-08-04 15:48:33 +02:00

Codex State: progress

Summary

Coordinated v0.1.15 release commits and tags are pushed for all modules, Core, and the developer meta-package.
Package publisher credentials were validated earlier by successful Access and Core publications; 67 v0.1.15 package jobs are queued in dependency order.

Changed Files

tools/release/push-release-tag.sh
tools/release/generate-release-lock.sh
tools/release/synchronize-webui-package-metadata.py

Verification

Version alignment passed for 77 repositories including release composition.
Release entrypoint and WebUI metadata synchronization tests: 12 passed.

Next / Blocked

Wait for Actions jobs 556-621 and 625, repair any failure, then install-verify govoplan and govoplan[full] from the Gitea registry.

Suggested status label: status/in-progress

## Codex State: progress ### Summary - Coordinated v0.1.15 release commits and tags are pushed for all modules, Core, and the developer meta-package. - Package publisher credentials were validated earlier by successful Access and Core publications; 67 v0.1.15 package jobs are queued in dependency order. ### Changed Files - `tools/release/push-release-tag.sh` - `tools/release/generate-release-lock.sh` - `tools/release/synchronize-webui-package-metadata.py` ### Verification - `Version alignment passed for 77 repositories including release composition.` - `Release entrypoint and WebUI metadata synchronization tests: 12 passed.` ### Next / Blocked - Wait for Actions jobs 556-621 and 625, repair any failure, then install-verify govoplan and govoplan[full] from the Gitea registry. Suggested status label: `status/in-progress`

zemion commented

2026-08-04 16:53:23 +02:00

Codex State: done

Summary

Published the coordinated protected v0.1.15 package set: all 66 packageable repositories report complete immutable Python/WebUI registry artifacts.
Published and consumer-tested govoplan==0.1.15 and govoplan[full]==0.1.15; the full environment contains 67 exact GovOPlaN distributions and passes pip check.
Runtime Distribution run 629 passed amd64/arm64 migration, schema, non-root readiness, worker delivery/shutdown, signed bundle adoption, and managed-ingress drills.
Release v0.1.15 retains release-packages.json, package-artifacts.lock.json, the signed distribution manifest/keyring, SBOM/provenance, deployer, and both runtime smoke receipts. The release and provenance resolve to protected source commit a24c94435e.

Changed Files

.gitea/workflows/runtime-distribution.yml
docs/PACKAGE_REGISTRY_RELEASES.md
tests/test_runtime_distribution_build.py

Verification

30 focused package/runtime release tests passed.
Package registry dispatcher: planned 0, active 0, already complete 66.
Downloaded manifest/deployer SHA-256 checks passed; package-lock SHA-256 matches the signed manifest; independent deployer verify-release adoption passed with runtime-distribution-2026-01.

Next / Blocked

No Package Publisher setup or population work remains. Future releases use the protected per-module workflows and tag-safe runtime retry path.

## Codex State: done ### Summary - Published the coordinated protected v0.1.15 package set: all 66 packageable repositories report complete immutable Python/WebUI registry artifacts. - Published and consumer-tested govoplan==0.1.15 and govoplan[full]==0.1.15; the full environment contains 67 exact GovOPlaN distributions and passes pip check. - Runtime Distribution run 629 passed amd64/arm64 migration, schema, non-root readiness, worker delivery/shutdown, signed bundle adoption, and managed-ingress drills. - Release v0.1.15 retains release-packages.json, package-artifacts.lock.json, the signed distribution manifest/keyring, SBOM/provenance, deployer, and both runtime smoke receipts. The release and provenance resolve to protected source commit a24c94435eecd6c96f3d4dae09675aa0c6a954b7. ### Changed Files - `.gitea/workflows/runtime-distribution.yml` - `docs/PACKAGE_REGISTRY_RELEASES.md` - `tests/test_runtime_distribution_build.py` ### Verification - `30 focused package/runtime release tests passed.` - `Package registry dispatcher: planned 0, active 0, already complete 66.` - `Downloaded manifest/deployer SHA-256 checks passed; package-lock SHA-256 matches the signed manifest; independent deployer verify-release adoption passed with runtime-distribution-2026-01.` ### Next / Blocked - No Package Publisher setup or population work remains. Future releases use the protected per-module workflows and tag-safe runtime retry path.

zemion closed this issue

2026-08-04 16:53:23 +02:00

zemion removed the

status

blocked

codex/needs-human labels 2026-08-04 16:53:50 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan#38