forgejo-mcp

History

Christoph Görn 748de5102d fix: 🐛 push image version tag directly, never delete a staging tag On Forgejo/Codeberg the container registry deletes the underlying MANIFEST when any of its tags is deleted. promote-image-tag's `skopeo delete :build-tmp` cleanup therefore wiped the :vX.Y.Z and :latest tags that shared the same digest — only the separate cosign .sig/.att manifests survived. This silently broke the v2.27.0 image publish (first release to run the delete step added in `f026f8c`). Fix (shared by the forgejo-mcp and release-tools publish pipelines): - push-image-by-digest pushes :vX.Y.Z directly (new TAG param); no :build-tmp staging tag is ever created. - promote-image-tag only ADDS :latest (stable releases); it no longer copies :vX.Y.Z or deletes any tag. - new delete-tag-on-failure task runs in `finally`, gated on attach-sbom not succeeding, to remove the briefly-unsigned :vX.Y.Z so the fail-closed "never advertise unsigned" guarantee is kept. Both PipelineRuns validated with `oc create --dry-run=server`. Refs: forgejo-mcp-9r4	2026-06-02 17:37:45 +02:00
..
tasks	fix: 🐛 push image version tag directly, never delete a staging tag	2026-06-02 17:37:45 +02:00

Christoph Görn 748de5102d

fix: 🐛 push image version tag directly, never delete a staging tag

On Forgejo/Codeberg the container registry deletes the underlying
MANIFEST when any of its tags is deleted. promote-image-tag's
`skopeo delete :build-tmp` cleanup therefore wiped the :vX.Y.Z and
:latest tags that shared the same digest — only the separate cosign
.sig/.att manifests survived. This silently broke the v2.27.0 image
publish (first release to run the delete step added in f026f8c).

Fix (shared by the forgejo-mcp and release-tools publish pipelines):
- push-image-by-digest pushes :vX.Y.Z directly (new TAG param); no
  :build-tmp staging tag is ever created.
- promote-image-tag only ADDS :latest (stable releases); it no longer
  copies :vX.Y.Z or deletes any tag.
- new delete-tag-on-failure task runs in `finally`, gated on
  attach-sbom not succeeding, to remove the briefly-unsigned :vX.Y.Z
  so the fail-closed "never advertise unsigned" guarantee is kept.

Both PipelineRuns validated with `oc create --dry-run=server`.

Refs: forgejo-mcp-9r4

2026-06-02 17:37:45 +02:00

tasks fix: 🐛 push image version tag directly, never delete a staging tag 2026-06-02 17:37:45 +02:00