54 lines
71 KiB
JSON
54 lines
71 KiB
JSON
{"_type":"issue","id":"forgejo-mcp-1b4","title":"Build dedicated release-tools container image for op1st Tekton release pipeline","description":"Currently .tekton/tasks/goreleaser-release.yaml installs syft + goreleaser at runtime in separate Tekton Steps, which fails (exit 127) because /usr/local/bin/ is per-container, not shared across Steps in a Pod. Workaround in current code is to collapse all installs+run into one Step (loses log granularity, repeats install on every release run, fragile to upstream URL changes). Proper fix: build a custom OCI image with pinned Go + syft + goreleaser + cosign + jq + curl + node22 + npx + @anthropic-ai/mcpb prefetched. Reference this image from all three Tasks (goreleaser-release, cosign-sign-release, mcpb-pack). Image rebuild on tool bump only. Likely lives in op1st-emea-b4mad or ghcr.io/operate-first/release-tools.","acceptance_criteria":"Image published at a stable registry path; .tekton/tasks/*.yaml reference it via params with versioned tag; release pipeline still passes; install-at-runtime removed; Renovate/dependabot config bumps the image tag","notes":"PR #155 merged into main as 550db7f. OpenSpec design + adversarial review now canonical. Implementation work begins on branch feat/release-tools-image-impl. Tracking via /var/home/goern/Source/codeberg.org/goern/forgejo-mcp-release-tools-impl worktree. Dev team release-tools-image-iter1 spawned for iteration 1 (source tree only; pipelines deferred to iter 2).","status":"closed","priority":0,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T11:47:01Z","created_by":"Christoph Görn","updated_at":"2026-05-25T22:20:29Z","started_at":"2026-05-25T12:09:21Z","closed_at":"2026-05-25T22:20:29Z","close_reason":"PR #157 merged (commit e02cf56). release-tools image built and pushed to codeberg.org/operate-first/release-tools:latest (sha256:b0387a762c54). All .tekton/tasks/ rewritten. OpenSpec change implemented end-to-end.","dependencies":[{"issue_id":"forgejo-mcp-1b4","depends_on_id":"forgejo-mcp-29g","type":"blocks","created_at":"2026-05-25T11:47:15Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":5,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-aps","title":"Fix build-image task: remove privileged, use rootless buildah","description":"build-image.yaml sets securityContext.privileged: true which is rejected by OpenShift container-build SCC bound to the pipeline SA. Fix: remove privileged: true, run as UID 1000, use --isolation=chroot --storage-driver=vfs so buildah works rootless under container-build SCC.","status":"in_progress","priority":1,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T23:10:09Z","created_by":"Christoph Görn","updated_at":"2026-05-25T23:10:13Z","started_at":"2026-05-25T23:10:13Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-8sz","title":"Move release-tools PipelineRuns to .tekton/ root — PaC v0.42.0 does not scan subdirectories","description":"PaC v0.42.0 only reads PipelineRun YAMLs from .tekton/*.yaml (root level). .tekton/release-tools/on-tag-publish.yaml and on-pull-request-build.yaml are invisible to PaC and never trigger. Fix: move both PipelineRun files to .tekton/ root with release-tools- prefix. Task YAMLs in .tekton/release-tools/tasks/ stay in place (PaC fetches them by explicit path in the task annotation).","status":"closed","priority":1,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T22:53:37Z","created_by":"Christoph Görn","updated_at":"2026-05-25T22:59:33Z","started_at":"2026-05-25T22:53:40Z","closed_at":"2026-05-25T22:59:33Z","close_reason":"PR #160 merged — PipelineRuns moved to .tekton/ root, CEL fixed","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-00o","title":"Restore cosign fail-closed signing after release-tools/v1.0.0 bootstrap ships","description":"Bootstrap exception: the first release-tools/v1.0.0 publish run will be invoked with SKIP_SIGN=true PipelineRun param so signing is skipped (allowed per D4 of design.md — chicken-egg unknowns at first end-to-end run). After v1.0.0 is published and pullable, run a smoke release-tools/v1.0.1 (no-op image bump or tooling rev) with SKIP_SIGN=false (default) to confirm cosign-signing-key Secret shape matches and signature objects land in codeberg.org/operate-first/release-tools registry. Verify cosign verify --key \u003cop1st-pub\u003e against the v1.0.1 manifest. Once green: remove the SKIP_SIGN param from on-tag-publish.yaml entirely (revert to spec.md A3 fail-closed posture exactly).","acceptance_criteria":"release-tools/v1.0.1 (or later) published with SKIP_SIGN=false. cosign verify succeeds. SKIP_SIGN param removed from on-tag-publish.yaml. Bead closes when commit landing the removal merges.","notes":"PR #158 created: https://codeberg.org/goern/forgejo-mcp/pulls/158. Code removes SKIP_SIGN param, validate-skip-sign task, and all when: guards — cosign-sign/attach-sbom now unconditional. Pre-merge: operator must verify release-tools/v1.0.1 publishes with signing enabled and cosign verify passes.","status":"closed","priority":1,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T17:08:31Z","created_by":"Christoph Görn","updated_at":"2026-05-26T00:14:57Z","started_at":"2026-05-25T22:34:46Z","closed_at":"2026-05-26T00:14:57Z","close_reason":"PR #158 merged. v1.0.1 published with signing enabled (run11 succeeded). SKIP_SIGN removed from on-tag-publish.yaml. A3 fail-closed posture restored.","dependencies":[{"issue_id":"forgejo-mcp-00o","depends_on_id":"forgejo-mcp-1b4","type":"blocks","created_at":"2026-05-25T17:08:36Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-j52","title":"Split cosign keypair: separate release-tools-image signing from release-artifact signing","description":"Origin: L4 from release-tools-image adversarial review. v1.0.0 of the image is signed with the same cosign-signing-key Secret used to sign forgejo-mcp release artifacts. The release-tools image is consumed by .tekton/tasks/cosign-sign-release.yaml at release time, so a compromised image (via Containerfile change, transitive dep, or npm-package takeover) has access to the signing key and can sign attacker-supplied binaries. Mitigation: provision a second keypair in op1st-pipelines (e.g. cosign-signing-key-images vs cosign-signing-key-artifacts) so a release-tools image compromise cannot forge release artifact signatures. Coordinate with op1st-emea-b4mad maintainers for the second secret + reflector ruleset.","notes":"Tracked in design.md Open Questions. Filed under Status/Blocked per acceptance criteria of release-tools-image change.","status":"open","priority":1,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-25T13:52:20Z","created_by":"Christoph Görn","updated_at":"2026-05-25T13:52:20Z","dependencies":[{"issue_id":"forgejo-mcp-j52","depends_on_id":"forgejo-mcp-1b4","type":"blocks","created_at":"2026-05-25T13:52:44Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-3h2","title":"Tighten release-tools pinning: vendor goreleaser, SHA256-verify curl-installed binaries","description":"Origin: L2 from release-tools-image adversarial review. The v1.0.0 image installs goreleaser via 'go install \u003ctag\u003e' which re-resolves transitive deps from proxy.golang.org on every build; syft and cosign installed via curl by tag only (no SHA256 verify). A transitive-dep takeover in goreleaser's module graph OR a CDN poisoning of anchore/sigstore release URLs would ship unnoticed. Fix: vendor goreleaser source at pinned SHA (build via 'go build' from a committed go.mod/go.sum), and SHA256-verify all curl-downloaded binaries against checksums recorded in VERSIONS.md before installing them.","notes":"PR #159: https://codeberg.org/goern/forgejo-mcp/pulls/159. goreleaser: go install → prebuilt tarball + dual SHA256 verify. syft: curl|sh → direct tarball + dual SHA256 verify. Hashes in VERSIONS.md + Containerfile ARG defaults. cosign unchanged.","status":"in_progress","priority":1,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T13:52:15Z","created_by":"Christoph Görn","updated_at":"2026-05-25T22:42:35Z","started_at":"2026-05-25T22:37:39Z","dependencies":[{"issue_id":"forgejo-mcp-3h2","depends_on_id":"forgejo-mcp-1b4","type":"blocks","created_at":"2026-05-25T13:52:44Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-aun","title":"Hummingbird base health monitoring: SLO on hi/go tag lag + scheduled CVE rescan","description":"Origin: A6 + L6 from release-tools-image adversarial review (openspec/changes/release-tools-image/review.md). Hummingbird is young; hi/go may lag upstream Go releases. Renovate bumps tags but does NOT surface CVEs landing between bumps. Need: (a) documented SLO for acceptable lag between upstream Go GA and hi/go:\u003cver\u003e-builder availability, (b) second-source mirror policy if Red Hat pulls a tag mid-cycle, (c) scheduled PipelineRun (e.g. weekly) that pulls the published release-tools image and runs grype or trivy against it, opening issues on findings. Defer until release-tools-image v1.0.0 ships + one CVE-cycle of operational data exists.","notes":"Tracked in design.md Open Questions as forgejo-mcp-bd-A6L6 placeholder. Filed under Status/Blocked per acceptance criteria of release-tools-image change.","status":"open","priority":1,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-25T13:52:10Z","created_by":"Christoph Görn","updated_at":"2026-05-25T13:52:10Z","dependencies":[{"issue_id":"forgejo-mcp-aun","depends_on_id":"forgejo-mcp-1b4","type":"blocks","created_at":"2026-05-25T13:52:44Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-trb","title":"Fix goreleaser-release Task: move Go cache out of git checkout to avoid dirty-tree","description":"GoReleaser run on v2.24.1 failed: 'git is in a dirty state' caused by GOCACHE=/workspace/src/.gocache + GOMODCACHE=/workspace/src/.gomodcache placing untracked dirs inside the repo. GoReleaser checks git status before publishing and bails on any uncommitted/untracked content. Fix: move caches to /tmp/gocache + /tmp/gomodcache (per-step but acceptable; release runs once per tag).","acceptance_criteria":"goreleaser release succeeds on v2.24.2; cosign-sign + mcpb-pack downstream Tasks complete; all 8 assets uploaded","status":"closed","priority":1,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T11:54:05Z","created_by":"Christoph Görn","updated_at":"2026-05-25T11:55:30Z","started_at":"2026-05-25T11:54:05Z","closed_at":"2026-05-25T11:55:30Z","close_reason":"PR #154 merged. Go cache moved to /tmp. v2.24.2 cut next.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-29g","title":"Fix goreleaser-release Task: collapse install steps to survive Pod step-isolation","description":"Path B workaround for forgejo-mcp-1b4. Step containers in a Tekton Pod don't share /usr/local/bin/, so syft + goreleaser installed in install-* steps disappear before the release step runs (exit 127 'goreleaser: command not found' on first v2.24.0 run). Collapse install-syft + install-goreleaser + release into a single Step that installs both tools inline and then invokes goreleaser release. Smoke-test stays separate (reads from dist/ on workspace). Proper image-based fix tracked in forgejo-mcp-1b4.","acceptance_criteria":"goreleaser-release Task succeeds end-to-end on v2.24.1; all 8 release assets uploaded to Codeberg; cosign-sign + mcpb-pack downstream Tasks complete","status":"closed","priority":1,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T11:47:11Z","created_by":"Christoph Görn","updated_at":"2026-05-25T11:49:15Z","started_at":"2026-05-25T11:47:15Z","closed_at":"2026-05-25T11:49:15Z","close_reason":"PR #153 merged. Inline syft+goreleaser install in release Step; v2.24.1 cut next to validate.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-hvr","title":"Fix release workflow smoke-test: --help + dead ldflags break v2.23.0 release","description":"Release run 172 (tag v2.23.0) failed at smoke-test step in .forgejo/workflows/release.yml. Two compounding bugs:\n\n1. main.go declares 'var Version = \"dev\"' but .goreleaser.yml ldflags inject '-X main.BuildTag={{.Version}}' (and BuildCommit/BuildDate). Symbol main.BuildTag is not defined anywhere — grep returns zero hits. So Version stays 'dev' in shipped binaries.\n\n2. Smoke-test runs '$BIN --help' but the CLI uses flag.NewFlagSet with ExitOnError; --help is undefined, exits non-zero with 'flag provided but not defined: -help' on stderr and Usage banner. The expected regex '^forgejo-mcp ${VERSION}([+-]|$)' never matches.\n\nFix:\n- .goreleaser.yml: rewrite ldflags to -X main.Version={{.Version}} (drop dead BuildCommit/BuildDate or wire them to real vars).\n- .forgejo/workflows/release.yml: invoke '$BIN version' (the 'version' subcommand documented in cmd.go isVersionRequest) instead of '--help'.\n\nTracks: https://codeberg.org/goern/forgejo-mcp/actions/runs/172","notes":"PR #149 opened: https://codeberg.org/goern/forgejo-mcp/pulls/149. Fix verified locally (ldflags + 'version' subcommand). Awaiting merge + next release tag to re-cut release pipeline.","status":"closed","priority":1,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T08:28:14Z","created_by":"Christoph Görn","updated_at":"2026-05-25T08:37:38Z","started_at":"2026-05-25T08:28:17Z","closed_at":"2026-05-25T08:37:38Z","close_reason":"PR #149 merged into main (merge commit 332b989). Release pipeline fixed; next semantic-release tag (v2.23.1+) will re-cut a clean release.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-5x8","title":"fix: add pull_request event to Codeberg webhook for op1st PaC","description":"Codeberg repo webhook (id 60326) to op1st Pipelines-as-Code controller only subscribes to push event. No pull_request event delivered, so on-pull-request, openspec-validate-pr, code-scans PR pipelines never fire on any open PR (#126, #138, #139). Push pipelines on main work fine (verified on 4f57c57). Fix: PATCH hook events to include pull_request (and pull_request_comment for /ok-to-test on fork PRs).","notes":"Verified via curl: events=['push']. Root cause of all three open PRs lacking PaC statuses.","status":"closed","priority":1,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T07:13:31Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:16:46Z","started_at":"2026-05-24T07:15:18Z","closed_at":"2026-05-24T07:16:46Z","close_reason":"Patched webhook 60326 events from ['push'] to push+pull_request+pull_request_comment (plus auto-expanded subevents). Verified: /test comment on PR #139 triggered op1st Pipelines as Code / on-pull-request status (pending). All future PR opens/syncs/comments will now reach PaC.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-f37","title":"CI: add lint, race, mod-tidy, govulncheck to go-ci task","description":"Current .tekton/tasks/go-ci.yaml only does build+test. Missing critical correctness gates. Add golangci-lint (gofmt, errcheck, staticcheck, ineffassign, gosec), go test -race -shuffle=on -count=1, go mod tidy drift check, govulncheck ./...","acceptance_criteria":"go vet runs, golangci-lint runs (warning-only first pass acceptable), race detector on, govulncheck zero high-severity findings, go.mod/go.sum drift fails build","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/142 (mergeable). Bead stays in_progress until merge — close on merge.","status":"closed","priority":1,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:30Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:24:57Z","started_at":"2026-05-24T07:06:57Z","closed_at":"2026-05-24T07:24:57Z","close_reason":"Merged via PR #142 (rebase). Step 1 hardening live in main.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-3a9","title":"Dashboard: subway-map dependency graph","description":"Replace the flat text edge list in beads-dashboard.html with a layered SVG subway-map view of issue dependencies. Goals: visualise upstream→downstream chains, colour 'lines' per source issue, click station to jump to that issue card.","acceptance_criteria":"SVG renders all dep edges with no overlapping stations; click on a station selects and scrolls to the matching issue; nodes coloured by status (closed/in_progress/open); responsive layout (page still usable at 800px width).","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T23:08:05Z","created_by":"Christoph Görn","updated_at":"2026-05-25T23:10:21Z","started_at":"2026-05-25T23:08:09Z","closed_at":"2026-05-25T23:10:21Z","close_reason":"subway-map dep view shipped in beads-dashboard.html — layered SVG with orthogonal routing, status-coloured stations, click-to-jump.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-wqm","title":"Rewrite .tekton/tasks/ to use release-tools image (drop runtime installs)","description":"All 5 tasks in .tekton/tasks/ still install tools at runtime (microdnf, curl, go install, npx -y, npm install -g). With govulncheck and openspec now baked into the release-tools image, all runtime installs can be removed. Tasks to rewrite: goreleaser-release (syft+goreleaser go install), cosign-sign-release (microdnf jq+curl in upload step), mcpb-pack (npx -y mcpb + apt-get jq), go-ci (govulncheck go install), openspec-validate (npm install -g openspec). Each task should use RELEASE_TOOLS_IMAGE param defaulting to codeberg.org/operate-first/release-tools:latest. External PR: https://codeberg.org/goern/forgejo-mcp/pulls/157","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T21:21:01Z","created_by":"Christoph Görn","updated_at":"2026-05-25T21:24:08Z","started_at":"2026-05-25T21:21:04Z","closed_at":"2026-05-25T21:24:08Z","close_reason":"All 5 tasks rewritten in commit 0dcb2e1. No runtime installs remain. Minutes posted to PR #157.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-6t6","title":"Fix code review issues from PR #157 automated review","description":"Address all 11 inline review comments from the automated multi-agent review on PR #157 (release-tools image + Tekton pipelines). Comments span: (1) build-image IMAGE_DIGEST extraction broken, (2) syft-scan-image tries registry pull for unpushed image, (3) push-image-by-digest TOCTOU concern, (4) Containerfile floating base tag, (5) syft installer from main branch, (6) cosign no integrity verify, (7) npm install -g re-resolves transitive deps, (8-9) cosign-sign + cosign-attach-sbom unverified downloads, (10) SKIP_SIGN ungated, (11) mutable cosign.pub URL in README. External PR: https://codeberg.org/goern/forgejo-mcp/pulls/157","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T21:04:41Z","created_by":"Christoph Görn","updated_at":"2026-05-25T21:12:09Z","started_at":"2026-05-25T21:04:45Z","closed_at":"2026-05-25T21:12:09Z","close_reason":"All 11 review findings fixed in commit d59b910, pushed to feat/release-tools-pipelines, minutes posted to PR #157","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-46j","title":"Publish SLSA provenance attestation for release-tools image via Tekton Chains","description":"Origin: L5 from release-tools-image adversarial review. Tekton Chains is deployed in op1st-pipelines (per ADR docs/design/release-pipeline-migration.md and op1st-emea-b4mad manifests/applications/op1st-pipelines/tekton-chains.yaml) but the release-tools publish pipeline does not consume its in-toto SLSA v1.0 attestations. Cosign signature alone attests signer-holds-key, NOT build-provenance binding image digest → PipelineRun → git commit → builder identity. With key-split (L4) still pending, the provenance gap is exploitable. Fix: enable Chains annotations on the publish PipelineRun (chains.tekton.dev/transparency-upload: true), have Chains produce SLSA v1.0 provenance, attach as cosign attestation, document 'cosign verify-attestation --type slsaprovenance' in README.","notes":"Tracked in design.md Open Questions. Filed under Status/Blocked per acceptance criteria of release-tools-image change.","status":"open","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-25T13:52:26Z","created_by":"Christoph Görn","updated_at":"2026-05-25T13:52:26Z","dependencies":[{"issue_id":"forgejo-mcp-46j","depends_on_id":"forgejo-mcp-1b4","type":"blocks","created_at":"2026-05-25T13:52:44Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-a2y","title":"Remove in-repo secrets/ + use op1st-emea-b4mad as normative source for cosign public key","description":"Delete secrets/cosign.pub, secrets/cosign-signing-key.enc.yaml, secrets/.gitkeep (and the dir). Cosign-signing-key public key normative source moves to https://codeberg.org/operate-first/op1st-emea-b4mad/raw/.../cosign-signing-key.pub, matching the Tekton release pipeline's signing key in op1st-pipelines namespace. Note: legacy releases signed via Forgejo Actions (Codeberg Actions COSIGN_PRIVATE_KEY) used a different keypair (now-deleted secrets/cosign.pub) — historical verification still possible via git history of commit 791ef6d.","acceptance_criteria":"secrets/ directory removed from main; .gitignore rules for secrets/ cleaned up; README Verifying Releases chapter points at op1st-emea-b4mad URL; ADR + runbook references updated; legacy-key note explains historical signature verification","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/152 (branch chore/remove-stale-secrets). Stale secrets/ + scripts/cosign-keygen.sh removed; README + ADR + runbook now point at op1st-emea-b4mad/.../cosign-signing-key.pub (commit 8a3c55e5).","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T11:33:54Z","created_by":"Christoph Görn","updated_at":"2026-05-25T11:38:24Z","started_at":"2026-05-25T11:34:01Z","closed_at":"2026-05-25T11:38:24Z","close_reason":"PR #152 merged. secrets/ + scripts/cosign-keygen.sh removed; README + ADR + runbook now point at op1st-emea-b4mad/.../cosign-signing-key.pub as normative source.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-n85","title":"Disable Forgejo Actions release workflow auto-trigger (soft cutover)","description":"Switch .forgejo/workflows/release.yml trigger from 'push tags v*' to 'workflow_dispatch' only. Stops auto-firing on tag push while preserving the file as a manual fallback if the op1st Tekton release pipeline (added in PR #150) fails. Full file deletion deferred to forgejo-mcp-gdz once 2 successful Tekton releases prove the cutover.","acceptance_criteria":".forgejo/workflows/release.yml on=workflow_dispatch only; ADR addendum noting soft-disable date; PR opened","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/151 (branch chore/disable-forgejo-release). Trigger switched to workflow_dispatch only; ADR moved to Accepted (soft-cutover phase). Close on merge.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T11:29:02Z","created_by":"Christoph Görn","updated_at":"2026-05-25T11:31:15Z","started_at":"2026-05-25T11:29:06Z","closed_at":"2026-05-25T11:31:15Z","close_reason":"PR #151 merged. Trigger now workflow_dispatch only; Tekton sole auto-firing release path; Forgejo workflow preserved as manual fallback.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-d4b","title":"Migrate Forgejo release workflow to op1st Tekton pipeline","description":"Port .forgejo/workflows/release.yml to .tekton/ as a PipelinesAsCode release pipeline triggered on tag push v*. Cover all current features: GoReleaser w/ syft SBOMs, smoke-test of linux/amd64 binary, cosign sign-blob of checksums.txt + upload, .mcpb pack per platform (linux/darwin × amd64/arm64) + upload to Codeberg release. Run in parallel with existing Forgejo Actions release; cutover deferred. Add ADR + migration notes.","design":"PipelinesAsCode on-event=push with on-target-branch=refs/tags/v* (matches forgejo-mcp-33k cross-repo spike pattern only if PaC supports tag-push; falls back to tag-push directly). Three new tasks mirroring go-ci.yaml structure. Secrets: RELEASE_TOKEN, COSIGN_PRIVATE_KEY/PASSWORD assumed present in op1st-pipelines namespace. Existing release.yml stays untouched.","acceptance_criteria":"release pipeline yaml in .tekton/ triggered by tag push v*; reusable tasks for goreleaser, cosign-sign-blob, mcpb-pack defined under .tekton/tasks/; docs/design/release-pipeline-migration.md ADR explaining parallel-run + cutover criteria; PR opened on Codeberg","notes":"PR #150: https://codeberg.org/goern/forgejo-mcp/pulls/150. Secret validation done 2026-05-25: op1st-release-token + cosign-signing-key both confirmed in op1st-pipelines (shape + scope + cosign.pub match). Pipeline ready; next v* tag triggers parallel Tekton run. Close after 2 successful Tekton releases satisfy ADR cutover criteria.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T09:10:22Z","created_by":"Christoph Görn","updated_at":"2026-05-25T11:28:00Z","started_at":"2026-05-25T09:10:26Z","closed_at":"2026-05-25T11:28:00Z","close_reason":"PR #150 merged (commit 6c824c9). All acceptance criteria met: .tekton release PipelineRun + 3 reusable Tasks + ADR + runbook + README verification chapter all in main. Parallel-run begins on next v* tag. Cutover decision tracked in forgejo-mcp-gdz.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-dhd","title":"ci: gitleaks allowlist for placeholder tokens in demo docs","description":"gitleaks 'generic-api-key' rule flags 'Authorization: token invalid_token' on demos/multi-tenant-http.md:109 (commit bd08d6147 on fork branch byteflavour/stateless-token, incoming PR). The token is intentional test data — request 4 in the multi-tenant HTTP demo shows what an invalid token does. Add a path+regex-scoped allowlist so demo docs can use placeholder tokens (invalid_token, changeme, etc.) without tripping the scanner, while real generic-api-key detection stays intact elsewhere.","acceptance_criteria":"gitleaks scan over demos/multi-tenant-http.md returns 0 leaks. Real secret patterns elsewhere in repo still flagged. Allowlist scope limited to demos/*.md.","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/147 (mergeable). Per-rule allowlist on curl-auth-header scoped to demos/*.md + placeholder regexes. Local gitleaks v8.30.1 negative test confirms real github-pat still flagged.","status":"closed","priority":2,"issue_type":"bug","owner":"goern@b4mad.net","created_at":"2026-05-25T07:21:45Z","created_by":"Christoph Görn","updated_at":"2026-05-25T07:46:29Z","closed_at":"2026-05-25T07:46:29Z","close_reason":"PR #147 merged 2026-05-25T09:45:33+02:00; worktree + local branch ci/gitleaks-allowlist-demos cleaned up","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-phn","title":"Set Codeberg Actions secrets COSIGN_PRIVATE_KEY and COSIGN_PASSWORD","description":"Mirror cosign signing material from SOPS-encrypted secrets/cosign-signing-key.enc.yaml into Codeberg Actions repo secrets so the release pipeline can sign artifacts. Source-of-truth stays in SOPS; this is one-way sync to CI.","notes":"Decrypt with sops, extract via yq, PUT to Forgejo API /repos/goern/forgejo-mcp/actions/secrets/{name}. Never write plaintext to disk.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T11:09:58Z","created_by":"Christoph Görn","updated_at":"2026-05-24T11:11:01Z","started_at":"2026-05-24T11:10:08Z","closed_at":"2026-05-24T11:11:01Z","close_reason":"Both Codeberg Actions secrets created (HTTP 201). Verified via API list. Source-of-truth remains secrets/cosign-signing-key.enc.yaml (SOPS).","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-p1p","title":"ci: bump x/net + jsonparser to clear govulncheck advisories (run #151)","description":"Forgejo Actions ci.yml run #151 (https://codeberg.org/goern/forgejo-mcp/actions/runs/151) flagged govulncheck findings. Local scan (govulncheck v1.3.0) shows 7 findings: 0 reachable, 2 package-level (x/net/idna GO-2026-5026, buger/jsonparser GO-2026-4514), 5 module-level (x/net/html GO-2026-5025..5030). Default govulncheck exits 0 on non-reachable findings, so the CI failure may be from a stricter flag/version on the runner — fix in this PR clears them regardless. Bump x/net to v0.55.0 (clears 6), add direct require for buger/jsonparser v1.1.2 to override transitive (clears 1).","acceptance_criteria":"govulncheck ./... locally returns 0 findings at all tiers OR only retains findings not present in advisories. Next ci.yml run on a fresh PR passes the govulncheck step.","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/145 (mergeable). Local govulncheck verified clean at all tiers.","status":"closed","priority":2,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T11:06:20Z","created_by":"Christoph Görn","updated_at":"2026-05-25T22:28:25Z","started_at":"2026-05-24T11:06:27Z","closed_at":"2026-05-25T22:28:25Z","close_reason":"PR #145 merged 2026-05-25 (612da9f). govulncheck ./... on main: no vulnerabilities. All 7 advisories cleared.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-1l5","title":"RFC: introduce MCP resource templates for core entities (owner, repo, commit, issue, pr, comment, status)","description":"## Why\n\nforgejo-mcp is currently tool-only. No MCP resources registered in operation/operation.go. Core Forgejo entities (owner, repo, commit, issue, pr, comment, status) are noun-like, addressable, and often immutable or stable — natural fit for MCP resource templates. Exposing them as resources unlocks:\n\n- URI-based references the LLM can auto-resolve (e.g. PR diff mentions a sha → fetch commit resource)\n- Cacheable, content-addressable lookup (commits especially)\n- Cleaner composition: a PR resource can link to commit + comment resources instead of forcing tool-call ceremony\n\nDoing this piecemeal (one entity at a time) creates an inconsistent server. A coherent design pass covering all seven entities at once avoids that.\n\n## What\n\nProduce an OpenSpec proposal that designs MCP resource templates for:\n\n- owner (user or org): `forgejo://owner/{name}`\n- repo: `forgejo://repo/{owner}/{repo}`\n- commit: `forgejo://repo/{owner}/{repo}/commit/{sha}`\n- issue: `forgejo://repo/{owner}/{repo}/issue/{index}`\n- pr: `forgejo://repo/{owner}/{repo}/pr/{index}`\n- comment: `forgejo://repo/{owner}/{repo}/{issue|pr}/{index}/comment/{id}`\n- status: `forgejo://repo/{owner}/{repo}/commit/{sha}/status` (combined) + `.../statuses` (list)\n\nURI scheme above is illustrative — proposal must justify final scheme.\n\n## Acceptance criteria\n\n- OpenSpec change proposal created via /openspec-propose covering all 7 entity templates\n- Proposal includes: URI scheme rationale, capability registration changes to operation/operation.go, handler pattern, MIME type per resource, relationship to existing tools (coexist or replace?), output bounding strategy (AGENTS.md docs/design/output-bounding.md), client compatibility matrix, migration/rollout plan\n- design.md addresses: listable vs template-only per entity, subscription semantics (do we support resource updates?), error handling for missing/private entities, auth scope\n- Specs cover behavior for each of the 7 entities\n- Tasks broken down per-entity so implementation can land incrementally even though design is unified\n\n## Out of scope\n\n- Implementation (this bead = design only)\n- Wiki/projects resources (blocked upstream per docs/plans/)\n- Webhook/event resources\n\n## Notes\n\nDriven by session discussion 2026-05-24 around replacing curl-based commit status fetches with proper MCP surface. Decision: design resources holistically rather than one-off per entity.","notes":"OpenSpec change created at openspec/changes/mcp-resource-templates/ on branch worktree-rfc-resource-templates. 4/4 artifacts pass strict validation (proposal, design, 8 spec files, tasks). 13 design decisions documented. 7-slice rollout plan in tasks.md. Ready for /opsx:apply to start implementation.","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T07:35:50Z","created_by":"Christoph Görn","updated_at":"2026-05-25T08:04:39Z","started_at":"2026-05-25T07:30:03Z","closed_at":"2026-05-25T08:04:39Z","close_reason":"OpenSpec proposal complete: proposal.md, design.md, 8 spec files, tasks.md all pass strict validation. Branch: worktree-rfc-resource-templates.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-e9i","title":"CI: investigate Forgejo Actions ci.yml failure on PR #143","description":"First run of .forgejo/workflows/ci.yml (run #147, SHA d711f32) failed at 3m43s. Merged anyway. No per-step detail available via Codeberg API. Need to: (1) open https://codeberg.org/goern/forgejo-mcp/actions/runs/147 in browser, identify which step failed; (2) fix root cause (likely candidates: golangci-lint-action@v6 incompatibility on Codeberg runner, cache mount permissions, missing toolchain, setup-go@v6 quirk); (3) verify on follow-up PR.","acceptance_criteria":"ci.yml run on a fresh PR completes with all steps green (lint warn-only acceptable). Document root cause in bd notes.","status":"open","priority":2,"issue_type":"bug","owner":"goern@b4mad.net","created_at":"2026-05-24T07:35:45Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:35:45Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-51l","title":"CI: harden release pipeline (SBOM, cosign, smoke-test)","description":"release.yml ships .mcpb per platform but never verifies binary boots. Add: syft SBOM upload as release asset, cosign sign binaries+containers (keyless via OIDC if available, else key from secret), smoke-test ./forgejo-mcp --version per arch before .mcpb upload.","acceptance_criteria":"SBOM uploaded per release, signatures verifiable, smoke-test runs on linux/amd64 at minimum","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/144 (mergeable). Branch ci/step3-release-hardening. 3 commits:\n1. .goreleaser.yml: checksums + per-archive CycloneDX SBOMs via syft\n2. release.yml: syft + cosign install, smoke-test linux/amd64 binary, conditional cosign sign-blob on checksums.txt\n3. scripts/cosign-keygen.sh: SOPS-encrypted k8s Secret keypair generator (tmpfs + shred + no-echo password)\n\nSigning gated on COSIGN_PRIVATE_KEY + COSIGN_PASSWORD repo secrets — releases keep working until secret provisioned. Activation steps in PR body.\n\nLocal verification:\n- goreleaser check → 1 configuration file(s) validated\n- YAML lint → OK\n- bash -n on script → OK (no shellcheck available locally)\n\nUntested in PR (require tagged release): SBOM upload path, smoke-test on real built binary, cosign sign flow.","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:38Z","created_by":"Christoph Görn","updated_at":"2026-05-24T10:59:53Z","started_at":"2026-05-24T10:30:14Z","closed_at":"2026-05-24T10:59:53Z","close_reason":"Merged via PR #144 (commit b2c67f8). Activation pending: run scripts/cosign-keygen.sh, add COSIGN_PRIVATE_KEY + COSIGN_PASSWORD to Codeberg Actions secrets, then signing kicks in on next v* tag.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-9n2","title":"CI: add Forgejo Actions PR workflow with Go cache","description":"Tekton has no cross-run Go cache (PVC ephemeral). Add .forgejo/workflows/ci.yml mirroring go-ci gates on codeberg-small runner using actions/setup-go cache. Run parallel to Tekton 2 weeks, then decide canonical.","acceptance_criteria":"ci.yml runs on pull_request + push to main, uses setup-go cache, runs build/test/lint/race/govulncheck, completes \u003c5min on cache hit","notes":"PR opened: https://codeberg.org/goern/forgejo-mcp/pulls/143 (mergeable). Will close on merge. First Forgejo Actions run will be cold-cache; verify \u003c5min on second run.","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:34Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:35:56Z","started_at":"2026-05-24T07:25:05Z","closed_at":"2026-05-24T07:35:56Z","close_reason":"Merged via PR #143 (rebase, force_merge — run #147 failed, fix tracked in forgejo-mcp-e9i).","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-33k","title":"C5 spike: verify cross-repo workflow_call on Codeberg Forgejo v11.x","description":"Battle-test of forgejo-action-code-review deferred this spike. Spike scaffolding under openspec/changes/forgejo-action-code-review/spikes/c5-cross-repo-workflow-call/. Library + consumer repos already exist on Codeberg (goern/c5-spike-lib, goern/c5-spike-consumer). Remaining steps: (1) create tag v0.0.1 on c5-spike-lib main, (2) set repo secret SPIKE_SECRET on both repos, (3) push trigger commit to c5-spike-consumer main, (4) observe whether cross-repo uses: resolves, secret propagates, event context shape. Result drives design.md D9: keep Path B as recommended, or demote to experimental.","status":"open","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-13T06:33:23Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-673","title":"Implement forgejo-action-code-review workflow","description":"OpenSpec change forgejo-action-code-review has spec deltas (8 capability requirements, PR specs/action-code-review/spec.md) but no implementation. The workflow file .forgejo/workflows/claude-code-review.yml does not exist. Need to ship the reusable Forgejo Actions workflow that runs Claude Code with forgejo-mcp on PR events, installs CC, registers forgejo-mcp as MCP server, runs /code-review skill in -p mode, and posts findings via create_pull_review. Depends on forgejo-code-review-skill (delivered). See openspec/changes/forgejo-action-code-review/ for proposal + specs.","status":"open","priority":2,"issue_type":"feature","owner":"goern@b4mad.net","created_at":"2026-05-12T13:37:41Z","created_by":"Christoph Görn","updated_at":"2026-05-12T13:37:41Z","dependencies":[{"issue_id":"forgejo-mcp-673","depends_on_id":"forgejo-mcp-33k","type":"blocks","created_at":"2026-05-13T06:33:31Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-fdx","title":"Migrate openspec validate from Forgejo Actions to op1st Tekton","description":"Pivot PR 132: drop .forgejo/workflows/openspec.yml, add Tekton PipelineRuns for openspec validate using op1st-pipelines (PaC). Path-gated via CEL on openspec/** and .tekton/*openspec* changes. Same trigger semantics: push to main + PR open/sync.","acceptance_criteria":"- .tekton/tasks/openspec-validate.yaml runs openspec@1.3.1 validate --all --strict --no-interactive\n- .tekton/on-pull-request-openspec.yaml + on-push-to-main-openspec.yaml gate on path changes via CEL\n- .forgejo/workflows/openspec.yml deleted\n- PR 132 retitled to reflect Tekton migration","status":"closed","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-12T07:46:04Z","created_by":"Christoph Görn","updated_at":"2026-05-12T07:48:35Z","closed_at":"2026-05-12T07:48:35Z","close_reason":"Landed in PR 132 commit fbd1203 on feat/openspec-workflow. on-pull-request-openspec PipelineRun green (24s). Old .forgejo/workflows/openspec.yml deleted.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-43k","title":"Replace .forgejo/workflows/go.yml with op1st Tekton CI","description":"Codeberg Forgejo runners enforce strict job time limits. Move CI to op1st-pipelines (Pipelines-as-Code on OpenShift). Run go build + go test on every push to main and every PR change. Follow patterns from goern/epaper-service and feeldata/feeldata.app.","acceptance_criteria":"- .tekton/repository.yaml registers repo with op1st-pipelines\n- .tekton/on-push-to-main.yaml triggers go build + go test on push to main\n- .tekton/on-pull-request.yaml triggers go build + go test on PR open/sync\n- Custom go-ci task uses docker.io/library/golang:1.25\n- PaC secrets reuse codeberg-runner-openshift-pac + codeberg-org-op1st-pipelines\n- .forgejo/workflows/go.yml deleted","notes":"Tracked on Codeberg as goern/forgejo-mcp#133 (https://codeberg.org/goern/forgejo-mcp/issues/133). Implementation in commit ae35a30. Remaining: Repository CR apply in op1st-pipelines namespace (cluster-side, out-of-band).","status":"closed","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-12T06:38:01Z","created_by":"Christoph Görn","updated_at":"2026-05-12T06:40:54Z","closed_at":"2026-05-12T06:39:55Z","close_reason":"Implemented in commit ae35a30. .tekton/ PaC config + go-ci task replace .forgejo/workflows/go.yml.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-zwr","title":"Complete add-bounded-text-responses change for Codeberg #124","description":"Pre-existing scaffold at openspec/changes/add-bounded-text-responses/ has only proposal.md. Codeberg issue #124 (\"Add paged or per-file diff\", reporter fiesh, Kind/Enhancement, Reviewed/Confirmed) is still open.\n\nProposal scope:\n- Add optional `file_path` param to get_pull_request_diff (per-file slicing on `diff --git` boundaries)\n- Add optional `start_line` + `end_line` to get_file_content (1-indexed inclusive line slice)\n- README updates for missing tool entries\n\nRemaining work:\n- Add design.md, specs/bounded-pr-diff/spec.md, specs/bounded-file-content/spec.md, tasks.md\n- Implement in operation/pull/pull.go + operation/repo/file.go\n- Optional pkg/diff/ helper for unified-diff splitting\n- Tests per proposal's Impact section\n\nCurrently fails `openspec validate --all --strict` with 'no deltas found', so it blocks forgejo-mcp-6jc (workflow).\n\nUpstream: https://codeberg.org/goern/forgejo-mcp/issues/124","status":"closed","priority":2,"issue_type":"feature","owner":"goern@b4mad.net","created_at":"2026-05-11T14:32:54Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","closed_at":"2026-05-11T14:58:24Z","close_reason":"Impl + tests landed in PR #131 (commit dda4ba1). New pkg/diff splitter; get_pull_request_diff gained file_path; get_file_content gained start_line/end_line with clamping. 11 new unit tests; full suite green. README tool table updated incl previously-missing entries.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-6jc","title":"Add Forgejo Actions workflow for openspec validate","description":"Add `.forgejo/workflows/openspec.yml` running `openspec validate --all --strict --no-interactive` on PRs touching `openspec/**` or the workflow file itself. Reference: https://codeberg.org/goern/epaper-service/src/branch/main/.forgejo/workflows/openspec.yml\n\nPinned version: `@fission-ai/openspec@1.3.1` (current local).\n\nBlocked by the 4 spec/change cleanup tasks (forgejo-mcp-6un, forgejo-mcp-a0p, forgejo-mcp-517, forgejo-mcp-cpb) — workflow strict would fail on day 1 otherwise.","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-11T14:18:58Z","created_by":"Christoph Görn","updated_at":"2026-05-11T15:04:35Z","started_at":"2026-05-11T15:03:34Z","closed_at":"2026-05-11T15:04:35Z","close_reason":"Landed in PR #132 (commit 16ca60f). Workflow runs openspec validate --all --strict on openspec/** and workflow file changes, modeled on epaper-service workflow. Pre-existing failures (4 specs/changes) were cleaned up first so gate is green from day one.","dependencies":[{"issue_id":"forgejo-mcp-6jc","depends_on_id":"forgejo-mcp-517","type":"blocks","created_at":"2026-05-11T14:19:03Z","created_by":"Christoph Görn","metadata":"{}"},{"issue_id":"forgejo-mcp-6jc","depends_on_id":"forgejo-mcp-6un","type":"blocks","created_at":"2026-05-11T14:19:02Z","created_by":"Christoph Görn","metadata":"{}"},{"issue_id":"forgejo-mcp-6jc","depends_on_id":"forgejo-mcp-a0p","type":"blocks","created_at":"2026-05-11T14:19:02Z","created_by":"Christoph Görn","metadata":"{}"},{"issue_id":"forgejo-mcp-6jc","depends_on_id":"forgejo-mcp-cpb","type":"blocks","created_at":"2026-05-11T14:19:03Z","created_by":"Christoph Görn","metadata":"{}"},{"issue_id":"forgejo-mcp-6jc","depends_on_id":"forgejo-mcp-zwr","type":"blocks","created_at":"2026-05-11T14:33:02Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":5,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-cpb","title":"Fix openspec change: forgejo-action-code-review has no deltas","description":"openspec/changes/forgejo-action-code-review/ fails validation:\n\n```\n✗ [ERROR] file: Change must have at least one delta. No deltas found.\nEnsure your change has a specs/ directory with capability folders containing .md files\nthat use delta headers (## ADDED/MODIFIED/REMOVED/RENAMED Requirements) and that each\nrequirement includes at least one \"#### Scenario:\" block.\n```\n\nAdd a `specs/\u003ccapability\u003e/spec.md` with `## ADDED Requirements` deltas and scenarios reflecting the change's intent. Probably has design.md but no spec delta.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-11T14:18:52Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","started_at":"2026-05-11T14:40:50Z","closed_at":"2026-05-11T14:42:00Z","close_reason":"Landed in commit a83a033. Added specs/action-code-review/spec.md with 8 capability requirements + scenarios. openspec validate forgejo-action-code-review --strict passes.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-517","title":"Fix openspec spec: pr-review-write missing Purpose/Requirements headers","description":"openspec/specs/pr-review-write/spec.md fails validation with the same missing-headers error as cli-mode and merge-pull-request. Add `## Purpose` and `## Requirements` sections.","status":"closed","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-11T14:18:45Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","closed_at":"2026-05-11T14:30:43Z","close_reason":"Landed in commit c8a7883. Both specs now carry Purpose + Requirements headers; openspec validate --strict passes.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-a0p","title":"Fix openspec spec: merge-pull-request missing Purpose/Requirements headers","description":"openspec/specs/merge-pull-request/spec.md fails strict + non-strict validation with the same missing-headers error as cli-mode. Add `## Purpose` and `## Requirements` sections.","status":"closed","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-11T14:18:41Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","closed_at":"2026-05-11T14:30:43Z","close_reason":"Landed in commit c8a7883. Both specs now carry Purpose + Requirements headers; openspec validate --strict passes.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-6un","title":"Fix openspec spec: cli-mode missing Purpose/Requirements headers","description":"openspec/specs/cli-mode/spec.md fails strict + non-strict validation:\n\n```\n✗ [ERROR] file: Spec must have a Purpose section.\nMissing required sections. Expected headers: \"## Purpose\" and \"## Requirements\"\n```\n\nAdd the two missing top-level section headers. Content already implies a purpose — promote it. Prerequisite for forgejo-mcp-NEW-workflow.","status":"closed","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-11T14:18:36Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","closed_at":"2026-05-11T14:29:36Z","close_reason":"Landed in commit 23db899. cli-mode spec now has Purpose + Requirements headers; openspec validate cli-mode --strict passes.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-0ep","title":"Add MCP tools for Forgejo releases","description":"Codeberg issue #127: surface release operations (list, get, create, edit, delete, list assets) as MCP tools to help generate release notes and changelogs.\n\nUpstream: https://codeberg.org/goern/forgejo-mcp/issues/127","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-11T13:26:17Z","created_by":"Christoph Görn","updated_at":"2026-05-12T14:56:12Z","started_at":"2026-05-11T13:26:22Z","closed_at":"2026-05-12T14:56:12Z","close_reason":"PR #134 merged (https://codeberg.org/goern/forgejo-mcp/pulls/134); 14 tools live","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-efo","title":"Fix update_issue tool: assignee field ignored by Forgejo API","description":"The mcp__codeberg__update_issue tool exposes a singular 'assignee' parameter, but Forgejo's EditIssueOption ignores the deprecated singular field in current API versions and only honors the 'assignees' array.\n\nObserved in issue goern/forgejo-mcp#127: calling update_issue with assignee=goern returned HTTP 200 but a follow-up GET still shows assignees:null.\n\nWhat needs to be done:\n- Locate the update_issue handler in operation/issue/ (or wherever EditIssue is wired)\n- Change the SDK call to pass assignees=[]string{assignee} (or expose an 'assignees' parameter directly)\n- Keep the singular 'assignee' param for backward compat, but convert to array before SDK call\n- Add an integration test that asserts the assignee actually persists after update\n\nAcceptance:\n- update_issue with assignee=\u003cuser\u003e results in assignees containing that user on subsequent GET\n- Upstream tracking: codeberg.org/goern/forgejo-mcp#\u003cTBD\u003e","status":"closed","priority":2,"issue_type":"bug","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-11T13:24:23Z","created_by":"Christoph Görn","updated_at":"2026-05-11T13:29:56Z","started_at":"2026-05-11T13:25:58Z","closed_at":"2026-05-11T13:29:56Z","close_reason":"Fix landed in commit 6291213. Singular 'assignee' now wired to opt.Assignees=[]string{assignee}. New 'assignees' CSV param overrides. Unit tests in operation/issue/issue_test.go cover singular, CSV, clear, and omit cases. Upstream: codeberg.org/goern/forgejo-mcp#128.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-e0j","title":"docs(design): codify output-bounding rule from #124","description":"Issue #124 surfaced unbounded MCP tool outputs (diffs, files, pull-files lists) blowing up context windows. Codify the rule derived in triage as a design doc and reference it from AGENTS.md so every new tool considers output bounding by default. Three sub-rules: no silent truncation, bound by domain shape (line/per-file/page), always resumable.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-10T14:09:42Z","created_by":"Christoph Görn","updated_at":"2026-05-10T14:12:04Z","started_at":"2026-05-10T14:09:45Z","closed_at":"2026-05-10T14:12:04Z","close_reason":"Landed in 1412cbe — docs/design/output-bounding.md + AGENTS.md checklist update.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-xv0","title":"OpenSpec change for org-label support in list_repo_labels","description":"Sub-task of forgejo-mcp-7ch. Author OpenSpec change covering:\n- New tool list_org_labels(org, page, limit)\n- Augmentation of list_repo_labels with include_org_labels bool (default true) and scope tag on each label\n- Use pkg/forgejo.DoJSONList against /orgs/{org}/labels (no SDK upgrade)\n- Test plan: httptest server fixtures for repo-only, org-only, merged, 404→empty\n\nOutput: artifacts under openspec/changes/\u003cchange-id\u003e/ following experimental workflow (proposal, design, tasks, deltas).","status":"closed","priority":2,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-09T20:38:32Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","closed_at":"2026-05-09T20:43:52Z","close_reason":"OpenSpec change add-org-label-support authored on branch issues/125","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-7ch","title":"list_repo_labels missing org-level labels (#125)","description":"Codeberg issue #125: list_repo_labels exposes only repo-scoped labels. Forgejo API also exposes /orgs/{org}/labels which SDK v3 does not bind. For org-owned repos, org labels are usable on issues but invisible to MCP — model cannot discover their IDs.\n\nImpl path:\n- Add new tool list_org_labels(org, page, limit) using pkg/forgejo.DoJSONList against /orgs/{org}/labels.\n- Augment list_repo_labels with bool include_org_labels (default true). When repo owner is org, merge org labels and tag each with scope=repo|org.\n- No SDK upgrade required — same pattern as attachments raw-HTTP path.\n- Tests via httptest server matching pkg/forgejo/*_test.go patterns.\n\nAcceptance:\n- list_repo_labels of an org-owned repo returns repo+org labels with scope tag.\n- list_org_labels callable standalone.\n- 404 from org endpoint maps to empty (no error).\n- include_org_labels=false suppresses merge.\n- Tests cover both tools.","acceptance_criteria":"list_repo_labels returns org labels when repo owner is org; new list_org_labels tool callable; tests cover both","notes":"Merged in PR #130 (squash, 2026-05-12). Closes Codeberg #125.","status":"closed","priority":2,"issue_type":"bug","owner":"goern@b4mad.net","created_at":"2026-05-09T20:38:27Z","created_by":"Christoph Görn","updated_at":"2026-05-12T08:41:22Z","closed_at":"2026-05-11T14:48:41Z","dependencies":[{"issue_id":"forgejo-mcp-7ch","depends_on_id":"forgejo-mcp-xv0","type":"blocks","created_at":"2026-05-09T20:38:35Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-9y4","title":"Wire .mcpb build into release pipeline","description":"PR #118 adds extension/ scaffolding for Claude Desktop Extension (.mcpb) but does NOT produce .mcpb on release. Maintainer must extend release.yml so users get downloadable .mcpb per release.\n\nRequired:\n1. Inject release tag into extension/manifest.json version field (currently hardcoded 2.20.0). Use jq before mcpb pack.\n2. Build per-platform .mcpb archives OR single .mcpb with server.mcp_config.platform_overrides bundling all 4 binaries (linux/darwin x amd64/arm64).\n3. Attach resulting .mcpb file(s) to Codeberg release alongside existing tar.gz archives.\n4. Optional: sign with npx @anthropic-ai/mcpb sign.\n\nWhy: PR #118 leaves this explicitly as follow-up. Without it, end users on releases page see only tar.gz binaries, no drag-and-drop install artifact. Extension story incomplete from end-user POV.\n\nHow to apply: extend .forgejo/workflows/release.yml with post-goreleaser job. Use dist/ artifacts produced by goreleaser as input. See PR #118 review for concrete shell snippet.","acceptance_criteria":"- Each tagged release on codeberg.org/goern/forgejo-mcp/releases includes .mcpb artifact(s)\n- manifest.json version matches release tag at pack time (no hardcoded version drift)\n- .mcpb installs cleanly in Claude Desktop on at least linux-amd64 and darwin-arm64\n- Smoke test (extension/test_smoke.py) runs in CI before pack","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-07T20:23:07Z","created_by":"Christoph Görn","updated_at":"2026-05-07T21:02:47Z","started_at":"2026-05-07T20:25:53Z","closed_at":"2026-05-07T21:02:47Z","close_reason":"Shipped in PR #122 (commit fdc6305): release.yml builds and attaches per-platform .mcpb (linux/darwin x amd64/arm64) with jq-based manifest version injection. Local make target added in commit 679d593.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-vsm","title":"E2E test script for attachment tools","description":"Shell script in test/e2e/attachments.sh that exercises ./forgejo-mcp --cli end-to-end against live Codeberg: create issue, upload attachment, list, get, verify browser_download_url, cleanup. Validates v2.19.0-alpha.1 attachment tools work in real deployment as referenced in issue #106.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-04-27T06:54:05Z","created_by":"Christoph Görn","updated_at":"2026-04-27T06:55:37Z","started_at":"2026-04-27T06:54:10Z","closed_at":"2026-04-27T06:55:37Z","close_reason":"Script at test/e2e/attachments.sh, passes live against Codeberg, committed 8ec35e5.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-zhi","title":"Amend issue-attachments spec: lower inline cap to 1 MiB and always include download URL","description":"Follow-up to heathen711's feedback on https://codeberg.org/goern/forgejo-mcp/issues/106. After discussion (comments 13562510, 13701827, 13703888), the agreed scope is two narrow changes to docs/plans/issue-attachments.md: (1) lower MaxInlineDownloadBytes from 10 MiB to 1 MiB, (2) always include browser_download_url in download_*_attachment responses regardless of size. Files under the cap return base64-encoded bytes inline (current MCP-protocol-native behavior); files over the cap return metadata + URL only, and the LLM is expected to fall through to a curl/Bash fetch using its existing token. Earlier proposals — save_to_path parameter and inline:true flag — dropped per heathen711's reasoning: file-path returns introduce tmpfile hygiene + cross-container permission problems, which is exactly why MCP standardised on pipe-based binary delivery; size-cap discrimination already gives the metadata-vs-bytes split without an extra flag. Must land before forgejo-mcp-ydg implementation starts.","design":"Two-line behavioural change: const MaxInlineDownloadBytes = 1 * 1024 * 1024 (was 10 * 1024 * 1024); download_*_attachment response shape always carries browser_download_url alongside metadata, with bytes only if size \u003c cap. No new tool-surface parameters. Open Question #2 in the spec (private-repo auth on browser_download_url) becomes load-bearing — the fall-through-to-curl pattern only works if the URL accepts Authorization: token $TOKEN; verify in Part 1 of the implementation.","acceptance_criteria":"docs/plans/issue-attachments.md updated with save_to_path parameter, 1 MiB cap, always-include-download-url rule, and metadata-default behavior. Parameter matrix reflects the new column. Acceptance criteria section includes save_to_path round-trip test. heathen711 notified of the amendment on issue #106.","status":"closed","priority":2,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-04-24T14:14:05Z","created_by":"Christoph Görn","updated_at":"2026-05-24T06:02:27Z","started_at":"2026-04-26T10:45:34Z","closed_at":"2026-04-26T10:46:59Z","close_reason":"Spec amended in docs/plans/issue-attachments.md: cap lowered to 1 MiB, browser_download_url always included, Open Question #2 promoted to load-bearing Part-1 verification step, acceptance criteria updated to cover both under-cap and over-cap paths. Implementation issue forgejo-mcp-ydg is now unblocked.","dependency_count":0,"dependent_count":1,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-ya6","title":"Issue/PR time tracking: tracked-time + stopwatch MCP tools","description":"Adds 10 MCP tools wrapping forgejo-sdk/v3's tracked-time and stopwatch APIs. Covers list/add/reset/delete tracked-time entries on issues and PRs (which share index space in Forgejo), plus start/stop/cancel/list_my stopwatches. No raw-HTTP helper needed — SDK has full coverage. Spec: docs/plans/issue-time-tracking.md.","design":"SDK-wrapping approach (not raw HTTP): forgejo-sdk/v3 exposes AddTime/ListIssueTrackedTimes/ResetIssueTime/DeleteTime + StartIssueStopWatch/StopIssueStopWatch/DeleteIssueStopwatch/GetMyStopwatches. Verbs mirror API primitives (chose option B over 'set' convenience wrapper to avoid non-atomic reset+add race on shared state). Duration parsing via stdlib time.ParseDuration — no extra dep. Issue/PR unified: single tool set covers both because Forgejo shares index namespace.","acceptance_criteria":"All 10 tools registered and callable; add_issue_time accepts either 'seconds' (int) or 'duration' (string like '15m'); list_issue_tracked_times returns entries with id/time/user; reset clears all entries; delete removes one; stopwatch start→stop produces a tracked-time entry visible via list; cancel discards without creating an entry; make build + go test ./... pass; both demo files run cleanly.","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-04-21T20:38:06Z","created_by":"Christoph Görn","updated_at":"2026-04-21T20:48:54Z","started_at":"2026-04-21T20:42:04Z","closed_at":"2026-04-21T20:48:54Z","close_reason":"Implemented in commit (see git log); 10 MCP tools + tests + 2 showboat demos + README update.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-ydg","title":"Issue \u0026 comment attachments: full CRUD MCP tools","description":"Closes upstream Codeberg issue goern/forgejo-mcp#106: attachments on issues are invisible to the MCP because GET /issues/{index} does not embed them, and forgejo-sdk/v3 has zero issue-attachment methods. Spec: docs/plans/issue-attachments.md (amended per forgejo-mcp-zhi). Delivers 12 new tools (list/get/download/create/edit/delete × issue + comment), a raw-HTTP helper (pkg/forgejo/rawhttp.go), binary content return via mcp.BlobResourceContents with a 1 MiB inline cap, browser_download_url always included for over-cap fall-through, and two Showboat demos (demos/issue-attachments.md, demos/comment-attachments.md). Part 1 of implementation must verify private-repo auth on browser_download_url before Part 3 begins (load-bearing — see Open Question #2 in spec).","design":"Approach 2: raw HTTP inside forgejo-mcp (chosen over upstream-first and replace-directive hybrid). Rationale: attachment endpoints are stable Gitea/Forgejo routes, raw-HTTP surface is small and contained behind one helper package, shipping time beats SDK-consistency. Risk (field drift) mitigated by reusing forgejo_sdk.Attachment as DTO + demos as live-integration canaries.","acceptance_criteria":"All 12 tools registered and callable; list_issue_attachments on goern/forgejo-mcp#106 returns the uploaded PDF metadata; download_issue_attachment round-trips bytes sha256-identical; edit/delete round-trip works for both issues and comments; list on empty entity returns []; make build + go test ./... pass; both demo files run cleanly end-to-end.","status":"closed","priority":2,"issue_type":"feature","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-04-21T20:29:49Z","created_by":"Christoph Görn","updated_at":"2026-04-26T11:11:40Z","started_at":"2026-04-26T10:58:41Z","closed_at":"2026-04-26T11:11:40Z","close_reason":"Implemented in PR #109 (feature/issue-attachments). 12 tools, rawhttp helper, all tests green, live-verified against Codeberg API.","dependencies":[{"issue_id":"forgejo-mcp-ydg","depends_on_id":"forgejo-mcp-zhi","type":"blocks","created_at":"2026-04-24T14:14:10Z","created_by":"Christoph Görn","metadata":"{}"}],"dependency_count":1,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-gdz","title":"Decide Tekton release pipeline cutover after 2 successful runs","description":"Followup to forgejo-mcp-d4b. After 2 consecutive v* releases where the op1st Tekton pipeline succeeds end-to-end and produces assets matching the Forgejo Actions output, decide canonical release path per docs/design/release-pipeline-migration.md cutover criteria. If Tekton wins: open PR removing .forgejo/workflows/release.yml. If not: file follow-up bugs explaining why and revisit.","acceptance_criteria":"ADR addendum or new commit on docs/design/release-pipeline-migration.md recording the decision; redundant pipeline (.forgejo/workflows/release.yml OR the .tekton release pipeline) removed in a single PR","notes":"Validation state after first live run cycle:\n- v2.24.0: phantom tag, no Release on Codeberg (goreleaser exit 127)\n- v2.24.1: phantom tag, no Release on Codeberg (goreleaser dirty-tree)\n- v2.24.2: 13/14 assets on Codeberg, no .sig (cosign step distroless-no-shell). Counts as partial first Tekton release.\n\nCutover criteria require 2 consecutive end-to-end successes including .sig. v2.24.2 does not qualify. Next clean Tekton release must come AFTER forgejo-mcp-1b4 (release-tools image). Once that lands, need 2 clean releases before deleting .forgejo/workflows/release.yml. Until then: pipeline stays parallel-ready, Forgejo release.yml stays as workflow_dispatch fallback.","status":"open","priority":3,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-25T11:27:33Z","created_by":"Christoph Görn","updated_at":"2026-05-25T12:04:46Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-02o","title":"Label Codeberg PR #145 via codeberg-label skill","description":"Test new codeberg-label skill end-to-end on https://codeberg.org/goern/forgejo-mcp/pulls/145. Sonnet subagent picks labels; main session applies via forgejo-mcp.","status":"closed","priority":3,"issue_type":"task","assignee":"Christoph Görn","owner":"goern@b4mad.net","created_at":"2026-05-25T07:23:23Z","created_by":"Christoph Görn","updated_at":"2026-05-25T07:24:59Z","started_at":"2026-05-25T07:23:30Z","closed_at":"2026-05-25T07:24:59Z","close_reason":"Labeled PR #145 with Kind/Security + Priority/Critical via codeberg-label skill; minutes posted.","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-e8e","title":"CI: coverage report + pre-commit parity job","description":"Post coverage as PR comment (codecov-cli or go tool cover artifact). Add CI job that runs .pre-commit-config.yaml hooks so they're enforced beyond local dev.","status":"open","priority":3,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:47Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:06:47Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-zuh","title":"CI: container build sanity on PR + edge tag on main","description":"Containerfile builds only via Konflux currently. Add PR job that builds container image as sanity check (no push). On push to main, push :edge tag to registry.","status":"open","priority":3,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:45Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:06:45Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-1p1","title":"CI: add go-licenses + conventional commits PR title check","description":"Catch GPL contamination via go-licenses check. Gate Conventional Commits PR title earlier than .releaserc post-merge (use commitlint or equivalent action).","status":"open","priority":3,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:42Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:06:42Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-td8","title":"CI: decide canonical PR gate (Tekton vs Forgejo Actions)","description":"After 2 weeks of parallel Forgejo Actions + Tekton PR gates, evaluate reliability/speed/contributor-visibility and pick one as canonical. Keep Tekton/Konflux only for signed container builds if Forgejo Actions wins.","acceptance_criteria":"ADR or design note in docs/design/ recording decision + rationale, redundant pipeline removed","status":"open","priority":3,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-24T07:06:40Z","created_by":"Christoph Görn","updated_at":"2026-05-24T07:06:40Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-p0y","title":"Cleanup C4 spike state on Codeberg","description":"Battle-test of forgejo-action-code-review created throwaway repos: goern/c4-spike-target and fork tinytalesshop/c4-spike-target. Both should be deleted once team confirms spike findings have been preserved in battle-test.md and design.md (already done). Also: PR #2 on goern/c4-spike-target is open; close it. Also: tag v0.0.1 not yet created on c5-spike-lib (and secrets not set on c5-spike-lib/c5-spike-consumer) — see related C5 spike issue. Delete all 3 c5 repos when C5 spike completes too.","status":"open","priority":3,"issue_type":"task","owner":"goern@b4mad.net","created_at":"2026-05-13T06:33:26Z","created_by":"Christoph Görn","updated_at":"2026-05-13T06:33:26Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|
||
{"_type":"issue","id":"forgejo-mcp-7g9","title":"Refactor release-tools image into smaller purpose-specific images","description":"release-tools image has grown to include goreleaser, syft, cosign, go, node, npm, mcpb, jq, curl, govulncheck, and openspec. This is a monolithic image that does not follow SRP. Refactor into smaller purpose-specific images: e.g. build-release (goreleaser+syft+go), sign-release (cosign), pack-release (node+npm+mcpb), validate (openspec), scan (govulncheck+syft). Each image should be smaller, faster to pull, and easier to audit. Coordinate with the release-pipeline-use-release-tools-image change and the forgejo-mcp-gdz cutover criteria. Do not start until at least 2 successful releases using the monolithic image confirm operational correctness.","status":"open","priority":4,"issue_type":"feature","owner":"goern@b4mad.net","created_at":"2026-05-25T21:17:18Z","created_by":"Christoph Görn","updated_at":"2026-05-25T21:17:18Z","dependency_count":0,"dependent_count":0,"comment_count":0}
|