feat(build-images): in-cluster first — builds and promotes publish to zot; codeberg is a backup leg #2049

Merged

pipeline-bot merged 1 commit from feat/builder-images-zot into trunk 2026-08-15 10:05:50 +00:00

Conversation 0 Commits 1 Files changed 3 +43 -23

sean commented 2026-08-15 10:03:23 +00:00

Owner

Copy link

The dockerfile-set taxonomy was the last path resolving/publishing against codeberg in the execute path — its quota broke our own builds twice today. Builds now push registry.sean.farm/someara/: (registry-credentials), promote retags by digest in zot, and each released :vN gets a bounded best-effort backup copy to codeberg (60s, non-fatal). Evidence lines carry zot refs.

129/129 guards. Landing this BEFORE the builder-images release means the seanfarm33 companion release already publishes in-cluster.

The dockerfile-set taxonomy was the last path resolving/publishing against codeberg in the execute path — its quota broke our own builds twice today. Builds now push registry.sean.farm/someara/<name>:<tag> (registry-credentials), promote retags by digest in zot, and each released :vN gets a bounded best-effort backup copy to codeberg (60s, non-fatal). Evidence lines carry zot refs. 129/129 guards. Landing this BEFORE the builder-images release means the seanfarm33 companion release already publishes in-cluster.

sean added 1 commit 2026-08-15 10:03:24 +00:00

feat(build-images): in-cluster first — builds and promotes publish to zot; codeberg is a backup leg ... a68d66ab41

Sean's standing doctrine, applied to the last straggler: builder-images
CI pushed every build offsite and promotes retagged on codeberg, so a
codeberg quota or outage broke OUR builds (2026-08-15: HTTP 413 killed
the seanfarm33 companion train; the prune defect then broke FROM
resolution). App projects already publish to registry.sean.farm — this
brings the dockerfile-set taxonomy in line.

pipeline-build-images: pushes registry.sean.farm/someara/<name>:<tag>
with the registry-credentials dockerconfigjson; evidence lines carry
zot refs.

pipeline-promote-images: crane retags by digest inside zot (the base
follows the MANIFEST refs, so a MANIFEST from an old build still
promotes where it was pushed); each released :vN then gets a bounded
(60 s), best-effort skopeo backup copy to codeberg — the passive
offsite seed, never a gate and never the resolution path.

url-credentials allow-list: one pinned line shifted by the comment
edits.

pipeline-bot merged commit a68d66ab41 into trunk 2026-08-15 10:05:50 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/pipelines!2049

No description provided.