ci: restore the in-cluster image build dispatch sender - #140
Open
todie wants to merge 1 commit into
Open
Conversation
This file was absent, so pushes to main triggered NO image build. Harbor held exactly one linearctl tag — git-deac9f1a5406, built 2026-07-29 — and the in-cluster operator ran that image while main moved 38 source files ahead of it. Chart 0.3.0 (the OPS-1214 containment + queue-HMAC rebuild) was never published at all. The missing sender is why. Mirrors the blackwall sender: resolves the pinned SHA + chart version and triggers the receiver in unsigned-gg/unsigned-paas via workflow_dispatch (Actions:write) rather than repository_dispatch (Contents:write, which the unsigned-reverie-arc App does not hold — OPS-1019). chart_version is read from deploy/chart/Chart.yaml rather than hardcoded, so it cannot silently drift from the file the receiver re-verifies it against. The receiver's own EXPECTED_CHART_VERSION must still be bumped in lockstep on any chart bump; the 0.2.0-vs-0.3.0 mismatch is exactly what deadlocked this pipeline (fixed in unsigned-paas by the companion PR). Publishing is not deploying: the ArgoCD app pins its image tag and chart targetRevision in unsigned-paas gitops/, so a successful build changes nothing in-cluster until that separate operator-gated PR lands. Requires repo secrets ARC_APP_ID + ARC_APP_PRIVATE_KEY (operator-seeded). This repo is PUBLIC: the workflow deliberately does not run on pull_request, so the App token is never minted in a context a fork can influence.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Restores the dispatch sender for the in-cluster image build. It was absent from this repo, so pushes to
maintriggered no build at all.Why this matters
platform/linearctlholds exactly one tag:git-deac9f1a5406, built 2026-07-29.linearctl, Cygnus) has been running that image ever since, whilemainmoved 38 source files ahead of it.0.3.0— the OPS-1214 containment + queue-HMAC rebuild (13703f9,3719db8,2ac8e33) — was never published.The missing sender is why. Its disappearance is consistent with the 2026-07-29 history rewrites, which force-moved
maintwice; the deployed image's own source commitdeac9f1a5406is likewise unreachable frommaintoday and survives only as a cached GitHub object.What it does
Mirrors the blackwall sender: resolves the pinned SHA + chart version and triggers
unsigned-gg/unsigned-paas→build-linearctl-image.yaml, which renders a rootless BuildKit Job, signs the image, and publishesdeploy/chartto Harbor OCI.Uses
workflow_dispatch, notrepository_dispatch— per OPS-1019,POST /repos/{o}/{r}/dispatchesneedsContents: write, which theunsigned-reverie-arcApp does not hold and should not be granted;POST .../actions/workflows/{file}/dispatchesneeds onlyActions: write, which it already has.chart_versionis read fromdeploy/chart/Chart.yamlrather than hardcoded, so it cannot silently drift from the file the receiver re-verifies it against.Requires before it can run
Repo secrets
ARC_APP_IDandARC_APP_PRIVATE_KEY(operator-seeded; this repo has neither today — blackwall has both).This repo is PUBLIC. The workflow deliberately does not run on
pull_request— push-to-mainand manual only — so the App token is never minted in a context a fork can influence.Depends on
unsigned-gg/unsigned-paas#2427, which unblocks the receiver's chart-version contract (
0.2.0→0.3.0). Until that lands, the receiver rejects every dispatch:0.3.0fails its contract gate and0.2.0fails itsChart.yamlverify.Publishing is not deploying
A successful build changes nothing in-cluster. The ArgoCD app pins its own image tag and chart
targetRevisionin unsigned-paasgitops/; that bump is a separate, operator-gated PR.