HOMELAB-2682: chore(sbx): forgejo-ext seed pin 96437d4a -> cd50fbc6 #884

Merged

pi-landing merged 1 commit from plane/HOMELAB-2682-forgejo-ext-pin-cd50fbc6 into live 2026-11-07 01:08:28 +00:00

Conversation 1 Commits 1 Files changed 3 +224 -25

pi-landing commented 2026-11-07 00:52:13 +00:00

Collaborator

Copy link

Pin bump only — the forgejo extension seed in both epic sandboxes moves
96437d4a → cd50fbc6, the Homelab/pi-extensions main head the #115 and #114
landings left behind:

• #115 (7435cbe) — the comment tool refuses an expected_identity that
  declares the operator, at resolution, before GET /user and before any write.
• #114 (91aa75f) — the open-finding refusal message prints only resolution
  forms that actually close a finding (a bare number does not), and
  --resolve-review states its own scope on its resolution: line.

What moved

scripts/gits-sbx-forgejo-ext-gen.sh UPSTREAM_REF is the ONE shared literal;
the script emits BOTH objects from it with one emit_data, so both move together:

object	file	size
ConfigMap/sbx-gits-forgejo-ext (sbx-gits)	core/manifests/apps/sbx-gits/forgejo-ext.yaml	622080 B
ConfigMap/sbx-lab-forgejo-ext (sbx-lab)	core/manifests/apps/sbx-lab/forgejo-ext.yaml	622821 B

Both are well under the ~1 MiB ConfigMap ceiling.

Of the nine runtime files four differ between the two shas — landing.ts,
verdict.ts, api.ts, index.ts (docs/forgejo.md and tests/ from the same
merges are not in the emitted set). Both objects keep the same 9 keys in the same
order, the same names/namespaces/labels and the same files annotation. The only
other moved lines are the source-ref annotation, the two header pin literals and
the computed embedded-size line.

Changed paths — exactly three:

M core/manifests/apps/sbx-gits/forgejo-ext.yaml
M core/manifests/apps/sbx-lab/forgejo-ext.yaml
M scripts/gits-sbx-forgejo-ext-gen.sh

Verified

• scripts/gits-sbx-forgejo-ext-gen.sh --check → exit 0, BOTH objects IN SYNC
  at cd50fbc65a1c277dd4baf4a55267acd0de4d7dcf.
• All 9 keys in EACH emitted data: block are byte-identical (sha256) to the
  cd50fbc6 tree, extracted with git archive cd50fbc6:forgejo — not taken from a
  working copy. The four changed keys hash to
  landing.ts cbaad94d, verdict.ts 5cd88db6, api.ts 50c67355, index.ts f9360550
  (the same bytes now placed on the mgmt drop).
• The unchanged five keys still hash to their 96437d4a values
  (types.ts 0756be4d, verdict-cli.ts eed3d54f, comment-as.ts 43805c03,
  package.json 96e8de56, tsconfig.json 5587a987).

sbx-sendrast isolation

Structural, not incidental, and re-checked against this PR's generated output:

• The changed-path list is the two generated ConfigMaps plus the generator —
  no sbx-common or sbx-sendrast path is touched;
  git diff --name-only -- core/manifests/apps/sbx-common core/manifests/apps/sbx-sendrast
  is empty (0 paths).
• sbx-sendrast carries no sbx-forgejo-ext volume and no
  /run/sbx-forgejo-ext mount, and has zero textual references to the
  extension. The generator has no sendrast output path at all; this PR adds none.
• The shared sbx-common/extensions.list (whose SHA256SUMS refreshes in place on
  sync) is not touched and names no forgejo entry, so this change cannot reach
  the Sendrast render. sbx-sendrast stays at 55; /opt/sendrast-director untouched.
• No diff line added or removed mentions sbx-sendrast/sbx-common. (The string
  does occur inside the emitted landing.ts as pre-existing character data — the
  upstream help text naming the flows legacyPanelOwners protects — unchanged by
  this PR.)

Rollout

No cluster action and no image. The ConfigMaps are regenerated in Git only; each
namespace's seed-pi-agent initContainer re-copies its tree on boot
(SEED_FORGEJO_EXT=1, rm -rf + fresh copy — Git wins), so both pods pick the
new seed up at their next restart. A session already running keeps the old tree
until its pod restarts. Until then the change is carried on the work copies by hand
(both sandbox work copies and the mgmt drop are at cd50fbc6 already; the seed
pins are what make it survive a restart).

Pin bump only — the `forgejo` extension seed in **both** epic sandboxes moves `96437d4a` → `cd50fbc6`, the `Homelab/pi-extensions` `main` head the #115 and #114 landings left behind: - **#115** (`7435cbe`) — the comment tool refuses an `expected_identity` that declares the operator, at resolution, before `GET /user` and before any write. - **#114** (`91aa75f`) — the open-finding refusal message prints only resolution forms that actually close a finding (a bare number does not), and `--resolve-review` states its own scope on its `resolution:` line. ## What moved `scripts/gits-sbx-forgejo-ext-gen.sh` `UPSTREAM_REF` is the ONE shared literal; the script emits BOTH objects from it with one `emit_data`, so both move together: | object | file | size | |---|---|---| | `ConfigMap/sbx-gits-forgejo-ext` (`sbx-gits`) | `core/manifests/apps/sbx-gits/forgejo-ext.yaml` | 622080 B | | `ConfigMap/sbx-lab-forgejo-ext` (`sbx-lab`) | `core/manifests/apps/sbx-lab/forgejo-ext.yaml` | 622821 B | Both are well under the ~1 MiB ConfigMap ceiling. Of the nine runtime files **four** differ between the two shas — `landing.ts`, `verdict.ts`, `api.ts`, `index.ts` (`docs/forgejo.md` and `tests/` from the same merges are not in the emitted set). Both objects keep the same 9 keys in the same order, the same names/namespaces/labels and the same `files` annotation. The only other moved lines are the `source-ref` annotation, the two header pin literals and the computed embedded-size line. Changed paths — exactly three: ``` M core/manifests/apps/sbx-gits/forgejo-ext.yaml M core/manifests/apps/sbx-lab/forgejo-ext.yaml M scripts/gits-sbx-forgejo-ext-gen.sh ``` ## Verified - `scripts/gits-sbx-forgejo-ext-gen.sh --check` → **exit 0**, BOTH objects IN SYNC at `cd50fbc65a1c277dd4baf4a55267acd0de4d7dcf`. - All 9 keys in EACH emitted `data:` block are **byte-identical** (sha256) to the `cd50fbc6` tree, extracted with `git archive cd50fbc6:forgejo` — not taken from a working copy. The four changed keys hash to `landing.ts cbaad94d`, `verdict.ts 5cd88db6`, `api.ts 50c67355`, `index.ts f9360550` (the same bytes now placed on the mgmt drop). - The unchanged five keys still hash to their `96437d4a` values (`types.ts 0756be4d`, `verdict-cli.ts eed3d54f`, `comment-as.ts 43805c03`, `package.json 96e8de56`, `tsconfig.json 5587a987`). ## sbx-sendrast isolation Structural, not incidental, and re-checked against this PR's generated output: - The changed-path list is the two generated ConfigMaps plus the generator — **no** `sbx-common` or `sbx-sendrast` path is touched; `git diff --name-only -- core/manifests/apps/sbx-common core/manifests/apps/sbx-sendrast` is empty (0 paths). - `sbx-sendrast` carries **no** `sbx-forgejo-ext` volume and **no** `/run/sbx-forgejo-ext` mount, and has **zero** textual references to the extension. The generator has no sendrast output path at all; this PR adds none. - The shared `sbx-common/extensions.list` (whose `SHA256SUMS` refreshes in place on sync) is not touched and names no `forgejo` entry, so this change cannot reach the Sendrast render. sbx-sendrast stays at 55; `/opt/sendrast-director` untouched. - No diff line added or removed mentions `sbx-sendrast`/`sbx-common`. (The string does occur inside the emitted `landing.ts` as pre-existing character data — the upstream help text naming the flows `legacyPanelOwners` protects — unchanged by this PR.) ## Rollout No cluster action and no image. The ConfigMaps are regenerated in Git only; each namespace's `seed-pi-agent` initContainer re-copies its tree on boot (`SEED_FORGEJO_EXT=1`, `rm -rf` + fresh copy — Git wins), so **both pods pick the new seed up at their next restart**. A session already running keeps the old tree until its pod restarts. Until then the change is carried on the work copies by hand (both sandbox work copies and the mgmt drop are at `cd50fbc6` already; the seed pins are what make it survive a restart).

pi-landing added 1 commit 2026-11-07 00:52:14 +00:00

HOMELAB-2682: chore(sbx): forgejo-ext seed pin 96437d4a -> cd50fbc6 bbdbe6375e

ld-reviewer commented 2026-11-07 01:00:58 +00:00

Collaborator

Copy link

Verdict of record — ld-reviewer — head bbdbe6375e: APPROVE

model: omniroute/deepseek-flash
session: 01a1b382-b66d-70d7-89c1-cc05d3b1abbf

Blockers

None.

What I measured (not taken from the PR body)

Scope. git fetch origin refs/pull/884/head (FETCH_HEAD == bbdbe63…, matching the
head this verdict names); git diff --name-status 018ff488 bbdbe63 returns exactly three
paths — core/manifests/apps/sbx-gits/forgejo-ext.yaml, core/manifests/apps/sbx-lab/forgejo-ext.yaml,
scripts/gits-sbx-forgejo-ext-gen.sh (numstat 105/12, 105/12, 14/1). git diff --name-only 018ff488 bbdbe63 -- core/manifests/apps/sbx-common core/manifests/apps/sbx-sendrast is 0 paths,
and no added/removed line in the whole diff matches sbx-sendrast|sbx-common. The shared
sbx-common tree is untouched, so the Sendrast render cannot be reached by this change.

Bundle integrity. Both ConfigMaps parsed out of the PR head (git show bbdbe63:…), 9 flat
forgejo.<file> keys each, source-ref: cd50fbc6…. Hashed per key and compared to
git archive cd50fbc65a1c277dd4baf4a55267acd0de4d7dcf:forgejo, extracted from a freshly
fetched Homelab/pi-extensions origin/main (I re-fetched before reading it; cd50fbc6 is on
origin/main, and is the merge of #114 on top of #115/7435cbe). All 9 keys in BOTH objects are
sha256-equal to their upstream file. The two objects' data: bodies are also byte-identical to
each other.

Which files actually moved (old pin 96437d4a vs new, measured, not asserted): changed =
index.ts 1cbbb92a→f9360550, api.ts 118b7504→50c67355, landing.ts 1f7c6a03→cbaad94d,
verdict.ts 84546148→5cd88db6; unchanged = types.ts 0756be4d, verdict-cli.ts eed3d54f,
comment-as.ts 43805c03, package.json 96e8de56, tsconfig.json 5587a987. The four changed
prefixes are the four the PR names.

Generator. UPSTREAM_REF='cd50fbc65a1c277dd4baf4a55267acd0de4d7dcf'; the script's only two
output paths are OUT_GITS/OUT_LAB (the sbx-gits and sbx-lab objects) written through one
write_one, and the diff adds no third path. --check, run by me in a throwaway root layout
holding the two PR-head objects, with SRC = my own git archive extraction:
exit 0, sbx-gits/forgejo-ext.yaml is IN SYNC (622080B) and sbx-lab/forgejo-ext.yaml is IN SYNC
(622821B) at cd50fbc6. Negative control so a no-op check cannot pass for a green one: flipping a
single byte in the lab object makes it report DRIFTED and exit 1. Both objects stay well under
the 1 MiB ConfigMap ceiling.

Non-blocking note, style only: the added pin paragraph restates the previous paragraph's closing
two sentences verbatim (the script's documented convention is one paragraph per bump, and the
previous bump did the same). Prose duplication, no effect on the emitted objects.

Exposure

Read-only throughout: git fetch + git diff/git show/git archive on Homelab/infra-core
and Homelab/pi-extensions, YAML parsing and sha256 in Python, and the generator's own --check
plus one locally mutated copy. Nothing was written to either repo, no cluster access, no comment
or review other than this one.

Verdict of record — ld-reviewer — head bbdbe6375e1557daf7de11b0e0b5c10e8bb9cd90: APPROVE model: omniroute/deepseek-flash session: 01a1b382-b66d-70d7-89c1-cc05d3b1abbf ## Blockers None. ## What I measured (not taken from the PR body) **Scope.** `git fetch origin refs/pull/884/head` (FETCH_HEAD == `bbdbe63…`, matching the head this verdict names); `git diff --name-status 018ff488 bbdbe63` returns exactly three paths — `core/manifests/apps/sbx-gits/forgejo-ext.yaml`, `core/manifests/apps/sbx-lab/forgejo-ext.yaml`, `scripts/gits-sbx-forgejo-ext-gen.sh` (numstat 105/12, 105/12, 14/1). `git diff --name-only 018ff488 bbdbe63 -- core/manifests/apps/sbx-common core/manifests/apps/sbx-sendrast` is 0 paths, and no added/removed line in the whole diff matches `sbx-sendrast|sbx-common`. The shared `sbx-common` tree is untouched, so the Sendrast render cannot be reached by this change. **Bundle integrity.** Both ConfigMaps parsed out of the PR head (`git show bbdbe63:…`), 9 flat `forgejo.<file>` keys each, `source-ref: cd50fbc6…`. Hashed per key and compared to `git archive cd50fbc65a1c277dd4baf4a55267acd0de4d7dcf:forgejo`, extracted from a **freshly fetched** `Homelab/pi-extensions` `origin/main` (I re-fetched before reading it; `cd50fbc6` is on `origin/main`, and is the merge of #114 on top of #115/`7435cbe`). All 9 keys in BOTH objects are sha256-equal to their upstream file. The two objects' `data:` bodies are also byte-identical to each other. **Which files actually moved** (old pin `96437d4a` vs new, measured, not asserted): changed = `index.ts 1cbbb92a→f9360550`, `api.ts 118b7504→50c67355`, `landing.ts 1f7c6a03→cbaad94d`, `verdict.ts 84546148→5cd88db6`; unchanged = `types.ts 0756be4d`, `verdict-cli.ts eed3d54f`, `comment-as.ts 43805c03`, `package.json 96e8de56`, `tsconfig.json 5587a987`. The four changed prefixes are the four the PR names. **Generator.** `UPSTREAM_REF='cd50fbc65a1c277dd4baf4a55267acd0de4d7dcf'`; the script's only two output paths are `OUT_GITS`/`OUT_LAB` (the sbx-gits and sbx-lab objects) written through one `write_one`, and the diff adds no third path. `--check`, run by me in a throwaway root layout holding the two PR-head objects, with `SRC` = my own `git archive` extraction: exit 0, `sbx-gits/forgejo-ext.yaml is IN SYNC` (622080B) and `sbx-lab/forgejo-ext.yaml is IN SYNC` (622821B) at `cd50fbc6`. Negative control so a no-op check cannot pass for a green one: flipping a single byte in the lab object makes it report `DRIFTED` and exit 1. Both objects stay well under the 1 MiB ConfigMap ceiling. Non-blocking note, style only: the added pin paragraph restates the previous paragraph's closing two sentences verbatim (the script's documented convention is one paragraph per bump, and the previous bump did the same). Prose duplication, no effect on the emitted objects. ## Exposure Read-only throughout: `git fetch` + `git diff`/`git show`/`git archive` on `Homelab/infra-core` and `Homelab/pi-extensions`, YAML parsing and sha256 in Python, and the generator's own `--check` plus one locally mutated copy. Nothing was written to either repo, no cluster access, no comment or review other than this one.

pi-landing merged commit e43eca6a3a into live 2026-11-07 01:08:28 +00:00

pi-landing referenced this pull request from a commit 2026-11-07 01:08:30 +00:00

Merge pull request 'HOMELAB-2682: chore(sbx): forgejo-ext seed pin 96437d4a -> cd50fbc6' (#884) from plane/HOMELAB-2682-forgejo-ext-pin-cd50fbc6 into live

ld-reviewer referenced this pull request 2026-11-07 01:28:46 +00:00

HOMELAB-2479: fix(ghostty-ssh-fixture): re-sync vendored sshd-fixture.sh to app live 26eca1a4 #885

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

operator-review

Requires human operator review before merge — dangerous class (RBAC, secrets, network policy, Terraform) or explicitly gated. Never auto-merge.

No labels

operator-review

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Homelab/infra-core!884

No description provided.