ci (Update): remove authz-bridge from central tag-build allowlist #15

Merged

ginjiruu merged 1 commit from issue-9-central-allowlist into master

2026-09-23 20:00:20 +00:00

ginjiruu commented

2026-09-23 19:51:46 +00:00

Owner

Fourth and final PR for lab/automation#9.

Why

lab/authz-bridge now has repo-declared CI: its sensor (authz-bridge-tag-build) lives in the repo's .ci/ (synced to the ci namespace). Argo Events JetStream consumer groups are independent per sensor (durable = hash of sensor+trigger+dep), so both sensors subscribe to the same default.webhook.forgejo subject and both would fire on an authz-bridge tag push — the build would run twice (once in automation, once in ci).

What

Removes authz-bridge from the central sensor's allowlist regex: ^lab/(authz-bridge)$ → ^lab/()$ (matches only the literal string lab/, i.e. no repo — verified). The group stays in place for the next central-CI repo; #11 retires this sensor entirely once all repos are repo-declared.

PRs for #9

PR	Repo	State
lab/authz-bridge#62	scaffold (`.ci/`)	merged
lab/dev-apps-source#8	factory entry (CI Application + AppProject)	open
lab/clusters#1628	wiring (`projects/` → argocd)	open
this PR	central allowlist removal	open

After all merges: the e2e tag-push test (tag push → repo sensor → go-build-push → Harbor image) and the project-role RBAC verification.

Fourth and final PR for lab/automation#9. ## Why lab/authz-bridge now has repo-declared CI: its sensor (`authz-bridge-tag-build`) lives in the repo's `.ci/` (synced to the ci namespace). Argo Events JetStream consumer groups are independent per sensor (durable = hash of sensor+trigger+dep), so both sensors subscribe to the same `default.webhook.forgejo` subject and **both would fire** on an authz-bridge tag push — the build would run twice (once in automation, once in ci). ## What Removes `authz-bridge` from the central sensor's allowlist regex: `^lab/(authz-bridge)$` → `^lab/()$` (matches only the literal string `lab/`, i.e. no repo — verified). The group stays in place for the next central-CI repo; #11 retires this sensor entirely once all repos are repo-declared. ## PRs for #9 | PR | Repo | State | |----|------|-------| | lab/authz-bridge#62 | scaffold (`.ci/`) | merged | | lab/dev-apps-source#8 | factory entry (CI Application + AppProject) | open | | lab/clusters#1628 | wiring (`projects/` → argocd) | open | | this PR | central allowlist removal | open | After all merges: the e2e tag-push test (tag push → repo sensor → go-build-push → Harbor image) and the project-role RBAC verification.

ginjiruu added 1 commit

2026-09-23 19:51:46 +00:00

ci (Update): remove authz-bridge from central tag-build allowlist ecd7c8c500

lab/authz-bridge now has repo-declared CI (lab/automation#9): its
sensor lives in the repo's .ci/ (ci namespace). Sensor consumer
groups are independent per sensor, so without this removal both
sensors would fire on its tag pushes and the build would run twice.
The allowlist group is empty until the next central-CI repo is
onboarded; #11 retires this sensor entirely.

ginjiruu referenced this pull request

2026-09-23 19:51:52 +00:00

authz-bridge: first end-to-end (hand-written scaffold + factory entry) #9

ginjiruu merged commit f41d5dceb5 into master

2026-09-23 20:00:20 +00:00

ginjiruu referenced this pull request from a commit

2026-09-23 20:00:22 +00:00

Merge pull request 'ci (Update): remove authz-bridge from central tag-build allowlist' (#15) from issue-9-central-allowlist into master