code/cl8y-dex-terraclassic

Fork 0

ci: enable Woodpecker on cl8y-dex-terraclassic so PR statuses are real #1247

New issue

Closed

opened 2026-09-12 03:03:28 +00:00 by PlasticDigits · 3 comments

PlasticDigits commented

2026-09-12 03:03:28 +00:00

Owner

Summary

Forgejo main requires status context ci/woodpecker/pr/woodpecker. This repo had no .woodpecker.yaml until the #1236 merge batch. ci.cl8y.com is up, but Woodpecker did not post statuses on these PRs (repo likely not enabled, or the agent cannot reach OpenBao for WOODPECKER_TOKEN).

During #1226 / #1233 / #1235 / #1236 / #1238 / #1239 / #1241 / #1242 / #1244 / #1245, merges used a local scripts/ci/gitleaks-scan-tracked.sh run plus a Forgejo commit status with that context, then POST /pulls/{n}/merge with {"Do":"merge"}.

Do not use force_merge: true. #1239 was marked merged (63006679…) while b33d3a2a was not an ancestor of origin/main. Reland was #1242; Makefile truncation recovery was #1244. Later PRs merged without force_merge and did update git.

.woodpecker.yaml is already on main (alpine digest-pinned, gitleaks v8.30.0, scripts/ci/gitleaks-scan-tracked.sh). This ticket is enablement + real status posts, not another pipeline rewrite.

OpenBao at 10.10.0.4:8200 was unreachable from the operator workstation (CL8Y WireGuard down). Do not paste tokens into the issue.

Acceptance criteria

AC1. A new PR on this repo gets a real ci/woodpecker/pr/woodpecker status from Woodpecker (not a manual Forgejo POST).
AC2. main branch protection still requires that context. Admins do not need to weaken it.
AC3. Document the merge recipe: dismiss CODEOWNERS maintainers self-request if the only member cannot approve their own PR; never force_merge.
AC4. Optional follow-up (not blocking): port cargo/frontend/indexer jobs from GitLab CI. Gitleaks-only is enough for AC1.

Constraints

Digest-pin images. Do not float tags.
Do not bind-mount indexer/ into root Docker for cargo.
Founder-required CI/auth. No community autoland.

## Summary Forgejo `main` requires status context `ci/woodpecker/pr/woodpecker`. This repo had no `.woodpecker.yaml` until the #1236 merge batch. `ci.cl8y.com` is up, but Woodpecker did not post statuses on these PRs (repo likely not enabled, or the agent cannot reach OpenBao for `WOODPECKER_TOKEN`). During #1226 / #1233 / #1235 / #1236 / #1238 / #1239 / #1241 / #1242 / #1244 / #1245, merges used a **local** `scripts/ci/gitleaks-scan-tracked.sh` run plus a Forgejo commit status with that context, then `POST /pulls/{n}/merge` with `{"Do":"merge"}`. **Do not use `force_merge: true`.** #1239 was marked merged (`63006679…`) while `b33d3a2a` was not an ancestor of `origin/main`. Reland was #1242; Makefile truncation recovery was #1244. Later PRs merged without `force_merge` and did update git. `.woodpecker.yaml` is already on `main` (alpine digest-pinned, gitleaks v8.30.0, `scripts/ci/gitleaks-scan-tracked.sh`). This ticket is **enablement + real status posts**, not another pipeline rewrite. OpenBao at `10.10.0.4:8200` was unreachable from the operator workstation (CL8Y WireGuard down). Do not paste tokens into the issue. ## Acceptance criteria - **AC1.** A new PR on this repo gets a real `ci/woodpecker/pr/woodpecker` status from Woodpecker (not a manual Forgejo POST). - **AC2.** `main` branch protection still requires that context. Admins do not need to weaken it. - **AC3.** Document the merge recipe: dismiss CODEOWNERS `maintainers` self-request if the only member cannot approve their own PR; never `force_merge`. - **AC4.** Optional follow-up (not blocking): port cargo/frontend/indexer jobs from GitLab CI. Gitleaks-only is enough for AC1. ## Constraints - Digest-pin images. Do not float tags. - Do not bind-mount `indexer/` into root Docker for cargo. - Founder-required CI/auth. No community autoland.

PlasticDigits referenced this issue

2026-09-12 03:03:48 +00:00

fix(pair): UpdateLimitOrderPrice same-id relink jumps FIFO at the new price #1227

PlasticDigits referenced this issue

2026-09-12 03:03:49 +00:00

fix(community-tax): SendFrom listed-pair Sell extra-debits beyond allowance #1228

PlasticDigits referenced this issue

2026-09-12 03:03:50 +00:00

fix(pair): reject zero and dust-floor belief_price in check_max_spread #1230

PlasticDigits referenced this issue

2026-09-12 03:03:51 +00:00

fix(pair): Observe query panics on Decimal::from_ratio after #465 #1231

PlasticDigits referenced this issue

2026-09-12 03:03:53 +00:00

fix(community-tax): SettingsBatch autolp no-op still charges 50 UST1 #1237

PlasticDigits referenced this issue

2026-09-12 03:03:54 +00:00

design(dex): research remaining Swap gas envelope vs wallet auto-fee #1222

PlasticDigits referenced this issue

2026-09-12 03:03:55 +00:00

feat(frontend): preserve mixed-case tickers on /protocol oracle #1240

PlasticDigits added the

devops

infra

labels

2026-09-12 03:04:22 +00:00

PlasticDigits commented

2026-09-12 03:27:48 +00:00

Author

Owner

Ops probe 2026-09-12

.woodpecker.yaml is already on main (digest-pinned alpine + gitleaks v8.30.0). https://ci.cl8y.com returns 200. This workstation cannot enable the repo: OpenBao WOODPECKER_TOKEN is behind wg-quick@wg0 (inactive). Direct bao login → context deadline exceeded.

AC3 (docs)

Merge recipe is now docs/runbooks/forgejo-pr-merge.md (also linked from docs/testing.md § CI):

Dismiss CODEOWNERS @code/maintainers self-request when the only member cannot approve their own PR.
Never force_merge.
Do not POST a fake ci/woodpecker/pr/woodpecker status once Woodpecker is posting for real.

Founder (AC1)

After WireGuard + bao-exec --check:

sudo systemctl start wg-quick@wg0
source ~/.config/openbao/env.sh
bao login -no-print -method=cert -path=workstation-cert name=answorld-pop-os
bao-exec --check

Then enable code/cl8y-dex-terraclassic on https://ci.cl8y.com (trusted Forgejo org admin). After it has a numeric repo id in the Woodpecker UI, from /home/answorld/repos/cl8y-forgejo:

bao-exec --only WOODPECKER_TOKEN -- python3 scripts/woodpecker_ops.py trust-network --repo-id plus that id.

Do not put secrets on this repo. trust-network is optional (lets pipeline containers reach the Coolify network; this YAML is gitleaks-only).

Do not put the token in the issue. Do not weaken main protection. AC4 (port cargo/frontend/indexer jobs) stays optional.

Leaving open until a PR gets a real Woodpecker status (not a manual Forgejo POST).

## Ops probe 2026-09-12 `.woodpecker.yaml` is already on `main` (digest-pinned alpine + gitleaks v8.30.0). `https://ci.cl8y.com` returns 200. This workstation cannot enable the repo: OpenBao `WOODPECKER_TOKEN` is behind `wg-quick@wg0` (inactive). Direct `bao login` → context deadline exceeded. ### AC3 (docs) Merge recipe is now [`docs/runbooks/forgejo-pr-merge.md`](https://git.cl8y.com/code/cl8y-dex-terraclassic/src/branch/main/docs/runbooks/forgejo-pr-merge.md) (also linked from `docs/testing.md` § CI): - Dismiss CODEOWNERS `@code/maintainers` self-request when the only member cannot approve their own PR. - Never `force_merge`. - Do not POST a fake `ci/woodpecker/pr/woodpecker` status once Woodpecker is posting for real. ### Founder (AC1) After WireGuard + `bao-exec --check`: ``` sudo systemctl start wg-quick@wg0 source ~/.config/openbao/env.sh bao login -no-print -method=cert -path=workstation-cert name=answorld-pop-os bao-exec --check ``` Then enable `code/cl8y-dex-terraclassic` on https://ci.cl8y.com (trusted Forgejo org admin). After it has a numeric repo id in the Woodpecker UI, from `/home/answorld/repos/cl8y-forgejo`: `bao-exec --only WOODPECKER_TOKEN -- python3 scripts/woodpecker_ops.py trust-network --repo-id` plus that id. Do not put secrets on this repo. `trust-network` is optional (lets pipeline containers reach the Coolify network; this YAML is gitleaks-only). Do not put the token in the issue. Do not weaken `main` protection. AC4 (port cargo/frontend/indexer jobs) stays optional. Leaving **open** until a PR gets a real Woodpecker status (not a manual Forgejo POST).

PlasticDigits commented

2026-09-12 03:29:31 +00:00

Author

Owner

Merge recipe is commit e31fa2e6 (docs/runbooks/forgejo-pr-merge.md). It is not on origin/main until that commit is pushed (branch protection still wants a real Woodpecker status). Use the local file until then.

Merge recipe is commit `e31fa2e6` (`docs/runbooks/forgejo-pr-merge.md`). It is **not** on `origin/main` until that commit is pushed (branch protection still wants a real Woodpecker status). Use the local file until then.

PlasticDigits commented

2026-09-12 04:43:29 +00:00

Author

Owner

Woodpecker: all `code/*` enabled

Operator request this turn: enable every Forgejo code/* repo on ci.cl8y.com, not only this DEX repo.

Result

Forgejo org code has 44 repositories.
Woodpecker now has 44/44 active (require_approval=forks, allow_deploy=false, trusted.network=true, volumes/security off).
41 newly activated; already on: code/hello (wp 1), code/listing-api (wp 2), code/cl8y-dex-terraclassic (wp 7, activated first as the probe).
Did not copy Coolify/Telegram deploy secrets onto product repos. Those stay on the hello lab (and listing-api telegram) only.
Forgejo webhook on this repo: hook id 12 → https://ci.cl8y.com/api/hook (push + pull_request events). Same hook shape verified on code/cl8y-bridge-monorepo.
Autoscaler agents are registered. Manual pipeline #1 on this repo main (gitleaks) finished success. That is a real Woodpecker run, not a forged commit status.

AC1 still open until a PR

Branch protection wants context ci/woodpecker/pr/woodpecker. The success above was event=manual on main. Close this issue after the next PR shows that PR context from Woodpecker (open docs/1247-forgejo-merge-recipe or any real PR). Do not force_merge.

Out of scope

PlasticDigits/* private ops repos were already enabled (4). Unchanged.
New code/* repos created later are not auto-enabled; activate with POST /api/repos?forge_remote_id={forge_id} as Woodpecker admin.
WOODPECKER_ORGS stays cl8y (did not add org code to the login allowlist).

## Woodpecker: all `code/*` enabled Operator request this turn: enable every Forgejo `code/*` repo on `ci.cl8y.com`, not only this DEX repo. ### Result - Forgejo org `code` has **44** repositories. - Woodpecker now has **44/44** active (`require_approval=forks`, `allow_deploy=false`, `trusted.network=true`, volumes/security off). - **41** newly activated; already on: `code/hello` (wp 1), `code/listing-api` (wp 2), `code/cl8y-dex-terraclassic` (wp 7, activated first as the probe). - Did **not** copy Coolify/Telegram deploy secrets onto product repos. Those stay on the hello lab (and listing-api telegram) only. - Forgejo webhook on this repo: hook id 12 → `https://ci.cl8y.com/api/hook` (push + pull_request events). Same hook shape verified on `code/cl8y-bridge-monorepo`. - Autoscaler agents are registered. Manual pipeline **#1** on this repo `main` (gitleaks) finished **success**. That is a real Woodpecker run, not a forged commit status. ### AC1 still open until a PR Branch protection wants context `ci/woodpecker/pr/woodpecker`. The success above was `event=manual` on `main`. Close this issue after the next PR shows that PR context from Woodpecker (open `docs/1247-forgejo-merge-recipe` or any real PR). Do not `force_merge`. ### Out of scope - `PlasticDigits/*` private ops repos were already enabled (4). Unchanged. - New `code/*` repos created later are **not** auto-enabled; activate with `POST /api/repos?forge_remote_id={forge_id}` as Woodpecker admin. - `WOODPECKER_ORGS` stays `cl8y` (did not add org `code` to the login allowlist).

PlasticDigits referenced this issue from a pull request that will close it,

2026-09-12 04:48:02 +00:00

docs: Forgejo merge recipe for real Woodpecker statuses #1248

PlasticDigits closed this issue

2026-09-12 04:48:58 +00:00