all: name forge.sarak.sh as the home, verify releases with cosign.pub #70

Open

mikluko wants to merge 3 commits from mikluko/forge-migration into main AGit

pull from: mikluko/forge-migration

merge into: mikluko:main

mikluko:main

mikluko:renovate/github.com-google-cel-go-0.x

mikluko:renovate/k8s.io-apiserver-0.x

mikluko:renovate/k8s.io-apimachinery-0.x

mikluko:renovate/k8s.io-apiextensions-apiserver-0.x

mikluko:renovate/k8s.io-api-0.x

mikluko:renovate/k8s.io-utils-digest

mikluko:renovate/github.com-prometheus-common-0.x

mikluko:renovate/golang.org-x-tools-0.x

mikluko:renovate/golang.org-x-net-0.x

mikluko:renovate/helm-unittest-helm-unittest-1.x

mikluko:mikluko/release-0.5.1

mikluko:mikluko/octant/2407-probe-handler

mikluko:mikluko/release-0.5.0

mikluko:mikluko/octant/2403-meta-join

mikluko:mikluko/octant/2406-probe-port

mikluko:mikluko/octant/2405-gateway-not-ready

mikluko:mikluko/octant/2404-startup-probe

mikluko:mikluko/octant/2401-auth-transition

mikluko:mikluko/octant/2393-sysaccount-revocations

mikluko:mikluko/octant/2396-trusted-keys-signer

mikluko:mikluko/octant/2392-claimed-key-revocation

mikluko:mikluko/octant/2390-importer-by-key

mikluko:mikluko/octant/2391-operator-untrusted-signer

mikluko:mikluko/octant/2380-takeover-refusal

mikluko:mikluko/octant/2382-scoped-signing-keys

mikluko:mikluko/octant/2388-outside-imports

mikluko:mikluko/octant/2386-hold-unrecovered-push

mikluko:mikluko/octant/2385-star-revocation

mikluko:mikluko/octant/2387-untrusted-operator-key

mikluko:mikluko/octant/2384-sysaccount-takeover

mikluko:mikluko/octant/2381-jetstream-tiers

mikluko:mikluko/octant/2383-revocations-no-signing-key

mikluko:mikluko/octant/2389-importer-waits

mikluko:mikluko/octant/2377-takeover-accounts

mikluko:mikluko/workflow-names

mikluko:mikluko/release-on-tag

mikluko:renovate/natsio-prometheus-nats-exporter-0.x

mikluko:mikluko/api-domain-nats-operator-io

mikluko:readout-theme

mikluko:mikluko/test-without-race

mikluko:mikluko/octant/2369-install-howto-and-reference

mikluko:mikluko/rbac-test-without-race

mikluko:mikluko/octant/2371-stories-7-9-13-how-to

mikluko:mikluko/tests-unpinned-image-versions

mikluko:mikluko/octant/2373-lb-service-fields

mikluko:mikluko/octant/2372-readmes-security

mikluko:mikluko/octant/2370-stories-howto

mikluko:mikluko/octant/2368-style-pilot

mikluko:mikluko/octant/2364-join-supercluster

mikluko:mikluko/octant/2363-account-trust-refs

Conversation 0 Commits 3 Files changed 288 +1382 -1092

mikluko commented 2026-10-24 10:17:07 +00:00

Owner

Copy link

The site moves to https://nats-operator.sarak.sh/. SECURITY.md keeps
the keyless commands for releases 0.5.1 and earlier, which stay on
ghcr.io. Forgejo has no private vulnerability reporting, so reports go
to the maintainer.

The site moves to https://nats-operator.sarak.sh/. SECURITY.md keeps the keyless commands for releases 0.5.1 and earlier, which stay on ghcr.io. Forgejo has no private vulnerability reporting, so reports go to the maintainer.

mikluko added 3 commits 2026-10-24 10:17:07 +00:00

go.mod, all: move the module to sarak.sh/mikluko/nats-operator ... 855eaf04be

The repository moves to forge.sarak.sh; sarak.sh serves the vanity
import path for /mikluko/.

.forgejo: run CI, releases and the site on forge.sarak.sh ... 43b1212be6

Workflows move from .github to .forgejo and reference actions by full
URL. The default runner has no Docker daemon and no sudo guarantee, so
zizmor, chart-testing and Hugo are installed from pinned release
assets instead of container or sudo-based actions; actionlint and
zizmor are pointed at their configs under .forgejo, where neither
looks by itself.

The acceptance stories and the chart install need kind on rootful
podman and run on the privileged runner. The chart install builds kind
from go.mod and loads ko's tarball into it, since kind-action assumes
Docker. ci calls e2e.yaml twice instead of through a matrix, which
Forgejo's workflow expansion is not documented to support.

release-cut pushes the tag with RELEASE_TOKEN. release-roll publishes
to sarak.sh, signs with a cosign key from COSIGN_PRIVATE_KEY (Rekor
accepts key-signed entries without OIDC), drops GitHub provenance,
creates the release through the Forgejo API, and asks the Go proxy for
the new tag.

The site is built into an nginx image pushed as
sarak.sh/mikluko/nats-operator/docs:main-<sha>-<unix>, the tag form Flux
image automation selects on.

all: name forge.sarak.sh as the home, verify releases with cosign.pub ... aff9331683

The site moves to https://nats-operator.sarak.sh/. SECURITY.md keeps
the keyless commands for releases 0.5.1 and earlier, which stay on
ghcr.io. Forgejo has no private vulnerability reporting, so reports go
to the maintainer.

Some checks failed

Hide checks

CI / go test (pull_request) Failing after 41s

Details

CI / go race (pull_request) Failing after 41s

Details

CI / go envtest (pull_request) Failing after 42s

Details

CI / actionlint (pull_request) Successful in 1m1s

Details

CI / renovate (pull_request) Successful in 1m35s

Details

CI / zizmor (pull_request) Successful in 5s

Details

CI / changelog (pull_request) Successful in 6s

Details

CI / helm (pull_request) Failing after 10s

Details

CI / govulncheck (pull_request) Failing after 13m38s

Details

CI / acceptance (every namespace) (pull_request) Has been cancelled

Details

CI / acceptance (watched namespaces) (pull_request) Has been cancelled

Details

CI / chart-install (pull_request) Has been cancelled

Details

CI / stories (pull_request) Has been cancelled

Details

CI / stories-1 (pull_request) Has been cancelled

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/70/head:mikluko/forge-migration

git switch mikluko/forge-migration

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main

git merge --no-ff mikluko/forge-migration

git switch mikluko/forge-migration

git rebase main

git switch main

git merge --ff-only mikluko/forge-migration

git switch mikluko/forge-migration

git rebase main

git switch main

git merge --no-ff mikluko/forge-migration

git switch main

git merge --squash mikluko/forge-migration

git switch main

git merge --ff-only mikluko/forge-migration

git switch main

git merge mikluko/forge-migration

git push origin main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Barrier affecting people with disabilities

  

bug

Something isn't working

  

dependencies

Pull requests that update a dependency file

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

go

Pull requests that update go code

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

accessibility

bug

dependencies

documentation

duplicate

enhancement

go

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

mikluko/nats-operator!70

No description provided.