From 8fde0ba0797ac4656e391e3930a875b02c550d13 Mon Sep 17 00:00:00 2001
From: Marcos Della <mdella@tikali.ai>
Date: Sat, 5 Sep 2026 08:11:25 +0000
Subject: [PATCH] =?UTF-8?q?ci:=20wheel/package=20are=20blocking=20?=
 =?UTF-8?q?=E2=80=94=20runner=20egress=20proven=20on=20the=20v0.1.0=20tag?=
 =?UTF-8?q?=20pipeline?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pipeline 6999 built the openziti 1.7.1 wheel (github.com + pypi.org) and the
nfpm .deb; the allow_failure escape hatches are no longer honest. package now
requires the wheel so a .deb can never ship without transport sdk.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KLB7jieMNRkTsJ2epr4Ds1
---
 .gitlab-ci.yml | 18 ++++++++----------
 README.md      |  4 ++--
 2 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 64a40c8..f629d5d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,9 +3,8 @@
 #   lint -> test -> build (openziti wheel) -> package (.deb via nfpm) -> release (v* tags) -> docs
 #
 # Every script line is single-quoted (a bare ": " turns the line into a YAML map and silently
-# yields a 0-job pipeline). Jobs that need egress the runner may not have (GitHub for the
-# openziti sdist's ziti-sdk-c fetch, GitHub for the nfpm binary) are allow_failure: true until
-# proven; see README "CI notes".
+# yields a 0-job pipeline). Runner egress to github.com + pypi.org was PROVEN on the v0.1.0 tag
+# pipeline (6999: openziti 1.7.1 wheel built, nfpm .deb packaged), so wheel/package are blocking.
 #
 # CI/CD variables (project or group level):
 #   GITEA_TOKEN   — Gitea API token (write:repository) for `release:gitea`; without it the job is manual
@@ -76,13 +75,11 @@ test:
 # PyPI ships `openziti` as an sdist whose build fetches ziti-sdk-c (+ prebuilt tlsuv/uv-mbed
 # via cmake FetchContent) from github.com at install time. Building it here on ubuntu:26.04
 # (the target OS; python3 = the target's python3) gives us a wheel to vendor into the venv.
-# NEEDS runner egress to github.com + pypi.org; allow_failure until proven on this runner —
-# without the wheel the .deb still builds (transports proxy/system work; sdk logs a clear error).
+# NEEDS runner egress to github.com + pypi.org (proven 2026-09-05, pipeline 6999).
 wheel:
   stage: build
   image: ubuntu:26.04
   needs: ["test"]
-  allow_failure: true
   rules:
     - if: '$CI_COMMIT_TAG'
     - if: '$CI_COMMIT_BRANCH == "main"'
@@ -104,15 +101,14 @@ wheel:
 # --- the .deb --------------------------------------------------------------------------------------
 # venv at its final path (/opt/monky-deployd/venv is where the .deb puts it; venvs are not
 # relocatable) + nfpm. nfpm comes from GitHub releases (egress) with the goreleaser apt repo as
-# fallback; allow_failure until proven.
+# fallback (proven 2026-09-05, pipeline 6999). The wheel is required: a .deb without it would
+# silently ship a broken `transport: sdk`.
 package:
   stage: package
   image: ubuntu:26.04
   needs:
     - job: test
     - job: wheel
-      optional: true
-  allow_failure: true
   rules:
     - if: '$CI_COMMIT_TAG'
     - if: '$CI_COMMIT_BRANCH == "main"'
@@ -127,7 +123,9 @@ package:
     - 'python3 -m venv /opt/monky-deployd/venv'
     - '/opt/monky-deployd/venv/bin/pip install -q --upgrade pip'
     - '/opt/monky-deployd/venv/bin/pip install -q .'
-    - 'if ls vendor/*.whl >/dev/null 2>&1; then /opt/monky-deployd/venv/bin/pip install -q vendor/*.whl && /opt/monky-deployd/venv/bin/python -c "import openziti; print(\"openziti\", openziti.__version__ if hasattr(openziti, \"__version__\") else \"ok\")"; else echo "WARNING: no vendored openziti wheel — transport sdk will not work from this build"; fi'
+    - 'ls vendor/*.whl >/dev/null 2>&1 || { echo "no vendored openziti wheel (wheel job artifact missing)"; exit 1; }'
+    - '/opt/monky-deployd/venv/bin/pip install -q vendor/*.whl'
+    - '/opt/monky-deployd/venv/bin/python -c "import openziti; print(\"openziti import ok\")"'
     - '/opt/monky-deployd/venv/bin/python -m monky_deployd version'
     - 'mkdir -p build dist && cp -a /opt/monky-deployd/venv build/venv'
     # nfpm: GitHub release .deb, else the goreleaser apt repo
diff --git a/README.md b/README.md
index 5482908..f9ea013 100644
--- a/README.md
+++ b/README.md
@@ -138,8 +138,8 @@ systemd-analyze verify packaging/systemd/*.service   # where systemd is availabl
 `lint` and `test` run on every MR/branch. `wheel` builds the `openziti` wheel on `ubuntu:26.04`
 (PyPI ships an sdist that fetches **ziti-sdk-c from github.com** at build time — the runner needs
 egress to github.com and pypi.org) and `package` builds the `.deb` with `nfpm` (binary from GitHub
-releases, goreleaser apt repo as fallback). Both are `allow_failure: true` until proven on this
-runner; without the wheel the `.deb` still works with `transport: proxy|system`. On a `v*` tag
+releases, goreleaser apt repo as fallback). Both were proven on the v0.1.0 tag pipeline and are
+blocking on `main`/tags (manual on MRs); the `.deb` always ships the SDK wheel. On a `v*` tag
 `release` uploads to the GitLab generic package registry + release, and `release:gitea` publishes
 the same assets on the public Gitea mirror (automatic when `GITEA_TOKEN` is set, manual otherwise
 — see `docs/OPERATIONS.md` for the by-hand recipe).