Merge branch 'ci/proven-egress' into 'main'

ci: wheel/package blocking — runner egress proven (v0.1.0 pipeline)

See merge request tikali/applications/monky/monky-deployd!2

.gitlab-ci.yml

@@ -3,9 +3,8 @@
 #   lint -> test -> build (openziti wheel) -> package (.deb via nfpm) -> release (v* tags) -> docs
 #
 # Every script line is single-quoted (a bare ": " turns the line into a YAML map and silently
-# yields a 0-job pipeline). Jobs that need egress the runner may not have (GitHub for the
-# openziti sdist's ziti-sdk-c fetch, GitHub for the nfpm binary) are allow_failure: true until
-# proven; see README "CI notes".
+# yields a 0-job pipeline). Runner egress to github.com + pypi.org was PROVEN on the v0.1.0 tag
+# pipeline (6999: openziti 1.7.1 wheel built, nfpm .deb packaged), so wheel/package are blocking.
 #
 # CI/CD variables (project or group level):
 #   GITEA_TOKEN   — Gitea API token (write:repository) for `release:gitea`; without it the job is manual
@@ -76,13 +75,11 @@ test:
 # PyPI ships `openziti` as an sdist whose build fetches ziti-sdk-c (+ prebuilt tlsuv/uv-mbed
 # via cmake FetchContent) from github.com at install time. Building it here on ubuntu:26.04
 # (the target OS; python3 = the target's python3) gives us a wheel to vendor into the venv.
-# NEEDS runner egress to github.com + pypi.org; allow_failure until proven on this runner —
-# without the wheel the .deb still builds (transports proxy/system work; sdk logs a clear error).
+# NEEDS runner egress to github.com + pypi.org (proven 2026-09-05, pipeline 6999).
 wheel:
   stage: build
   image: ubuntu:26.04
   needs: ["test"]
-  allow_failure: true
   rules:
     - if: '$CI_COMMIT_TAG'
     - if: '$CI_COMMIT_BRANCH == "main"'
@@ -104,15 +101,14 @@ wheel:
 # --- the .deb --------------------------------------------------------------------------------------
 # venv at its final path (/opt/monky-deployd/venv is where the .deb puts it; venvs are not
 # relocatable) + nfpm. nfpm comes from GitHub releases (egress) with the goreleaser apt repo as
-# fallback; allow_failure until proven.
+# fallback (proven 2026-09-05, pipeline 6999). The wheel is required: a .deb without it would
+# silently ship a broken `transport: sdk`.
 package:
   stage: package
   image: ubuntu:26.04
   needs:
     - job: test
     - job: wheel
-      optional: true
-  allow_failure: true
   rules:
     - if: '$CI_COMMIT_TAG'
     - if: '$CI_COMMIT_BRANCH == "main"'
@@ -127,7 +123,9 @@ package:
     - 'python3 -m venv /opt/monky-deployd/venv'
     - '/opt/monky-deployd/venv/bin/pip install -q --upgrade pip'
     - '/opt/monky-deployd/venv/bin/pip install -q .'
-    - 'if ls vendor/*.whl >/dev/null 2>&1; then /opt/monky-deployd/venv/bin/pip install -q vendor/*.whl && /opt/monky-deployd/venv/bin/python -c "import openziti; print(\"openziti\", openziti.__version__ if hasattr(openziti, \"__version__\") else \"ok\")"; else echo "WARNING: no vendored openziti wheel — transport sdk will not work from this build"; fi'
+    - 'ls vendor/*.whl >/dev/null 2>&1 || { echo "no vendored openziti wheel (wheel job artifact missing)"; exit 1; }'
+    - '/opt/monky-deployd/venv/bin/pip install -q vendor/*.whl'
+    - '/opt/monky-deployd/venv/bin/python -c "import openziti; print(\"openziti import ok\")"'
     - '/opt/monky-deployd/venv/bin/python -m monky_deployd version'
     - 'mkdir -p build dist && cp -a /opt/monky-deployd/venv build/venv'
     # nfpm: GitHub release .deb, else the goreleaser apt repo

README.md

@@ -138,8 +138,8 @@ systemd-analyze verify packaging/systemd/*.service   # where systemd is availabl
 `lint` and `test` run on every MR/branch. `wheel` builds the `openziti` wheel on `ubuntu:26.04`
 (PyPI ships an sdist that fetches **ziti-sdk-c from github.com** at build time — the runner needs
 egress to github.com and pypi.org) and `package` builds the `.deb` with `nfpm` (binary from GitHub
-releases, goreleaser apt repo as fallback). Both are `allow_failure: true` until proven on this
-runner; without the wheel the `.deb` still works with `transport: proxy|system`. On a `v*` tag
+releases, goreleaser apt repo as fallback). Both were proven on the v0.1.0 tag pipeline and are
+blocking on `main`/tags (manual on MRs); the `.deb` always ships the SDK wheel. On a `v*` tag
 `release` uploads to the GitLab generic package registry + release, and `release:gitea` publishes
 the same assets on the public Gitea mirror (automatic when `GITEA_TOKEN` is set, manual otherwise
 — see `docs/OPERATIONS.md` for the by-hand recipe).