timothy/ersatztv
1
0
Fork 0
Code Issues 54 Pull Requests 6 Actions Packages Projects Releases 9 Wiki Activity

release: cut v26.8.0 and complete ChicoryTV go-live #335

New Issue
Closed
opened 2026-07-13 19:37:32 +02:00 by timothy · 4 comments
timothy commented 2026-07-13 19:37:32 +02:00
Owner
Copy Link
Copy Source

Arc 6 from #237. Release the settled ChicoryTV rewrite from current main, validate the exact immutable candidate, and deploy it through the proven fail-closed backup/migration-smoke path.

The authoritative deployment policy is the floating :prod path hardened in server-management#585/#589. PR #191's immediate version-pin bump is stale and superseded; it must not be merged as-is.

Done-when

  • PR #191 is closed as superseded and repository release docs match the live floating-:prod deployment path.
  • docs/decisions.md release-boundary consolidation/index refresh is merged to main.
  • Current candidate passes the full local verification gate and a full dependency vulnerability scan; main CI is green.
  • v26.8.0 is cut from the verified main commit and its immutable :26.8.0 image build is green.
  • The authenticated ZAP + semgrep release scan passes against the exact immutable :26.8.0 image, with every finding triaged.
  • Prod ForwardedHeaders trust is restricted to the actual proxy/network before any proxy exposure.
  • The local admin is bootstrapped without committing a credential, login is verified, and any one-shot seed is removed.
  • The prod promotion is observed through Komodo's pre-deploy backup + prod-copy migration smoke; health, SPA auth, M3U, and XMLTV pass after deployment.
  • #333's real-server integration validation is either completed on an isolated current candidate or explicitly recorded as a non-gating deferral.
  • Adversarial review passed for any non-doc/runtime change, or the documented skip exemption applies.
Arc 6 from #237. Release the settled ChicoryTV rewrite from current `main`, validate the exact immutable candidate, and deploy it through the proven fail-closed backup/migration-smoke path. The authoritative deployment policy is the floating `:prod` path hardened in server-management#585/#589. PR #191's immediate version-pin bump is stale and superseded; it must not be merged as-is. ## Done-when - [x] PR #191 is closed as superseded and repository release docs match the live floating-`:prod` deployment path. - [x] `docs/decisions.md` release-boundary consolidation/index refresh is merged to `main`. - [x] Current candidate passes the full local verification gate and a full dependency vulnerability scan; `main` CI is green. - [x] `v26.8.0` is cut from the verified `main` commit and its immutable `:26.8.0` image build is green. - [x] The authenticated ZAP + semgrep release scan passes against the exact immutable `:26.8.0` image, with every finding triaged. - [x] Prod ForwardedHeaders trust is restricted to the actual proxy/network before any proxy exposure. - [x] The local admin is bootstrapped without committing a credential, login is verified, and any one-shot seed is removed. - [x] The prod promotion is observed through Komodo's pre-deploy backup + prod-copy migration smoke; health, SPA auth, M3U, and XMLTV pass after deployment. - [x] #333's real-server integration validation is either completed on an isolated current candidate or explicitly recorded as a non-gating deferral. - [x] Adversarial review passed for any non-doc/runtime change, or the documented skip exemption applies.
timothy added this to the ChicoryTV go-live milestone 2026-07-13 19:37:34 +02:00
timothy added the ci-cdpriority: highsecurityin-progress labels 2026-07-13 19:37:34 +02:00
timothy commented 2026-07-13 19:37:39 +02:00
Author
Owner
Copy Link
Copy Source

claiming — session started 2026-07-13T19:37:40+02:00

claiming — session started 2026-07-13T19:37:40+02:00
timothy commented 2026-07-13 19:45:27 +02:00
Author
Owner
Copy Link
Copy Source

Release-path recon complete:

  • PR #191 is closed as superseded. server-management#585/#589 prove the floating :prod path runs the same fail-closed backup + prod-copy migration smoke for manual and automatic DeployStack.
  • Preparing a docs-only release-boundary PR: correct stale host/pin text, replace the resolved backup caveat with the exact-image scan → manual promotion procedure, consolidate/refresh docs/decisions.md, and encode the lower-effort queue-selector routing rule requested in this session.
  • #333 is confirmed non-gating (unmilestoned priority: medium). Its Plex sign-out and sync flows are destructive to the chosen test instance and require interactive external credentials; it will be recorded as an explicit isolated-test deferral unless a safe current candidate becomes available before promotion.
Release-path recon complete: - PR #191 is closed as superseded. server-management#585/#589 prove the floating `:prod` path runs the same fail-closed backup + prod-copy migration smoke for manual and automatic `DeployStack`. - Preparing a docs-only release-boundary PR: correct stale host/pin text, replace the resolved backup caveat with the exact-image scan → manual promotion procedure, consolidate/refresh `docs/decisions.md`, and encode the lower-effort queue-selector routing rule requested in this session. - #333 is confirmed non-gating (unmilestoned `priority: medium`). Its Plex sign-out and sync flows are destructive to the chosen test instance and require interactive external credentials; it will be recorded as an explicit isolated-test deferral unless a safe current candidate becomes available before promotion.
timothy commented 2026-07-13 20:13:18 +02:00
Author
Owner
Copy Link
Copy Source

Progress

  • Release-boundary PR #337 merged at 985eed072c34321eb8ca1ddf6adfc97c961bc1e8; #336 is closed with full local and PR verification recorded.
  • Main CI run 613 has passed .NET and both-provider migration integrity; its image build is queued.
  • The exact-source Semgrep security-audit/secrets/C# rulesets completed with exit 0.
  • server-management#590 / PR #591 prepares the permanent forwarded-header trust boundary and empty-by-default one-shot admin seed. It is reviewed and intentionally held behind the immutable image scan.
  • The generated production admin credential is stored only in macOS Keychain; it has not appeared in Git or issue content.
  • #333 now records an explicit non-gating deferral to a later isolated real-server test window.

Next gate: main run 613 green → tag v26.8.0 → tag image green → authenticated DAST of the exact immutable image.

## Progress - Release-boundary PR #337 merged at `985eed072c34321eb8ca1ddf6adfc97c961bc1e8`; #336 is closed with full local and PR verification recorded. - Main CI run 613 has passed .NET and both-provider migration integrity; its image build is queued. - The exact-source Semgrep security-audit/secrets/C# rulesets completed with exit 0. - server-management#590 / PR #591 prepares the permanent forwarded-header trust boundary and empty-by-default one-shot admin seed. It is reviewed and intentionally held behind the immutable image scan. - The generated production admin credential is stored only in macOS Keychain; it has not appeared in Git or issue content. - #333 now records an explicit non-gating deferral to a later isolated real-server test window. Next gate: main run 613 green → tag v26.8.0 → tag image green → authenticated DAST of the exact immutable image.
timothy commented 2026-07-13 20:44:10 +02:00
Author
Owner
Copy Link
Copy Source

Done

  • Outcome: ChicoryTV v26.8.0 is live in production from exact commit 985eed072c34321eb8ca1ddf6adfc97c961bc1e8 and image sha256:ffadc2279c2db549aaa1e2bb35fe6629b9242b5bddd00548cc0b2f14315ced84.
  • Release boundary: stale PR #191 was closed as superseded. PR #337 merged the floating-:prod deployment policy, decisions consolidation/index refresh, and low-effort future queue-selector rule; #336 is closed.
  • Verification: full local restore/build/test passed (all six test projects; Core 507 passed/1 skipped), web 738 tests plus lint/typecheck/API sync/build passed, and the full NuGet transitive vulnerability audit found no vulnerable packages. Main run 613 and tag run 614 are green, including SQLite/MySql migration integrity and image IPTV/SPA smoke.
  • Security scan: exact-source Semgrep (p/security-audit, p/secrets, p/csharp) exited 0. Authenticated ZAP scanned the exact :26.8.0 image in a fresh throwaway container: 0 FAIL / High / Medium / Critical. Triaged warnings match the established baseline: CORP Low remains #330, four SPA fallback content types are expected, and client-error/non-storable informational alerts show auth/validation rejection behavior. Report: bumblebee:/home/timothy/etv-secscan-v26.8.0/. #338 tracks ZAP's misleading warning exit-code wording.
  • Production hardening/deploy: server-management#590 / PR #591 set ForwardedHeaders__KnownNetworks=172.16.238.0/24 and an empty-by-default bootstrap hook. Komodo update 6a55305946aa954121582bab created integrity-checked local/PBS snapshot 20260713T183714Z, passed the exact-image migration-on-prod-copy smoke, and recreated ErsatzTV. Update 6a5530ef46aa954121582bcb removed the seed and recreated the container.
  • Auth/runtime: generated admin credential is stored only in macOS Keychain. Komodo has zero seed entries; live placeholder is empty; final restart did not reseed. Version 26.8.0, health, local login/session, machine-key access, ChicoryTV SPA, M3U, and XMLTV pass; setupRequired=false; anonymous protected API access returns 401.
  • Docs: repo docs landed in 985eed07; operational runbook/evidence published to homelab-docs at 9907ed3.
  • Review: PR #337 recorded the docs-only exemption. server-management PR #591 recorded the bounded declarative-config/runbook self-review exemption and was then verified end-to-end in production.
  • Deferred/follow-up: #333 is explicitly non-gating and remains open for a later isolated real-server credentials window. #330 remains a non-gating CORP Low. #338 is a low-priority scanner UX/documentation correction.
## Done - **Outcome:** ChicoryTV v26.8.0 is live in production from exact commit `985eed072c34321eb8ca1ddf6adfc97c961bc1e8` and image `sha256:ffadc2279c2db549aaa1e2bb35fe6629b9242b5bddd00548cc0b2f14315ced84`. - **Release boundary:** stale PR #191 was closed as superseded. PR #337 merged the floating-`:prod` deployment policy, decisions consolidation/index refresh, and low-effort future queue-selector rule; #336 is closed. - **Verification:** full local restore/build/test passed (all six test projects; Core 507 passed/1 skipped), web 738 tests plus lint/typecheck/API sync/build passed, and the full NuGet transitive vulnerability audit found no vulnerable packages. Main run 613 and tag run 614 are green, including SQLite/MySql migration integrity and image IPTV/SPA smoke. - **Security scan:** exact-source Semgrep (`p/security-audit`, `p/secrets`, `p/csharp`) exited 0. Authenticated ZAP scanned the exact `:26.8.0` image in a fresh throwaway container: 0 FAIL / High / Medium / Critical. Triaged warnings match the established baseline: CORP Low remains #330, four SPA fallback content types are expected, and client-error/non-storable informational alerts show auth/validation rejection behavior. Report: `bumblebee:/home/timothy/etv-secscan-v26.8.0/`. #338 tracks ZAP's misleading warning exit-code wording. - **Production hardening/deploy:** server-management#590 / PR #591 set `ForwardedHeaders__KnownNetworks=172.16.238.0/24` and an empty-by-default bootstrap hook. Komodo update `6a55305946aa954121582bab` created integrity-checked local/PBS snapshot `20260713T183714Z`, passed the exact-image migration-on-prod-copy smoke, and recreated ErsatzTV. Update `6a5530ef46aa954121582bcb` removed the seed and recreated the container. - **Auth/runtime:** generated admin credential is stored only in macOS Keychain. Komodo has zero seed entries; live placeholder is empty; final restart did not reseed. Version 26.8.0, health, local login/session, machine-key access, ChicoryTV SPA, M3U, and XMLTV pass; `setupRequired=false`; anonymous protected API access returns 401. - **Docs:** repo docs landed in `985eed07`; operational runbook/evidence published to `homelab-docs` at `9907ed3`. - **Review:** PR #337 recorded the docs-only exemption. server-management PR #591 recorded the bounded declarative-config/runbook self-review exemption and was then verified end-to-end in production. - **Deferred/follow-up:** #333 is explicitly non-gating and remains open for a later isolated real-server credentials window. #330 remains a non-gating CORP Low. #338 is a low-priority scanner UX/documentation correction.
timothy removed the in-progress label 2026-07-13 20:44:15 +02:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
ad-hoc
One-off / ad-hoc work not tracked by a dedicated issue
 api
REST API / HTTP endpoints
 bug
Something isn't working
 ci-cd
Build, test, deploy pipeline
 content
Channel content / schedules / playlists
 dependencies
Dependency updates (Renovate)
 enhancement
New feature or improvement
 frontend
ChicoryTV React SPA frontend
 in-progress
Claimed by an active session — do not pick up
 jellyfin
Jellyfin tuner / IPTV integration
 parked
Excluded from automatic queue pickup; work only when explicitly selected
 priority: high
priority: low
priority: medium
review
Adversarial review finding
 security
Security / vulnerability fix
No labels ci-cd priority: high security
Milestone
No items
No Milestone ChicoryTV go-live
Projects
Clear projects
No projects
Assignees
Clear assignees
renovate timothy (Timothy)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: timothy/ersatztv#335