ci: move CI, previews and production to the self-hosted GitLab #505

2026-10-13T10:16:27Z

root commented

2026-10-13 10:16:27 +00:00

(Migrated from gitlab.core-project.space)

Summary

GitLab on the CI VPS becomes the source of truth: its pipeline runs the gate, deploys review apps and production, and reaps previews. GitHub becomes a push mirror with every workflow disabled.

 .gitlab-ci.yml
 include:
-  - local: infra/gitlab/ci/deploy.gitlab-ci.yml    # local PoC, manual production
+  - local: infra/gitlab/vps/deploy.gitlab-ci.yml   # CI VPS, automatic production

infra/gitlab/
├── compose.yaml, scripts/, ci/   # the local proof of concept and the shared CI scripts
├── vps/                          # the CI VPS: stack, wizard, backups, deploy jobs
├── import/                       # GitHub issues → GitLab, numbers kept
└── DECISIONS.md                  # decision log
docs/research/gitlab-poc.md       # PoC report and measurements

Fixes found on the VPS run: the image builds without attestations, since Docker 29.9 pushed the attestation manifest alongside the image manifest it names as subject and the registry refused it (MANIFEST_BLOB_UNKNOWN); the wizard blocks merges until the pipeline succeeds.

Evidence

Before: pipeline 2 (!503), build-image failed: error from registry: blob unknown to registry - sha256:d4dd…; registry log shows the attestation PUT answered 400 before the image manifest landed.
After: pipeline 3 (!504) green: gate, image pushed to registry.core-project.space, review app on the production VPS, browser suite against it, stop-review on close.
Project setting read back: only_allow_merge_if_pipeline_succeeds=true, allow_merge_on_skipped_pipeline=false.

Merge Danger

Door: two-way

Revert the include and re-enable the GitHub workflows (gh workflow enable) to hand deploys back to GitHub.

Blast Radius: production

Merging deploys production from the GitLab registry image. Rule files (CLAUDE.md, CONTRIBUTING.md, docs/agents/, skills calling gh, an ADR superseding the CI part of ADR 0029) follow in a dedicated merge request.

## Summary GitLab on the CI VPS becomes the source of truth: its pipeline runs the gate, deploys review apps and production, and reaps previews. GitHub becomes a push mirror with every workflow disabled. ```diff .gitlab-ci.yml include: - - local: infra/gitlab/ci/deploy.gitlab-ci.yml # local PoC, manual production + - local: infra/gitlab/vps/deploy.gitlab-ci.yml # CI VPS, automatic production ``` ```text infra/gitlab/ ├── compose.yaml, scripts/, ci/ # the local proof of concept and the shared CI scripts ├── vps/ # the CI VPS: stack, wizard, backups, deploy jobs ├── import/ # GitHub issues → GitLab, numbers kept └── DECISIONS.md # decision log docs/research/gitlab-poc.md # PoC report and measurements ``` Fixes found on the VPS run: the image builds without attestations, since Docker 29.9 pushed the attestation manifest alongside the image manifest it names as subject and the registry refused it (`MANIFEST_BLOB_UNKNOWN`); the wizard blocks merges until the pipeline succeeds. ## Evidence - **Before:** pipeline 2 (!503), `build-image` failed: `error from registry: blob unknown to registry - sha256:d4dd…`; registry log shows the attestation `PUT` answered 400 before the image manifest landed. **After:** pipeline 3 (!504) green: gate, image pushed to `registry.core-project.space`, review app on the production VPS, browser suite against it, `stop-review` on close. - Project setting read back: `only_allow_merge_if_pipeline_succeeds=true`, `allow_merge_on_skipped_pipeline=false`. ## Merge Danger **Door:** two-way Revert the include and re-enable the GitHub workflows (`gh workflow enable`) to hand deploys back to GitHub. **Blast Radius:** production Merging deploys production from the GitLab registry image. Rule files (CLAUDE.md, CONTRIBUTING.md, docs/agents/, skills calling `gh`, an ADR superseding the CI part of ADR 0029) follow in a dedicated merge request.