From 4f1c2cf174ad8f1308ff1f60ac30f1f70c4c6c82 Mon Sep 17 00:00:00 2001 From: "atlas-bot (Paperclip service account)" Date: Fri, 25 Sep 2026 20:44:53 +0000 Subject: [PATCH] docs(image-automation): push identity is the `flux` account, not gitea_admin MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The comment on ImageUpdateAutomation/homelab named gitea_admin as the owner of the bootstrap token that pushes writeback commits to master. That is wrong. The pushing account is `flux` (Gitea uid 9): its contribution history matches every `chore(image-automation)` commit on master 1:1, while gitea_admin's own contributions stop at 2026-07-21. Also separates two things the old wording ran together — the commit author (security-bot@renner.uno, set in this spec) and the pushing account (the token owner, not set here) — and records that writeback failure is silent, since no commit is attempted unless a tracked image moves. Comment-only. The ImageUpdateAutomation object is byte-identical; no Kubernetes object changes, nothing for Flux to reconcile. Refs REN-50 Co-Authored-By: Paperclip --- .../image-automation/update-automation.yaml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/kubernetes/infrastructure/image-automation/update-automation.yaml b/kubernetes/infrastructure/image-automation/update-automation.yaml index f71e62b1..0719356d 100644 --- a/kubernetes/infrastructure/image-automation/update-automation.yaml +++ b/kubernetes/infrastructure/image-automation/update-automation.yaml @@ -8,8 +8,15 @@ spec: # Reuses the existing flux-system GitRepository — its Secret was # created by `flux bootstrap gitea --token-auth` and already has # write access to the repo. Push identity is the bootstrap token's - # owner (gitea_admin); commit author is overridden below to - # security-bot@renner.uno so commits stay visibly machine-authored. + # owner, which is the `flux` Gitea account (uid 9) — not + # gitea_admin, as this comment used to say. Evidence: the flux + # account's contribution history matches every + # `chore(image-automation)` commit on master 1:1, while + # gitea_admin's own contributions stop at 2026-07-21. That account + # therefore has to keep push access to master, or writeback fails + # silently — no commit is attempted unless a tracked image moves. + # The commit author overridden below to security-bot@renner.uno is + # the author field only; it says nothing about who pushes. sourceRef: kind: GitRepository name: flux-system -- 2.54.0