chore(ci): move the release-toolkit PR gates into one pr.yml and bump the pin past the gate-removal cut #181

New issue

Open

opened 2026-10-04 10:54:42 +02:00 by claude · 0 comments

claude commented

2026-10-04 10:54:42 +02:00

Member

Part of frankenbit/release-toolkit#1530. Waits for both of these:

v0.66.0, the first release-toolkit tag with reusable-pr-gates.yml (rolling PR frankenbit/release-toolkit#1549);
tmux-tell's migration, whose job log is read first.

Now (read at `c6d7a55`, 2026-10-04)

Workflow	Calls	Pin
`release.yml`	`reusable-release.yml`	`@v0.42.0`
`manifest-check.yml`	`reusable-manifest-check.yml`	`@v0.42.0`
`fragment-check.yml`	`reusable-changelog-fragment-check.yml`	`@v0.42.0`

main requires no status today.

Why

release-toolkit's CI runner has one slot, shared by every repo. The toolkit is replacing its single-gate reusables with one reusable-pr-gates.yml that runs every gate in one job. Tags from before the removal keep working, so nothing here breaks until the pin moves.

The jump crosses v0.57.0. From that version, rt is fetched with a minisign check, and the repo needs the public key (frankenbit/release-toolkit#1479).

Migrating also turns on the landing-tree replay (frankenbit/release-toolkit#1548). The gates then grade what would land on main, not just the PR head. A PR whose branch no longer applies cleanly goes red with "rebase locally".

Acceptance criteria

RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY is set for the repo before the pin moves (frankenbit/release-toolkit#1479). — DONE @ #182 (df82f8f, reviewed as df82f8f, review 7249). It is set at the frankenbit org scope (key id D11C3791DB75C907). The PR run logged minisign signature OK (1 trusted key(s) available).
manifest-check.yml and fragment-check.yml are deleted. A new pr.yml calls reusable-pr-gates.yml at v0.66.0 or later with layout: combined, with manifest and fragments on and every other gate off. — DONE @ #182 (df82f8f, reviewed as df82f8f, review 7249).
pr.yml follows ADR-0013's wiring rule: its pull_request types include edited, and it has no paths: filter (frankenbit/release-toolkit#644). — DONE @ #182 (df82f8f, reviewed as df82f8f, review 7249).
main requires pr.yml's caller status, which is the status of the job in pr.yml that calls reusable-pr-gates.yml (frankenbit/release-toolkit ADR-0013 D3 and D4). A pr.yml that fails to parse then blocks merges instead of passing silently. — DONE 2026-10-05: after pr / gates posted success on rolling PR #183 (run 307; its log shows the gates ran, with cut consumed), the operator enabled status checks and required it. Read back via the API: enable_status_check: true, requiring pr / gates (pull_request).
- The required context is added only after it has posted on this repo's rolling release PR (frankenbit/release-toolkit#809).
- This is an admin edit by the operator.
release.yml is pinned to the same tag. — DONE @ #182 (df82f8f, reviewed as df82f8f, review 7249). Its first push run, 305, resolved v0.66.0 from the baked value, FETCHed and verified rt, and passed the PAT scope check (issue scope: PASS, user scope: PASS as release-bot).
On the first PR after the move, the pr job's log is read, not just its status. It must show both gates ran and the attest step passed. — DONE @ #182 (df82f8f, reviewed as df82f8f, review 7249). Run 303 job 1, read in the built-in browser by the implementer and the reviewer: resolved toolkit ref: v0.66.0 (source=baked), FETCH, minisign and trusted comment OK, checksum OK (189ebf7f…), replay PASS, the on gates passed, the off gates were skipped, the tree was unchanged, and attest passed.
The first cut after the move succeeds.

Part of frankenbit/release-toolkit#1530. Waits for both of these: - v0.66.0, the first release-toolkit tag with `reusable-pr-gates.yml` (rolling PR frankenbit/release-toolkit#1549); - tmux-tell's migration, whose job log is read first. ## Now (read at `c6d7a55`, 2026-10-04) | Workflow | Calls | Pin | |---|---|---| | `release.yml` | `reusable-release.yml` | `@v0.42.0` | | `manifest-check.yml` | `reusable-manifest-check.yml` | `@v0.42.0` | | `fragment-check.yml` | `reusable-changelog-fragment-check.yml` | `@v0.42.0` | `main` requires no status today. ## Why release-toolkit's CI runner has one slot, shared by every repo. The toolkit is replacing its single-gate reusables with one `reusable-pr-gates.yml` that runs every gate in one job. Tags from before the removal keep working, so nothing here breaks until the pin moves. **The jump crosses v0.57.0.** From that version, `rt` is fetched with a minisign check, and the repo needs the public key (frankenbit/release-toolkit#1479). **Migrating also turns on the landing-tree replay** (frankenbit/release-toolkit#1548). The gates then grade what would land on `main`, not just the PR head. A PR whose branch no longer applies cleanly goes red with "rebase locally". ## Acceptance criteria - [x] `RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY` is set for the repo before the pin moves (frankenbit/release-toolkit#1479). — DONE @ #182 (`df82f8f`, reviewed as `df82f8f`, review 7249). It is set at the frankenbit org scope (key id `D11C3791DB75C907`). The PR run logged `minisign signature OK (1 trusted key(s) available)`. - [x] `manifest-check.yml` and `fragment-check.yml` are deleted. A new `pr.yml` calls `reusable-pr-gates.yml` at `v0.66.0` or later with `layout: combined`, with manifest and fragments `on` and every other gate `off`. — DONE @ #182 (`df82f8f`, reviewed as `df82f8f`, review 7249). - [x] `pr.yml` follows ADR-0013's wiring rule: its `pull_request` types include `edited`, and it has no `paths:` filter (frankenbit/release-toolkit#644). — DONE @ #182 (`df82f8f`, reviewed as `df82f8f`, review 7249). - [x] `main` requires `pr.yml`'s caller status, which is the status of the job in `pr.yml` that calls `reusable-pr-gates.yml` (frankenbit/release-toolkit ADR-0013 D3 and D4). A `pr.yml` that fails to parse then blocks merges instead of passing silently. — DONE 2026-10-05: after `pr / gates` posted success on rolling PR #183 (run 307; its log shows the gates ran, with `cut consumed`), the operator enabled status checks and required it. Read back via the API: `enable_status_check: true`, requiring `pr / gates (pull_request)`. - The required context is added only after it has posted on this repo's rolling release PR (frankenbit/release-toolkit#809). - This is an admin edit by the operator. - [x] `release.yml` is pinned to the same tag. — DONE @ #182 (`df82f8f`, reviewed as `df82f8f`, review 7249). Its first push run, 305, resolved `v0.66.0` from the baked value, FETCHed and verified `rt`, and passed the PAT scope check (`issue scope: PASS`, `user scope: PASS` as release-bot). - [x] On the first PR after the move, the `pr` job's log is read, not just its status. It must show both gates ran and the attest step passed. — DONE @ #182 (`df82f8f`, reviewed as `df82f8f`, review 7249). Run 303 job 1, read in the built-in browser by the implementer and the reviewer: `resolved toolkit ref: v0.66.0 (source=baked)`, FETCH, minisign and trusted comment OK, `checksum OK (189ebf7f…)`, replay PASS, the on gates passed, the off gates were skipped, the tree was unchanged, and attest passed. - [ ] The first cut after the move succeeds.

claude added the

labels

2026-10-04 10:56:14 +02:00

claude referenced this issue from frankenbit/release-toolkit

2026-10-04 10:56:53 +02:00