chore(ci): run the release-toolkit PR gates from one pr.yml at v0.66.0 #182

Merged

alex merged 1 commit from claude/181-pr-gates-v0.66.0 into main 2026-10-05 21:56:07 +02:00

Conversation 3 Commits 1 Files changed 6 +38 -42

claude commented 2026-10-05 21:31:33 +02:00

Member

• Copy link
• Copy Markdown

Refs #181

Moves cellblock's release-toolkit PR gates into one pr.yml that calls reusable-pr-gates.yml@v0.66.0, deletes manifest-check.yml and fragment-check.yml, and bumps release.yml from @v0.42.0 to @v0.66.0. Same shape as tmux-tell's migration (frankenbit/tmux-tell PR 964). Part of frankenbit/release-toolkit#1530.

What changes

• New .forgejo/workflows/pr.yml: job gates, runs_on: go, layout: combined, manifest: 'on', fragments: 'on'. Every other gate stays at its default, off. Trigger types include edited; no paths: filter; no secrets: line (C3: pr-gates needs none).
• manifest-check.yml and fragment-check.yml are deleted.
• release.yml: pin @v0.42.0 -> @v0.66.0, plus a short upgrade comment. Nothing else in the file changes.
• release-toolkit.yml: the wiring comment names pr.yml instead of manifest-check.yml.
• changelog.d/181.internal.md.

Branch protection is not touched. Per ADR-0013 D4, the operator adds pr / gates (pull_request) as a required check on main after it has posted on the rolling release PR.

Behaviour change for contributors

The old fragment-check.yml ran only when changelog.d/** changed. pr.yml has no paths: filter, so fragment coverage now grades every PR: each PR needs a changelog.d/ fragment or one no-changelog: <reason> line in its body. The gates also grade the landing tree (the PR merged onto current main), so a PR that no longer applies cleanly goes red and needs a rebase (frankenbit/release-toolkit#1548).

Carry-forward

Old wrapper	Input passed	Where it goes in pr.yml
manifest-check.yml	runs_on: go	runs_on: go
manifest-check.yml	(config_path default release-toolkit.yml)	same default, not passed
fragment-check.yml	runs_on: go	runs_on: go
fragment-check.yml	(fragments_dir, valid_kinds, fragment_length_warn_chars, density, five density limits: defaults)	same defaults in pr-gates v0.66.0, not passed
fragment-check.yml	on: paths: ['changelog.d/**']	dropped on purpose (ADR-0013 wiring rule)

Both pins were @v0.42.0; the gate list is unchanged (manifest and fragments).

Upgrade check for release.yml (v0.42.0 -> v0.66.0)

Diffed reusable-release.yml's on: workflow_call: block at the two tags:

• Inputs went from 6 to 8. Added: release_pr_reviewers (default empty) and cut_gate (default execute), both optional. None removed or renamed, no new required input.
• No secrets: block in either version; secrets: inherit stays.
• Outputs were only added (the blocked mode outputs).
• One default changed: publish_mode went from draft to immediate at v0.43.0 (frankenbit/release-toolkit#827). It does not affect cellblock, because release.yml already passes publish_mode: ${{ inputs.publish_mode || 'immediate' }} explicitly (added in c60c5aa for exactly this). That line is unchanged.
• Every ### Removed and ### Upgrade section from v0.43.0 to v0.66.0 reads "None.", except v0.43.0's Removed (the Codeberg mirror workflows), which cellblock never wired.
• From v0.64.0 the release credential step probes the PAT's issue scope (frankenbit/release-toolkit#1484). cellblock has no repo secrets; it inherits the frankenbit org secret RELEASE_TOOLKIT_TOKEN, the same one tmux-tell's v0.66.0 wrapper uses.

Minisign key

The jump crosses v0.57.0, so rt is fetched with a minisign check. RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY is not set on the repo, but it is set at frankenbit org scope (read through the API on 2026-10-05). Its key id D11C3791DB75C907 and key line match minisign.pub at v0.66.0.

Fragment kind

internal is right when the change is invisible to players and should bump patch; changed is right when the release machinery counts as user-facing (tmux-tell chose it). This PR uses internal, since nothing in the game changes. Easy to rename if you prefer changed.

Verification

Requesting a verify-at-source review from @alex: the job log of this PR's pr / gates run, read in the pane, with the evidence lines posted as a comment below.

Locally (a dev rt build, not the v0.66.0 binary): rt manifest-check passes, and rt fragment-check in content mode passes kind, summary header, issue reference and density on the new fragment.

🤖 Generated with Claude Code

Refs #181 Moves cellblock's release-toolkit PR gates into one `pr.yml` that calls `reusable-pr-gates.yml@v0.66.0`, deletes `manifest-check.yml` and `fragment-check.yml`, and bumps `release.yml` from `@v0.42.0` to `@v0.66.0`. Same shape as tmux-tell's migration (frankenbit/tmux-tell PR 964). Part of frankenbit/release-toolkit#1530. ## What changes - New `.forgejo/workflows/pr.yml`: job `gates`, `runs_on: go`, `layout: combined`, `manifest: 'on'`, `fragments: 'on'`. Every other gate stays at its default, `off`. Trigger types include `edited`; no `paths:` filter; no `secrets:` line (C3: pr-gates needs none). - `manifest-check.yml` and `fragment-check.yml` are deleted. - `release.yml`: pin `@v0.42.0` -> `@v0.66.0`, plus a short upgrade comment. Nothing else in the file changes. - `release-toolkit.yml`: the wiring comment names `pr.yml` instead of `manifest-check.yml`. - `changelog.d/181.internal.md`. Branch protection is not touched. Per ADR-0013 D4, the operator adds `pr / gates (pull_request)` as a required check on `main` after it has posted on the rolling release PR. ## Behaviour change for contributors The old `fragment-check.yml` ran only when `changelog.d/**` changed. `pr.yml` has no `paths:` filter, so fragment coverage now grades every PR: each PR needs a `changelog.d/` fragment or one `no-changelog: <reason>` line in its body. The gates also grade the landing tree (the PR merged onto current `main`), so a PR that no longer applies cleanly goes red and needs a rebase (frankenbit/release-toolkit#1548). ## Carry-forward | Old wrapper | Input passed | Where it goes in `pr.yml` | |---|---|---| | `manifest-check.yml` | `runs_on: go` | `runs_on: go` | | `manifest-check.yml` | (`config_path` default `release-toolkit.yml`) | same default, not passed | | `fragment-check.yml` | `runs_on: go` | `runs_on: go` | | `fragment-check.yml` | (`fragments_dir`, `valid_kinds`, `fragment_length_warn_chars`, `density`, five density limits: defaults) | same defaults in pr-gates v0.66.0, not passed | | `fragment-check.yml` | `on: paths: ['changelog.d/**']` | dropped on purpose (ADR-0013 wiring rule) | Both pins were `@v0.42.0`; the gate list is unchanged (manifest and fragments). ## Upgrade check for `release.yml` (v0.42.0 -> v0.66.0) Diffed `reusable-release.yml`'s `on: workflow_call:` block at the two tags: - Inputs went from 6 to 8. Added: `release_pr_reviewers` (default empty) and `cut_gate` (default `execute`), both optional. None removed or renamed, no new required input. - No `secrets:` block in either version; `secrets: inherit` stays. - Outputs were only added (the `blocked` mode outputs). - One default changed: `publish_mode` went from `draft` to `immediate` at v0.43.0 (frankenbit/release-toolkit#827). It does not affect cellblock, because `release.yml` already passes `publish_mode: ${{ inputs.publish_mode || 'immediate' }}` explicitly (added in c60c5aa for exactly this). That line is unchanged. - Every `### Removed` and `### Upgrade` section from v0.43.0 to v0.66.0 reads "None.", except v0.43.0's Removed (the Codeberg mirror workflows), which cellblock never wired. - From v0.64.0 the release credential step probes the PAT's issue scope (frankenbit/release-toolkit#1484). cellblock has no repo secrets; it inherits the frankenbit org secret `RELEASE_TOOLKIT_TOKEN`, the same one tmux-tell's v0.66.0 wrapper uses. ## Minisign key The jump crosses v0.57.0, so `rt` is fetched with a minisign check. `RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY` is not set on the repo, but it is set at frankenbit org scope (read through the API on 2026-10-05). Its key id `D11C3791DB75C907` and key line match `minisign.pub` at v0.66.0. ## Fragment kind `internal` is right when the change is invisible to players and should bump patch; `changed` is right when the release machinery counts as user-facing (tmux-tell chose it). This PR uses `internal`, since nothing in the game changes. Easy to rename if you prefer `changed`. ## Verification Requesting a verify-at-source review from @alex: the job log of this PR's `pr / gates` run, read in the pane, with the evidence lines posted as a comment below. Locally (a dev `rt` build, not the v0.66.0 binary): `rt manifest-check` passes, and `rt fragment-check` in content mode passes kind, summary header, issue reference and density on the new fragment. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude added the

kind

chore

priority

low

size

S

labels 2026-10-05 21:31:33 +02:00

claude added 1 commit 2026-10-05 21:31:33 +02:00

chore(ci): run the release-toolkit PR gates from one pr.yml at v0.66.0 ... df82f8f4af

manifest-check.yml and fragment-check.yml each called a single-gate
reusable at v0.42.0. They become one pr.yml that calls
reusable-pr-gates.yml at v0.66.0 with layout: combined, manifest and
fragments on, and every other gate left at its default, off
(frankenbit/release-toolkit ADR-0013).

pr.yml follows the ADR's wiring rule: its pull_request types include
edited, and it has no paths: filter. The old fragment-check.yml ran only
on changelog.d/** changes; fragments now run on every PR. The only input
either old wrapper passed was runs_on: go. Every other input the old
reusables took has the same default in the new one.

release.yml moves to the same tag. Its workflow_call inputs went from 6
to 8 (cut_gate and release_pr_reviewers, both optional); none was
removed or renamed and no secret is declared. publish_mode's default
moved from draft to immediate at v0.43.0, which this wrapper already
passes explicitly. The minisign key the v0.57.0+ fetch needs is set at
frankenbit org scope.

release-toolkit.yml's wiring comment follows the rename.

Refs #181

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude requested review from alex 2026-10-05 21:31:33 +02:00

claude commented 2026-10-05 21:51:19 +02:00

Author

Member

• Copy link
• Copy Markdown

CI evidence for head df82f8f4af19ee483008e177c7ffbfc82b98c1e5, read from the job log (run 303, job 1, "plan, and run every gate when combined"), not from the status.

• resolve toolkit ref: resolved toolkit ref: v0.66.0 (source=baked), after caller scan over 3 top-level workflow file(s): / remote v0.66.0 .forgejo/workflows/pr.yml.
• bootstrap rt (cache miss, first run at this pin):
  • bootstrap rt: FETCH published asset @ v0.66.0 (adopter / frozen-cut path)
  • release-toolkit: minisign signature OK (1 trusted key(s) available)
  • release-toolkit: signed for v0.66.0 (trusted comment matches)
  • release-toolkit: checksum OK (189ebf7f9a653fd3cfe22ceed92fd048672df1eb5db10996776e65e3582515b4)
  • rt 0.66.0
• landing-tree replay: landing-tree replay: PASS - this head already contains origin/main at c6d7a55bd3e7b51ca4842b125e042e15dd97bcdf, so it IS the landing tree.
• manifest: [manifest-check] all checks passed
• fragments: fragment-coverage: PASS - fragment present: changelog.d/181.internal.md, and fragment-check: density PASS - grades fragment density and fragment content validity; does NOT grade PR fragment coverage.
• tree: pr-gates: tree unchanged across every gate step (manifest fragments).
• attest: attest: every expected gate ran (manifest fragments) and every green gate wrote its own verdict and no other.
• off gates: steps changelog_body, register, ac_closure and workflow_parse are skipped, with empty logs.

The split-layout jobs (manifest, fragments, changelog_body, register, ac_closure, workflow_parse, split result) are skipped in the run, but their commit statuses still read "pending, Has started running". tmux-tell's migration head af77cf0 shows the same. pr / gates (pull_request) is success, and the combined commit state is success.

test (run 304): server, client and client-nav all success.

CI evidence for head `df82f8f4af19ee483008e177c7ffbfc82b98c1e5`, read from the job log (run 303, job 1, "plan, and run every gate when combined"), not from the status. - resolve toolkit ref: `resolved toolkit ref: v0.66.0 (source=baked)`, after `caller scan over 3 top-level workflow file(s):` / `remote v0.66.0 .forgejo/workflows/pr.yml`. - bootstrap rt (cache miss, first run at this pin): - `bootstrap rt: FETCH published asset @ v0.66.0 (adopter / frozen-cut path)` - `release-toolkit: minisign signature OK (1 trusted key(s) available)` - `release-toolkit: signed for v0.66.0 (trusted comment matches)` - `release-toolkit: checksum OK (189ebf7f9a653fd3cfe22ceed92fd048672df1eb5db10996776e65e3582515b4)` - `rt 0.66.0` - landing-tree replay: `landing-tree replay: PASS - this head already contains origin/main at c6d7a55bd3e7b51ca4842b125e042e15dd97bcdf, so it IS the landing tree.` - manifest: `[manifest-check] all checks passed` - fragments: `fragment-coverage: PASS - fragment present: changelog.d/181.internal.md`, and `fragment-check: density PASS - grades fragment density and fragment content validity; does NOT grade PR fragment coverage.` - tree: `pr-gates: tree unchanged across every gate step (manifest fragments).` - attest: `attest: every expected gate ran (manifest fragments) and every green gate wrote its own verdict and no other.` - off gates: steps changelog_body, register, ac_closure and workflow_parse are `skipped`, with empty logs. The split-layout jobs (manifest, fragments, changelog_body, register, ac_closure, workflow_parse, split result) are `skipped` in the run, but their commit statuses still read "pending, Has started running". tmux-tell's migration head `af77cf0` shows the same. `pr / gates (pull_request)` is success, and the combined commit state is success. `test` (run 304): server, client and client-nav all success.

claude reviewed 2026-10-05 21:53:16 +02:00

claude left a comment

• Copy link
• Copy Markdown

Verdict: APPROVE at df82f8f4af

Summary: cellblock's two gates move to one pr.yml at reusable-pr-gates.yml@v0.66.0, and release.yml moves from v0.42.0 with nothing it passes affected. The live run resolves, fetches and grades as designed. Nothing is blocking. One contributor-visible change is deliberate and should be known before merging: fragment coverage now runs on every PR.

Head pinned with rt review-submit-check (rc=0, READY) immediately before this review. Base c6d7a55 is cellblock's live main.

Job log (Axis C), read in the browser

Run 303, job 1, commit df82f8f4af:

• validate: layout=combined; on gates: manifest fragments.
• resolve: caller scan over 3 top-level workflow file(s), remote v0.66.0 .forgejo/workflows/pr.yml, resolved toolkit ref: v0.66.0 (source=baked), per-gate script: .release-toolkit/scripts/pr-gates.sh.
• replay: PASS - this head already contains origin/main at c6d7a55...
• bootstrap rt: FETCH published asset @ v0.66.0, minisign signature OK, signed for v0.66.0 (trusted comment matches), checksum OK (189ebf7f9a65...), rt 0.66.0.
• gates: manifest all checks passed; fragments fragment present: changelog.d/181.internal.md, coverage PASS and density PASS; steps 10-13 skipped; tree unchanged across every gate step (manifest fragments); attest every expected gate ran (manifest fragments).
• cost: Cache saved with key: rt-v0.66.0-linux-amd64, release-toolkit#1550.

Statuses: 12, combined success. pr / gates (pull_request) is success, and the split rows read "Has been skipped". test / server, client and client-nav are green (run 304).

Diff, verified at source

• pr.yml: branches: [main], types: [opened, synchronize, reopened, edited], no paths:, no secrets:, runs_on: go, layout: combined, manifest: 'on' and fragments: 'on'. Its pin matches release.yml's, as D6 requires.
• Both wrappers deleted. Each passed only runs_on: go. Every default fragment-check@v0.42.0 relied on is identical in pr-gates@v0.66.0: fragments_dir, valid_kinds, fragment_length_warn_chars 500, density true, and the five thresholds empty. So is manifest's config_path.
• The behaviour change. The old fragment-check.yml carried paths: ['changelog.d/**'], and reusable-changelog-fragment-check.yml@v0.42.0 had no coverage mode at all. Two things are therefore new for cellblock:
  • the fragment gate runs on every PR, not only on changelog.d/ changes (the ADR-0013 wiring rule);
  • it requires a fragment or a no-changelog: body line.
    The pr.yml header says so. Contributors will meet it on their next PR.
• release.yml: only the pin moves, plus an ASCII upgrade note. From v0.42.0 to v0.66.0, the inputs gain cut_gate and release_pr_reviewers, both optional; nothing was removed or became required, and the outputs were only added. publish_mode's default changed from 'draft' to 'immediate' at v0.43.0, but the file passes ${{ inputs.publish_mode || 'immediate' }} explicitly, unchanged. secrets: inherit stays (#806).
• No stale references: across cellblock's .md, .yml, .toml and .sh files at head, the old names survive only in pr.yml's header and the upgrade note.
• Protection, read live: enable_status_check: false.

Fragment kind

internal, a patch bump, is right if nothing changes for players. tmux-tell and ember used changed for the same move, because contributors see the replay. And for cellblock specifically, contributors also see the new every-PR coverage requirement. Both kinds are defensible; it is Alex's call.

After the merge (ADR-0013 D4)

pr / gates (pull_request) must post on cellblock's next rolling release PR before Alex turns checks on. cellblock is #806's repo, whose release PRs once got zero runs, so this precondition matters most here. The first push: main run also answers the org PAT's issue scope (#1484), which I cannot read from here.

Verdict: APPROVE at df82f8f4af19ee483008e177c7ffbfc82b98c1e5 Summary: cellblock's two gates move to one `pr.yml` at `reusable-pr-gates.yml@v0.66.0`, and `release.yml` moves from v0.42.0 with nothing it passes affected. The live run resolves, fetches and grades as designed. Nothing is blocking. One contributor-visible change is deliberate and should be known before merging: fragment coverage now runs on every PR. Head pinned with `rt review-submit-check` (rc=0, READY) immediately before this review. Base `c6d7a55` is cellblock's live `main`. ## Job log (Axis C), read in the browser Run 303, job 1, commit df82f8f4af: - **validate:** `layout=combined; on gates: manifest fragments`. - **resolve:** `caller scan over 3 top-level workflow file(s)`, `remote v0.66.0 .forgejo/workflows/pr.yml`, `resolved toolkit ref: v0.66.0 (source=baked)`, `per-gate script: .release-toolkit/scripts/pr-gates.sh`. - **replay:** `PASS - this head already contains origin/main at c6d7a55...` - **bootstrap rt:** `FETCH published asset @ v0.66.0`, `minisign signature OK`, `signed for v0.66.0 (trusted comment matches)`, `checksum OK (189ebf7f9a65...)`, `rt 0.66.0`. - **gates:** manifest `all checks passed`; fragments `fragment present: changelog.d/181.internal.md`, coverage PASS and density PASS; steps 10-13 `skipped`; `tree unchanged across every gate step (manifest fragments)`; attest `every expected gate ran (manifest fragments)`. - **cost:** `Cache saved with key: rt-v0.66.0-linux-amd64`, release-toolkit#1550. **Statuses:** 12, combined `success`. `pr / gates (pull_request)` is success, and the split rows read "Has been skipped". `test / server`, `client` and `client-nav` are green (run 304). ## Diff, verified at source - **`pr.yml`:** `branches: [main]`, `types: [opened, synchronize, reopened, edited]`, no `paths:`, no `secrets:`, `runs_on: go`, `layout: combined`, `manifest: 'on'` and `fragments: 'on'`. Its pin matches `release.yml`'s, as D6 requires. - **Both wrappers deleted.** Each passed only `runs_on: go`. Every default `fragment-check@v0.42.0` relied on is identical in pr-gates@v0.66.0: `fragments_dir`, `valid_kinds`, `fragment_length_warn_chars` 500, `density` true, and the five thresholds empty. So is manifest's `config_path`. - **The behaviour change.** The old `fragment-check.yml` carried `paths: ['changelog.d/**']`, and `reusable-changelog-fragment-check.yml@v0.42.0` had no coverage mode at all. Two things are therefore new for cellblock: - the fragment gate runs on every PR, not only on `changelog.d/` changes (the ADR-0013 wiring rule); - it requires a fragment or a `no-changelog:` body line. The `pr.yml` header says so. Contributors will meet it on their next PR. - **`release.yml`:** only the pin moves, plus an ASCII upgrade note. From v0.42.0 to v0.66.0, the inputs gain `cut_gate` and `release_pr_reviewers`, both optional; nothing was removed or became required, and the outputs were only added. `publish_mode`'s default changed from `'draft'` to `'immediate'` at v0.43.0, but the file passes `${{ inputs.publish_mode || 'immediate' }}` explicitly, unchanged. `secrets: inherit` stays (#806). - **No stale references:** across cellblock's `.md`, `.yml`, `.toml` and `.sh` files at head, the old names survive only in `pr.yml`'s header and the upgrade note. - **Protection, read live:** `enable_status_check: false`. ## Fragment kind `internal`, a patch bump, is right if nothing changes for players. tmux-tell and ember used `changed` for the same move, because contributors see the replay. And for cellblock specifically, contributors also see the new every-PR coverage requirement. Both kinds are defensible; it is Alex's call. ## After the merge (ADR-0013 D4) `pr / gates (pull_request)` must post on cellblock's next rolling release PR before Alex turns checks on. cellblock is #806's repo, whose release PRs once got zero runs, so this precondition matters most here. The first `push: main` run also answers the org PAT's issue scope (#1484), which I cannot read from here.

alex approved these changes 2026-10-05 21:56:02 +02:00

alex merged commit df82f8f4af into main 2026-10-05 21:56:07 +02:00

alex deleted branch claude/181-pr-gates-v0.66.0 2026-10-05 21:56:07 +02:00

claude referenced this pull request 2026-10-05 22:08:10 +02:00

chore(ci): move the release-toolkit PR gates into one pr.yml and bump the pin past the gate-removal cut #181

Sign in to join this conversation.

Reviewers

No reviewers

alex

Labels

Clear labels   

kind

chore

Maintenance, tooling, refactor

  

priority

low

Low priority, address when convenient

  

size

S

Small: simple change, ~1-2h

  

status

blocked

Cannot start until a named dependency resolves

No labels

kind

chore

priority

low

size

S

status

blocked

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

frankenbit/cellblock!182

No description provided.