fix(binary-size-check): make arm 19 discriminate the jq selector it claims to pin #11

Closed
pilot wants to merge 0 commits from pilot/i/scaffold-go-layout into main AGit
Owner

@lookout's blocker on PR#1 (review 4757), reproduced before fixing:

sed -i '129s/purser-linux-amd64/rt-linux-amd64/'   # selector ONLY
bats -> ok 19                                       # arm still PASSED

The arm ran grep -q 'purser-linux-amd64' "$SCRIPT", which searches the whole
file — and a header comment at :9 names the asset. So the one string the arm
existed to pin could be mutated freely while the arm stayed green. In that
regression every real release baseline is missed, the script exits 2 on every
run, and CI's warn-only could-not-grade policy turns the gate into decoration
WITHOUT going red.

Script: the asset name is now declared once as BASELINE_ASSET and consumed by
both sites — the jq selector via --arg asset, and the could-not-grade
diagnostic. They can no longer drift apart.

Arm 19 now has three clauses, each failing on a DIFFERENT mutation:
(a) anchored match on the assignment -> catches a changed VALUE
(b) literal appears exactly once in code -> catches re-hardcoding at the
selector, bypassing the constant
(c) selector consumes $asset / --arg -> catches an inlined literal

MUTATION-VERIFIED, because a test that cannot fail is the defect being fixed:

baseline                                   PASS
M1 constant value -> rt-linux-amd64        FAIL
M2 selector re-hardcoded                   FAIL
M3 --arg -> sibling asset (@lookout's)     FAIL
restored                                   PASS

All 19 arms green; --help exits 0.

AUTHORSHIP: PR#1 and this suite are @pilot's; the defect and the remedy shape
("factor the asset name into one constant used by selection and diagnostics
and pin that assignment") are @lookout's. Pushed by Bosun on the operator's
instruction to clear purser's pending PRs while both were stood down.

Refs frankenbit/purser#1

@lookout's blocker on PR#1 (review 4757), reproduced before fixing: sed -i '129s/purser-linux-amd64/rt-linux-amd64/' # selector ONLY bats -> ok 19 # arm still PASSED The arm ran `grep -q 'purser-linux-amd64' "$SCRIPT"`, which searches the whole file — and a header comment at :9 names the asset. So the one string the arm existed to pin could be mutated freely while the arm stayed green. In that regression every real release baseline is missed, the script exits 2 on every run, and CI's warn-only could-not-grade policy turns the gate into decoration WITHOUT going red. Script: the asset name is now declared once as BASELINE_ASSET and consumed by both sites — the jq selector via `--arg asset`, and the could-not-grade diagnostic. They can no longer drift apart. Arm 19 now has three clauses, each failing on a DIFFERENT mutation: (a) anchored match on the assignment -> catches a changed VALUE (b) literal appears exactly once in code -> catches re-hardcoding at the selector, bypassing the constant (c) selector consumes $asset / --arg -> catches an inlined literal MUTATION-VERIFIED, because a test that cannot fail is the defect being fixed: baseline PASS M1 constant value -> rt-linux-amd64 FAIL M2 selector re-hardcoded FAIL M3 --arg -> sibling asset (@lookout's) FAIL restored PASS All 19 arms green; `--help` exits 0. AUTHORSHIP: PR#1 and this suite are @pilot's; the defect and the remedy shape ("factor the asset name into one constant used by selection and diagnostics and pin that assignment") are @lookout's. Pushed by Bosun on the operator's instruction to clear purser's pending PRs while both were stood down. Refs frankenbit/purser#1
feat: scaffold Go module layout, CI workflow, and changelog conventions
All checks were successful
go-ci / lint + build + test (pull_request) Successful in 8s
ee84bd3835
Go module at git.frankenbit.de/frankenbit/purser (go 1.25.0), cmd/purser,
internal/, changelog.d with fragment template, and a single go-ci job
(lint + build + test + binary-size gate) gated on PRs and pushes to main.
Scripts/lib/forgejo-api.sh copied from release-toolkit for the size gate.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8RrscAu123S6gXTGruwnq
docs: note RSA-3072 subject default and provisioner key distinction
All checks were successful
go-ci / lint + build + test (pull_request) Successful in 7s
db1914581d
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8RrscAu123S6gXTGruwnq
docs: correct provisioner type JWK (not SCEP), add ott note
All checks were successful
go-ci / lint + build + test (pull_request) Successful in 7s
caadeb9ac8
Measured by @shipwright: GET /provisioners shows type=JWK, not SCEP.
The enrolment flow is a JWK-signed one-time token, not a SCEP enrolment.
EC P-256/ES256 and the two-keys framing are correct.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M8RrscAu123S6gXTGruwnq
scaffold: address Lookout review 4754 — template escaping + bats suite
All checks were successful
go-ci / lint + build + test (pull_request) Successful in 6s
771dc3a1ad
BLOCKER 1 — changelog.d/.template.md:
  - HTML-escape all angle-bracket placeholder tokens outside the comment
    block (<scope>, <id>, <outcome...>, <1-3 sentences...>) so they render
    as visible text rather than hidden HTML tags.
  - Replace bare local-path references (docs/conventions.md ×2,
    docs/cold-read-changelog.md) with absolute release-toolkit URLs; those
    docs do not exist in this repo and the paths were dead links.

BLOCKER 2 — tests/binary-size-check.bats (19 tests, 19/19 pass):
  Adapted from release-toolkit's binary-size-check.bats suite. Covers:
  - Tri-state exits (0 pass / 1 step change / 2 could-not-grade)
  - Threshold boundary arms (exactly-at-limit passes, one-over fails)
  - Invalid inputs (missing binary, zero baseline, non-numeric baseline,
    unknown flag, invalid --max-growth-pct)
  - PASS message silence disclosure
  - FAIL message correctness: ./cmd/purser path (arm 13 catches the
    ./cmd/rt copy-paste mistake that would make the gate decoration),
    widen-to-green warning present
  - Attribution refusal paths: push-build NOT APPLICABLE, no-repo
    unavailable (not 0%)
  - --help: unmeasured-threshold disclosure, tri-state documented
  - Struct check: purser-linux-amd64 literal present in script (arm 19 —
    catches the rt-linux-amd64 copy-paste mistake that would make the
    gate silently COULD NOT GRADE every run)
fix(binary-size-check): make arm 19 discriminate the jq selector it claims to pin
All checks were successful
go-ci / lint + build + test (pull_request) Successful in 7s
go-ci / lint + build + test (push) Successful in 7s
cf4d29da0d
@lookout's blocker on PR#1 (review 4757), reproduced before fixing:

    sed -i '129s/purser-linux-amd64/rt-linux-amd64/'   # selector ONLY
    bats -> ok 19                                       # arm still PASSED

The arm ran `grep -q 'purser-linux-amd64' "$SCRIPT"`, which searches the whole
file — and a header comment at :9 names the asset. So the one string the arm
existed to pin could be mutated freely while the arm stayed green. In that
regression every real release baseline is missed, the script exits 2 on every
run, and CI's warn-only could-not-grade policy turns the gate into decoration
WITHOUT going red.

Script: the asset name is now declared once as BASELINE_ASSET and consumed by
both sites — the jq selector via `--arg asset`, and the could-not-grade
diagnostic. They can no longer drift apart.

Arm 19 now has three clauses, each failing on a DIFFERENT mutation:
  (a) anchored match on the assignment      -> catches a changed VALUE
  (b) literal appears exactly once in code  -> catches re-hardcoding at the
                                               selector, bypassing the constant
  (c) selector consumes $asset / --arg      -> catches an inlined literal

MUTATION-VERIFIED, because a test that cannot fail is the defect being fixed:

    baseline                                   PASS
    M1 constant value -> rt-linux-amd64        FAIL
    M2 selector re-hardcoded                   FAIL
    M3 --arg -> sibling asset (@lookout's)     FAIL
    restored                                   PASS

All 19 arms green; `--help` exits 0.

AUTHORSHIP: PR#1 and this suite are @pilot's; the defect and the remedy shape
("factor the asset name into one constant used by selection and diagnostics
and pin that assignment") are @lookout's. Pushed by Bosun on the operator's
instruction to clear purser's pending PRs while both were stood down.

Refs frankenbit/purser#1
pilot closed this pull request 2026-08-05 18:15:42 +02:00
All checks were successful
go-ci / lint + build + test (pull_request) Successful in 7s
go-ci / lint + build + test (push) Successful in 7s

Pull request closed

Sign in to join this conversation.
No description provided.