chore(ci): move the release-toolkit PR gates into one pr.yml and bump the pin past the gate-removal cut #63

New issue

Open

opened 2026-10-04 10:54:48 +02:00 by claude · 0 comments

claude commented

2026-10-04 10:54:48 +02:00

Member

Part of frankenbit/release-toolkit#1530. Waits for both of these:

v0.66.0, the first release-toolkit tag with reusable-pr-gates.yml (rolling PR frankenbit/release-toolkit#1549);
tmux-tell's migration, whose job log is read first.

Now (read at `41cd0d3`, 2026-10-04)

Workflow	Calls	Pin
`release.yml`	`reusable-release.yml`	`@v0.36.0`
`manifest-check.yml`	`reusable-manifest-check.yml`	`@v0.36.0`
`fragment-check.yml`	`reusable-changelog-fragment-check.yml`	`@v0.36.0`
`changelog-body-check.yml`	`reusable-changelog-body-check.yml`	`@v0.36.0`

main requires no status today.

Why

release-toolkit's CI runner has one slot, shared by every repo. Purser runs three gate jobs per PR today. The toolkit is replacing its single-gate reusables with one reusable-pr-gates.yml that runs every gate in one job. Tags from before the removal keep working, so nothing here breaks until the pin moves.

The jump crosses v0.57.0. From that version, rt is fetched with a minisign check, and the repo needs the public key (frankenbit/release-toolkit#1479). It is the longest jump of the five adopters, so read the toolkit's changelog from v0.36.0 onward for other changes, especially ### Upgrade.

Migrating also turns on the landing-tree replay (frankenbit/release-toolkit#1548). The gates then grade what would land on main, not just the PR head. A PR whose branch no longer applies cleanly goes red with "rebase locally".

Acceptance criteria

RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY is set for the repo before the pin moves (frankenbit/release-toolkit#1479). — DONE @ #64 (2c29adc, reviewed as 2c29adc, review 7253). It is set at the frankenbit org scope (key id D11C3791DB75C907). The PR run logged minisign signature OK (1 trusted key(s) available).
manifest-check.yml, fragment-check.yml and changelog-body-check.yml are deleted. A new pr.yml calls reusable-pr-gates.yml at v0.66.0 or later with layout: combined, with manifest, fragments and changelog body on and every other gate off. — DONE @ #64 (2c29adc, reviewed as 2c29adc, review 7253).
pr.yml follows ADR-0013's wiring rule: its pull_request types include edited, and it has no paths: filter (frankenbit/release-toolkit#644). — DONE @ #64 (2c29adc, reviewed as 2c29adc, review 7253).
main requires pr.yml's caller status, which is the status of the job in pr.yml that calls reusable-pr-gates.yml (frankenbit/release-toolkit ADR-0013 D3 and D4). A pr.yml that fails to parse then blocks merges instead of passing silently.
- The required context is added only after it has posted on this repo's rolling release PR (frankenbit/release-toolkit#809).
- This is an admin edit by the operator.
release.yml is pinned to the same tag. — DONE @ #64 (2c29adc, reviewed as 2c29adc, review 7253). Its first push run, 273, resolved v0.66.0 from the baked value, FETCHed and verified rt, and passed the PAT scope check (issue scope: PASS, user scope: PASS as release-bot).
On the first PR after the move, the pr job's log is read, not just its status. It must show all three gates ran and the attest step passed. — DONE @ #64 (2c29adc, reviewed as 2c29adc, review 7253). Run 270 job 1, read in the built-in browser by the implementer and the reviewer: resolved toolkit ref: v0.66.0 (source=baked), FETCH, minisign and trusted comment OK, checksum OK (189ebf7f…), replay PASS, every on gate passed, the off gates were skipped, the tree was unchanged, and attest passed.
The first cut after the move succeeds.

Part of frankenbit/release-toolkit#1530. Waits for both of these: - v0.66.0, the first release-toolkit tag with `reusable-pr-gates.yml` (rolling PR frankenbit/release-toolkit#1549); - tmux-tell's migration, whose job log is read first. ## Now (read at `41cd0d3`, 2026-10-04) | Workflow | Calls | Pin | |---|---|---| | `release.yml` | `reusable-release.yml` | `@v0.36.0` | | `manifest-check.yml` | `reusable-manifest-check.yml` | `@v0.36.0` | | `fragment-check.yml` | `reusable-changelog-fragment-check.yml` | `@v0.36.0` | | `changelog-body-check.yml` | `reusable-changelog-body-check.yml` | `@v0.36.0` | `main` requires no status today. ## Why release-toolkit's CI runner has one slot, shared by every repo. Purser runs three gate jobs per PR today. The toolkit is replacing its single-gate reusables with one `reusable-pr-gates.yml` that runs every gate in one job. Tags from before the removal keep working, so nothing here breaks until the pin moves. **The jump crosses v0.57.0.** From that version, `rt` is fetched with a minisign check, and the repo needs the public key (frankenbit/release-toolkit#1479). It is the longest jump of the five adopters, so read the toolkit's changelog from v0.36.0 onward for other changes, especially `### Upgrade`. **Migrating also turns on the landing-tree replay** (frankenbit/release-toolkit#1548). The gates then grade what would land on `main`, not just the PR head. A PR whose branch no longer applies cleanly goes red with "rebase locally". ## Acceptance criteria - [x] `RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY` is set for the repo before the pin moves (frankenbit/release-toolkit#1479). — DONE @ #64 (`2c29adc`, reviewed as `2c29adc`, review 7253). It is set at the frankenbit org scope (key id `D11C3791DB75C907`). The PR run logged `minisign signature OK (1 trusted key(s) available)`. - [x] `manifest-check.yml`, `fragment-check.yml` and `changelog-body-check.yml` are deleted. A new `pr.yml` calls `reusable-pr-gates.yml` at `v0.66.0` or later with `layout: combined`, with manifest, fragments and changelog body `on` and every other gate `off`. — DONE @ #64 (`2c29adc`, reviewed as `2c29adc`, review 7253). - [x] `pr.yml` follows ADR-0013's wiring rule: its `pull_request` types include `edited`, and it has no `paths:` filter (frankenbit/release-toolkit#644). — DONE @ #64 (`2c29adc`, reviewed as `2c29adc`, review 7253). - [ ] `main` requires `pr.yml`'s caller status, which is the status of the job in `pr.yml` that calls `reusable-pr-gates.yml` (frankenbit/release-toolkit ADR-0013 D3 and D4). A `pr.yml` that fails to parse then blocks merges instead of passing silently. - The required context is added only after it has posted on this repo's rolling release PR (frankenbit/release-toolkit#809). - This is an admin edit by the operator. - [x] `release.yml` is pinned to the same tag. — DONE @ #64 (`2c29adc`, reviewed as `2c29adc`, review 7253). Its first push run, 273, resolved `v0.66.0` from the baked value, FETCHed and verified `rt`, and passed the PAT scope check (`issue scope: PASS`, `user scope: PASS` as release-bot). - [x] On the first PR after the move, the `pr` job's log is read, not just its status. It must show all three gates ran and the attest step passed. — DONE @ #64 (`2c29adc`, reviewed as `2c29adc`, review 7253). Run 270 job 1, read in the built-in browser by the implementer and the reviewer: `resolved toolkit ref: v0.66.0 (source=baked)`, FETCH, minisign and trusted comment OK, `checksum OK (189ebf7f…)`, replay PASS, every on gate passed, the off gates were skipped, the tree was unchanged, and attest passed. - [ ] The first cut after the move succeeds.

claude added the

labels

2026-10-04 10:54:48 +02:00

claude referenced this issue from frankenbit/release-toolkit

2026-10-04 10:56:53 +02:00

chore(ci): one PR-gates reusable and fewer toolkit-self jobs, because the runner is down to one slot (#1304's hold condition) #1530

claude removed the

status/blocked