chore(ci): run the release-toolkit PR gates from one pr.yml at v0.66.0 #64

Merged

alex merged 3 commits from claude/63-pr-gates-v0.66.0 into main 2026-10-05 23:51:40 +02:00

Conversation 3 Commits 3 Files changed 9 +73 -78

claude commented 2026-10-05 21:34:32 +02:00

Member

• Copy link
• Copy Markdown

Refs #63. Part of frankenbit/release-toolkit#1530.

This PR runs purser's three release-toolkit PR gates from one pr.yml, which calls reusable-pr-gates.yml@v0.66.0. It also moves release.yml to the same tag, up from v0.36.0.

It also fixes two changelog texts that v0.66.0's gates grade. One of them would otherwise turn every purser PR red. See "Changelog fixes" below.

What changes

• New: .forgejo/workflows/pr.yml. Its job id is gates, so the context is pr / gates (pull_request).
  • layout: combined, with manifest, fragments and changelog_body set to 'on'. register, ac_closure and workflow_parse stay at their default, off.
  • The pull_request types include edited, and there is no paths: filter (ADR-0013 D4, frankenbit/release-toolkit#644).
  • No secrets: line, because pr-gates needs none (C3).
• Deleted: manifest-check.yml, fragment-check.yml and changelog-body-check.yml.
• release.yml: the reusable-release.yml pin moves from @v0.36.0 to @v0.66.0. Its comment naming reusable-release.yml@v0.36.0 now names v0.66.0, which still has no build_command or asset_paths input, so attach-release-asset stays.
• release-toolkit.yml: the comment listing the workflow files is updated.
• Fragment: changelog.d/63.internal.md.
• Changelog fixes: two separate commits, described below.
• Branch protection is not touched. Per ADR-0013 D4, the operator adds pr / gates (pull_request) after it has posted on purser's rolling release PR.

Carry-forward from the old wrappers

Old wrapper	Input passed	Where it went in pr.yml
manifest-check.yml	runs_on: go	runs_on: go, manifest: 'on'
fragment-check.yml	runs_on: go, plus paths: ['changelog.d/**']	fragments: 'on'. The paths filter is dropped on purpose (D4). Coverage now runs on every PR.
changelog-body-check.yml	runs_on: go, plus paths: ['CHANGELOG.md']	changelog_body: 'on'. The paths filter is dropped on purpose (D4).

None of the three wrappers passed a density threshold, valid_kinds, fragments_dir, changelog_path or config_path. All of them ran on the defaults.

At v0.36.0, the fragment reusable had no density inputs. Only the body reusable had the five thresholds, all empty, which means rt's defaults: 30, 25, 2, 100 and 75. pr-gates has one set of five, also empty by default, and it feeds both fragments and changelog_body. So both gates still grade at rt's defaults. valid_kinds, fragments_dir, fragment_length_warn_chars (500), changelog_path and config_path keep the same defaults as before.

release.yml across v0.36.0 to v0.66.0

I diffed reusable-release.yml's on: workflow_call: block between the two tags.

• Inputs: 6 became 8. release_pr_reviewers and cut_gate were added, both optional. None was removed or renamed. The four that purser passes (runs_on, bump_override, dry_run, publish_mode) all still exist.
• One default changed: publish_mode went from 'draft' to 'immediate' at v0.43.0. I checked every tag in between. purser passes ${{ inputs.publish_mode || 'draft' }} explicitly, so it stays on draft, and that line is unchanged.
• Secrets: none are declared at either tag. purser uses secrets: inherit.
• Outputs: 6 became 12, and nothing was removed. attach-release-asset reads mode and cut_tag, and both still exist.
• The second toolkit reference in release.yml is the @v0.36.0 comment about build_command and asset_paths. The same file at v0.66.0 has neither input, so the comment still holds and now names v0.66.0.

I read every ### Upgrade and ### Removed section from v0.37.0 to v0.66.0. Only two of them had content: v0.38.0, where the bash gates were retired, and v0.43.0, where the Codeberg mirror was retired. Neither touches purser.

Behaviour changes that do reach purser, outside those sections:

• Fragments: a fragment's summary must carry an issue reference (v0.50.0). Every PR needs a fragment or a No-Changelog: line (v0.54.0). Density is graded and FAILs on a violation (v0.39.0).
• Landing tree: the gates grade the tree the PR would land on (v0.62.0).
• Credentials: the release job now grades the credential configuration and probes the PAT's issue scope (v0.64.0).
  • Since 2026-08-26, purser has inherited the org-level secret RELEASE_TOOLKIT_TOKEN.
  • purser's last push to main was 2026-08-17, so the next release run on this repo will be its first on that PAT.
  • The release.yml comment saying purser runs without RELEASE_TOOLKIT_TOKEN is therefore stale. I left it alone. This PR does not change it.
• Minisign: from v0.57.0, the release job fetches rt with a minisign check. RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY is set at org scope (/orgs/frankenbit/actions/variables) and is not overridden at repo scope.

Changelog fixes (operator chose this option)

CHANGELOG.md [0.4.0] (commit 624e35e). At v0.48.2, rt changelog-body-check check 5 went from Warn to Fail. Check 5 flags a section that mixes bullets and prose. The old body wrapper ran only on PRs that touched CHANGELOG.md. pr-gates runs the check on every PR, so every PR is graded against the newest block, [0.4.0]. That block failed:

FAIL: check 5 (style): mixed bullet+prose in section(s): Added (bullets=2 prose=8)

• The four prose lines were #18's entry, which landed without a bullet header.
• The fix adds a header taken from #18's commit subject. The two paragraphs become its indented body, with their wording unchanged.
• The precedent is 27a5d6b, which edited the same released section for the density gate.
• The toolkit side is tracked in frankenbit/release-toolkit#1551.

changelog.d/61.fixed.md (commit 2c29adc). One sentence ran past 30 words, and it is now split in two with the meaning unchanged.

• On a PR it was only a warning, because the fragment already existed (frankenbit/release-toolkit#735).
• I first wrote that it would halt the next cut. That was inferred from fragment-check's own message, and it does not hold. I ran rt prep --dry-run (v0.66.0) on the pre-fix tree, and its cut-time compose-verify mirror reported "clean". Since v0.48.0, a fragment contributes only its summary line to the composed section.
• So this fix tidies the fragment. It does not unblock anything.

Local re-run with rt built from v0.66.0 (b1a9578), on head 2c29adc:

• manifest: all checks passed.
• fragments: coverage PASS and density PASS, with 2 fragments graded and no findings.
• changelog_body: "passed with warnings". Checks 1 to 6 and 8 pass, including check 5. Check 7 warns on sentences of 28 and 30 words, and check 9 warns on an 88-word paragraph. Both warnings are below the failure line.
• rt prep --dry-run: "Cut-time changelog gates - clean". All ten lines PASS: register-check and checks 1 to 9, for the would-be v0.4.1.

Self-bootstrap note

This is not toolkit-self, so no re-pin is involved. purser gets each toolkit change from the tag it pins.

Review

@alex, please verify at source (release-toolkit AGENTS.md section 6):

• the job log of this PR's pr / gates run;
• the workflow_call diff above, at both tags.

🤖 Generated with Claude Code

Refs #63. Part of frankenbit/release-toolkit#1530. This PR runs purser's three release-toolkit PR gates from one `pr.yml`, which calls `reusable-pr-gates.yml@v0.66.0`. It also moves `release.yml` to the same tag, up from v0.36.0. It also fixes two changelog texts that v0.66.0's gates grade. One of them would otherwise turn every purser PR red. See "Changelog fixes" below. ## What changes - **New:** `.forgejo/workflows/pr.yml`. Its job id is `gates`, so the context is `pr / gates (pull_request)`. - `layout: combined`, with `manifest`, `fragments` and `changelog_body` set to `'on'`. `register`, `ac_closure` and `workflow_parse` stay at their default, off. - The `pull_request` types include `edited`, and there is no `paths:` filter (ADR-0013 D4, frankenbit/release-toolkit#644). - No `secrets:` line, because pr-gates needs none (C3). - **Deleted:** `manifest-check.yml`, `fragment-check.yml` and `changelog-body-check.yml`. - **`release.yml`:** the `reusable-release.yml` pin moves from `@v0.36.0` to `@v0.66.0`. Its comment naming `reusable-release.yml@v0.36.0` now names v0.66.0, which still has no `build_command` or `asset_paths` input, so `attach-release-asset` stays. - **`release-toolkit.yml`:** the comment listing the workflow files is updated. - **Fragment:** `changelog.d/63.internal.md`. - **Changelog fixes:** two separate commits, described below. - **Branch protection is not touched.** Per ADR-0013 D4, the operator adds `pr / gates (pull_request)` after it has posted on purser's rolling release PR. ## Carry-forward from the old wrappers | Old wrapper | Input passed | Where it went in `pr.yml` | |---|---|---| | `manifest-check.yml` | `runs_on: go` | `runs_on: go`, `manifest: 'on'` | | `fragment-check.yml` | `runs_on: go`, plus `paths: ['changelog.d/**']` | `fragments: 'on'`. The paths filter is dropped on purpose (D4). Coverage now runs on every PR. | | `changelog-body-check.yml` | `runs_on: go`, plus `paths: ['CHANGELOG.md']` | `changelog_body: 'on'`. The paths filter is dropped on purpose (D4). | None of the three wrappers passed a density threshold, `valid_kinds`, `fragments_dir`, `changelog_path` or `config_path`. All of them ran on the defaults. At v0.36.0, the fragment reusable had no density inputs. Only the body reusable had the five thresholds, all empty, which means rt's defaults: 30, 25, 2, 100 and 75. pr-gates has one set of five, also empty by default, and it feeds both `fragments` and `changelog_body`. So both gates still grade at rt's defaults. `valid_kinds`, `fragments_dir`, `fragment_length_warn_chars` (500), `changelog_path` and `config_path` keep the same defaults as before. ## `release.yml` across v0.36.0 to v0.66.0 I diffed `reusable-release.yml`'s `on: workflow_call:` block between the two tags. - **Inputs:** 6 became 8. `release_pr_reviewers` and `cut_gate` were added, both optional. None was removed or renamed. The four that purser passes (`runs_on`, `bump_override`, `dry_run`, `publish_mode`) all still exist. - **One default changed:** `publish_mode` went from `'draft'` to `'immediate'` at v0.43.0. I checked every tag in between. purser passes `${{ inputs.publish_mode || 'draft' }}` explicitly, so it stays on draft, and that line is unchanged. - **Secrets:** none are declared at either tag. purser uses `secrets: inherit`. - **Outputs:** 6 became 12, and nothing was removed. `attach-release-asset` reads `mode` and `cut_tag`, and both still exist. - **The second toolkit reference** in `release.yml` is the `@v0.36.0` comment about `build_command` and `asset_paths`. The same file at v0.66.0 has neither input, so the comment still holds and now names v0.66.0. I read every `### Upgrade` and `### Removed` section from v0.37.0 to v0.66.0. Only two of them had content: v0.38.0, where the bash gates were retired, and v0.43.0, where the Codeberg mirror was retired. Neither touches purser. Behaviour changes that do reach purser, outside those sections: - **Fragments:** a fragment's summary must carry an issue reference (v0.50.0). Every PR needs a fragment or a `No-Changelog:` line (v0.54.0). Density is graded and FAILs on a violation (v0.39.0). - **Landing tree:** the gates grade the tree the PR would land on (v0.62.0). - **Credentials:** the release job now grades the credential configuration and probes the PAT's issue scope (v0.64.0). - Since 2026-08-26, purser has inherited the org-level secret `RELEASE_TOOLKIT_TOKEN`. - purser's last push to main was 2026-08-17, so the next release run on this repo will be its first on that PAT. - The `release.yml` comment saying purser runs without `RELEASE_TOOLKIT_TOKEN` is therefore stale. I left it alone. This PR does not change it. - **Minisign:** from v0.57.0, the release job fetches `rt` with a minisign check. `RELEASE_TOOLKIT_MINISIGN_PUBLIC_KEY` is set at org scope (`/orgs/frankenbit/actions/variables`) and is not overridden at repo scope. ## Changelog fixes (operator chose this option) **`CHANGELOG.md` `[0.4.0]` (commit 624e35e).** At v0.48.2, `rt changelog-body-check` check 5 went from Warn to Fail. Check 5 flags a section that mixes bullets and prose. The old body wrapper ran only on PRs that touched `CHANGELOG.md`. pr-gates runs the check on every PR, so every PR is graded against the newest block, `[0.4.0]`. That block failed: ``` FAIL: check 5 (style): mixed bullet+prose in section(s): Added (bullets=2 prose=8) ``` - The four prose lines were #18's entry, which landed without a bullet header. - The fix adds a header taken from #18's commit subject. The two paragraphs become its indented body, with their wording unchanged. - The precedent is 27a5d6b, which edited the same released section for the density gate. - The toolkit side is tracked in frankenbit/release-toolkit#1551. **`changelog.d/61.fixed.md` (commit 2c29adc).** One sentence ran past 30 words, and it is now split in two with the meaning unchanged. - On a PR it was only a warning, because the fragment already existed (frankenbit/release-toolkit#735). - I first wrote that it would halt the next cut. That was inferred from fragment-check's own message, and it does not hold. I ran `rt prep --dry-run` (v0.66.0) on the pre-fix tree, and its cut-time `compose-verify` mirror reported "clean". Since v0.48.0, a fragment contributes only its summary line to the composed section. - So this fix tidies the fragment. It does not unblock anything. **Local re-run with `rt` built from v0.66.0 (b1a9578), on head 2c29adc:** - `manifest`: all checks passed. - `fragments`: coverage PASS and density PASS, with 2 fragments graded and no findings. - `changelog_body`: "passed with warnings". Checks 1 to 6 and 8 pass, including check 5. Check 7 warns on sentences of 28 and 30 words, and check 9 warns on an 88-word paragraph. Both warnings are below the failure line. - `rt prep --dry-run`: "Cut-time changelog gates - clean". All ten lines PASS: register-check and checks 1 to 9, for the would-be v0.4.1. ## Self-bootstrap note This is not toolkit-self, so no re-pin is involved. purser gets each toolkit change from the tag it pins. ## Review @alex, please verify at source (release-toolkit AGENTS.md section 6): - the job log of this PR's `pr / gates` run; - the `workflow_call` diff above, at both tags. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude added 1 commit 2026-10-05 21:34:32 +02:00

chore(ci): run the release-toolkit PR gates from one pr.yml at v0.66.0 ... eb36faf6ac

Replace manifest-check.yml, fragment-check.yml and changelog-body-check.yml
with one pr.yml that calls reusable-pr-gates.yml@v0.66.0, layout combined,
with manifest, fragments and changelog_body on. Every other gate stays off.

Bump release.yml's reusable-release.yml pin from v0.36.0 to v0.66.0. Every
input purser passes still exists. publish_mode's default changed to
immediate at v0.43.0, but purser passes draft explicitly, so it stays on
draft.

Refs #63

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude requested review from alex 2026-10-05 21:34:38 +02:00

claude commented 2026-10-05 21:46:23 +02:00

Author

Member

• Copy link
• Copy Markdown

HOLD: pushing two new commits (option A, the changelog fixes). The current head eb36faf6ac is superseded. I will post the new full head SHA when the push lands.

HOLD: pushing two new commits (option A, the changelog fixes). The current head eb36faf6aca8d0b98eb2271d62c2062f4593ec66 is superseded. I will post the new full head SHA when the push lands.

claude added 2 commits 2026-10-05 21:46:25 +02:00

docs(changelog): give #18's entry in the 0.4.0 section its bullet header ... 624e35e27b

The four prose paragraphs under [0.4.0] ### Added were #18's entry, landed
without a bullet header. release-toolkit's changelog-body-check fails the
section for mixing bullets and prose (check 5, a failure since v0.48.2), and
pr-gates at v0.66.0 grades the newest block on every PR, so every purser PR
would be red until the next cut.

Reformat only: the header is #18's commit subject, and the two paragraphs
become its indented body with their wording unchanged. Same precedent as
27a5d6b, which edited this released section for the density gate.

Refs #63, frankenbit/release-toolkit#1551

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs(changelog): split the over-long sentence in 61.fixed.md ... 2c29adcf57

One sentence ran past release-toolkit's 30-word density ceiling. As a
pre-existing fragment it only warns on a PR, but it would halt the next
cut. Split in two, meaning unchanged.

Refs #63

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude commented 2026-10-05 21:46:51 +02:00

Author

Member

• Copy link
• Copy Markdown

New head: 2c29adcf57 (eb36faf plus 624e35e and 2c29adc, the changelog fixes). HOLD lifted. The PR body is updated: the decision is resolved, the toolkit side is frankenbit/release-toolkit#1551, and the claim about 61.fixed.md at cut time is corrected.

New head: 2c29adcf57bbaa14d840bff5b7e3ab8e34ddbd3c (eb36faf plus 624e35e and 2c29adc, the changelog fixes). HOLD lifted. The PR body is updated: the decision is resolved, the toolkit side is frankenbit/release-toolkit#1551, and the claim about 61.fixed.md at cut time is corrected.

claude reviewed 2026-10-05 22:01:37 +02:00

claude left a comment

• Copy link
• Copy Markdown

Verdict: APPROVE at 2c29adcf57

Summary: purser's three gates move to one pr.yml at reusable-pr-gates.yml@v0.66.0, and release.yml moves from v0.36.0, the longest jump, with nothing it passes or reads affected. The two option-A commits are needed, and 624e35e preserves the released text word for word. Nothing is blocking. Two items are for the record: one commit message makes a claim already measured false, and the gates now run on every PR.

Head pinned with rt review-submit-check (rc=0, READY) immediately before this review. Base 41cd0d3 is purser's live main. Three commits, all authored as Alexander Saratow.

Job logs (Axis C), read in the browser

Runs 270 and 271, job 1, both at commit 2c29adcf57:

• validate: layout=combined; on gates: manifest fragments changelog_body.
• resolve: caller scan over 4 top-level workflow file(s), remote v0.66.0 .forgejo/workflows/pr.yml, resolved toolkit ref: v0.66.0 (source=baked), per-gate script: .release-toolkit/scripts/pr-gates.sh.
• replay: PASS - this head already contains origin/main at 41cd0d3...
• bootstrap rt: Cache restored from key: rt-v0.66.0-linux-amd64 (the runner's cache is shared across repos), then minisign signature OK, signed for v0.66.0 (trusted comment matches), cache hit ... verifying restored binary, checksum OK (189ebf7f9a65...). Because the restored binary is re-verified against the signed checksum, a cache shared between repos cannot hand purser a different binary.
• gates:
  • manifest: all checks passed;
  • fragments: present: changelog.d/61.fixed.md, changelog.d/63.internal.md, coverage PASS and density PASS;
  • changelog_body: PASS: check 5 (style): all sections consistent, then passed with warnings (check 7 and check 9 WARNs);
  • register, ac_closure and workflow_parse: skipped;
  • tree unchanged; attest every expected gate ran (manifest fragments changelog_body).

Statuses: 10, combined success, including go-ci / lint + build + test and pr / gates (pull_request).

The option-A commits, with a live discriminator

At eb36faf, before them, run 268 job 1 logs:

• changelog_body: FAIL: check 5 (style): mixed bullet+prose in section(s): Added (bullets=2 prose=8) and changelog-body-check: FAILED;
• fragments: FAIL: pre-existing fragment: 61.fixed.md → check 7 (sentence length) ... exceed 30 words, non-blocking on a PR.

At head, check 5 passes and 61.fixed.md grades clean. So:

• 624e35e is required. Without it, every purser PR is red until the next cut, because pr-gates grades the newest block on every PR.
• It is a content-preserving reformat. I compared the removed lines with the added body: the words are identical once indentation is normalised, and every body line is indented two spaces. The new header - **dashboard**: choose a certificate's expiry at issue time (#18) is #18's commit subject (9f99148). Nit: the message says "four prose paragraphs"; the diff moves two.
• 2c29adc splits one sentence, ... until publication. So the step could never run in draft mode, the default for push events., with its meaning unchanged.
  • For the record: its commit message says the sentence "would halt the next cut". The rt prep --dry-run on the pre-fix tree reported clean, because fragments contribute only their summary line, so that claim is false (release-toolkit#1551, comment 115255). It is tidy-up only. The message cannot be amended here (no force-push), so this review records the correction.

release.yml: v0.36.0 to v0.66.0, verified independently

• Inputs go from 6 to 8: cut_gate and release_pr_reviewers were added, both optional. Nothing was removed or became required, and there are no declared secrets.
• Outputs go from 6 to 12, added only. mode (v0.66.0 line 124) and cut_tag (line 136), which attach-release-asset reads, still exist.
• publish_mode's default changed from 'draft' to 'immediate' at v0.43.0. purser passes ${{ inputs.publish_mode || 'draft' }} explicitly, unchanged, so cuts stay drafts and the asset job still attaches before publication.
• The second toolkit reference is the build_command/asset_paths comment, now naming v0.66.0. It is accurate: neither input exists at v0.66.0.

Carry-forward and behaviour change

• Defaults: the three wrappers passed only runs_on: go. config_path, fragments_dir, valid_kinds, fragment_length_warn_chars and changelog_path keep identical defaults at v0.66.0, and changelog_body's five thresholds stay empty (rt defaults).

• Behaviour change. Every old wrapper except manifest carried a paths: filter (changelog.d/** and CHANGELOG.md). fragment-check@v0.36.0 also had no coverage or density input. So three things are new on every purser PR:

  • fragment coverage (a fragment or a no-changelog: line);
  • fragment density;
  • a Cold-Read lint of the newest CHANGELOG block.

  That is the ADR-0013 wiring rule, and option A exists because of it. It is worth stating to contributors; 63.internal.md says it.

• pr.yml: edited is in the types, there is no paths: and no secrets:, the pin matches release.yml's (D6), and the on/off values are quoted.

• Protection, read live: enable_status_check: false.

Follow-ups, not this PR

• The stale release.yml comment saying purser runs without the org token.
• RELEASE_PR_REVIEWERS=lookout is unused.
• The org PAT's issue scope (#1484) shows on the first push: main run.

After the merge (ADR-0013 D4)

pr / gates (pull_request) must post on purser's next rolling release PR before Alex turns checks on. The prep PR is the one whose whole content is CHANGELOG.md (purser#41), and changelog_body now grades it at PR time.

Verdict: APPROVE at 2c29adcf57bbaa14d840bff5b7e3ab8e34ddbd3c Summary: purser's three gates move to one `pr.yml` at `reusable-pr-gates.yml@v0.66.0`, and `release.yml` moves from v0.36.0, the longest jump, with nothing it passes or reads affected. The two option-A commits are needed, and 624e35e preserves the released text word for word. Nothing is blocking. Two items are for the record: one commit message makes a claim already measured false, and the gates now run on every PR. Head pinned with `rt review-submit-check` (rc=0, READY) immediately before this review. Base `41cd0d3` is purser's live `main`. Three commits, all authored as Alexander Saratow. ## Job logs (Axis C), read in the browser Runs 270 and 271, job 1, both at commit 2c29adcf57: - **validate:** `layout=combined; on gates: manifest fragments changelog_body`. - **resolve:** `caller scan over 4 top-level workflow file(s)`, `remote v0.66.0 .forgejo/workflows/pr.yml`, `resolved toolkit ref: v0.66.0 (source=baked)`, `per-gate script: .release-toolkit/scripts/pr-gates.sh`. - **replay:** `PASS - this head already contains origin/main at 41cd0d3...` - **bootstrap rt:** `Cache restored from key: rt-v0.66.0-linux-amd64` (the runner's cache is shared across repos), then `minisign signature OK`, `signed for v0.66.0 (trusted comment matches)`, `cache hit ... verifying restored binary`, `checksum OK (189ebf7f9a65...)`. Because the restored binary is re-verified against the signed checksum, a cache shared between repos cannot hand purser a different binary. - **gates:** - manifest: `all checks passed`; - fragments: `present: changelog.d/61.fixed.md, changelog.d/63.internal.md`, coverage PASS and density PASS; - changelog_body: `PASS: check 5 (style): all sections consistent`, then `passed with warnings` (check 7 and check 9 WARNs); - register, ac_closure and workflow_parse: `skipped`; - tree unchanged; attest `every expected gate ran (manifest fragments changelog_body)`. **Statuses:** 10, combined `success`, including `go-ci / lint + build + test` and `pr / gates (pull_request)`. ## The option-A commits, with a live discriminator At `eb36faf`, before them, run 268 job 1 logs: - changelog_body: `FAIL: check 5 (style): mixed bullet+prose in section(s): Added (bullets=2 prose=8)` and `changelog-body-check: FAILED`; - fragments: `FAIL: pre-existing fragment: 61.fixed.md → check 7 (sentence length) ... exceed 30 words`, non-blocking on a PR. At head, check 5 passes and 61.fixed.md grades clean. So: - **624e35e is required.** Without it, every purser PR is red until the next cut, because pr-gates grades the newest block on every PR. - **It is a content-preserving reformat.** I compared the removed lines with the added body: the words are identical once indentation is normalised, and every body line is indented two spaces. The new header `- **dashboard**: choose a certificate's expiry at issue time (#18)` is #18's commit subject (`9f99148`). Nit: the message says "four prose paragraphs"; the diff moves two. - **2c29adc** splits one sentence, `... until publication. So the step could never run in draft mode, the default for push events.`, with its meaning unchanged. - **For the record:** its commit message says the sentence "would halt the next cut". The `rt prep --dry-run` on the pre-fix tree reported clean, because fragments contribute only their summary line, so that claim is false (release-toolkit#1551, comment 115255). It is tidy-up only. The message cannot be amended here (no force-push), so this review records the correction. ## `release.yml`: v0.36.0 to v0.66.0, verified independently - **Inputs** go from 6 to 8: `cut_gate` and `release_pr_reviewers` were added, both optional. Nothing was removed or became required, and there are no declared secrets. - **Outputs** go from 6 to 12, added only. `mode` (v0.66.0 line 124) and `cut_tag` (line 136), which `attach-release-asset` reads, still exist. - **`publish_mode`'s default changed from `'draft'` to `'immediate'` at v0.43.0.** purser passes `${{ inputs.publish_mode || 'draft' }}` explicitly, unchanged, so cuts stay drafts and the asset job still attaches before publication. - **The second toolkit reference** is the `build_command`/`asset_paths` comment, now naming v0.66.0. It is accurate: neither input exists at v0.66.0. ## Carry-forward and behaviour change - **Defaults:** the three wrappers passed only `runs_on: go`. `config_path`, `fragments_dir`, `valid_kinds`, `fragment_length_warn_chars` and `changelog_path` keep identical defaults at v0.66.0, and changelog_body's five thresholds stay empty (rt defaults). - **Behaviour change.** Every old wrapper except manifest carried a `paths:` filter (`changelog.d/**` and `CHANGELOG.md`). `fragment-check@v0.36.0` also had no coverage or density input. So three things are new on every purser PR: - fragment coverage (a fragment or a `no-changelog:` line); - fragment density; - a Cold-Read lint of the newest CHANGELOG block. That is the ADR-0013 wiring rule, and option A exists because of it. It is worth stating to contributors; `63.internal.md` says it. - **`pr.yml`:** `edited` is in the types, there is no `paths:` and no `secrets:`, the pin matches `release.yml`'s (D6), and the on/off values are quoted. - **Protection, read live:** `enable_status_check: false`. ## Follow-ups, not this PR - The stale `release.yml` comment saying purser runs without the org token. - `RELEASE_PR_REVIEWERS=lookout` is unused. - The org PAT's issue scope (#1484) shows on the first `push: main` run. ## After the merge (ADR-0013 D4) `pr / gates (pull_request)` must post on purser's next rolling release PR before Alex turns checks on. The prep PR is the one whose whole content is CHANGELOG.md (purser#41), and changelog_body now grades it at PR time.

alex merged commit 2c29adcf57 into main 2026-10-05 23:51:40 +02:00

alex deleted branch claude/63-pr-gates-v0.66.0 2026-10-05 23:51:40 +02:00

claude referenced this pull request 2026-10-05 23:59:19 +02:00

chore(ci): move the release-toolkit PR gates into one pr.yml and bump the pin past the gate-removal cut #63

Sign in to join this conversation.

Reviewers

No reviewers

alex

Labels

Clear labels   

kind/bug

  

kind/chore

  

kind/docs

  

kind/feature

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

  

status/blocked

Cannot start until a named dependency resolves

  

status/deferred

Deferred — not in active sprint scope; recorded for future consideration

No labels

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

status/blocked

status/deferred

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

frankenbit/purser!64

No description provided.