fix(preflight): report branch protection read outcomes #1012

Merged

pullings merged 1 commit from i/914-preflight-input-diagnostics into main 2026-08-27 21:39:08 +02:00

Conversation 1 Commits 1 Files changed 6 +159 -10

carpenter commented 2026-08-27 21:29:21 +02:00

Owner

Copy link

Refs #914

This adds input-aware diagnostics to the branch-protection preflight:

• HTTP 404 is reported as no protection configured.
• HTTP 403 is reported as protection not visible to the authenticated identity.
• malformed responses, other API statuses, and transport failures retain distinct WARN diagnostics.
• repository, branch, and push identity are included in the diagnostic.

All outcomes remain fail-safe WARN + proceed; the change does not assert a cause for the historical v0.46.0 wrong-skip.

Verification:

• go test ./... -count=1
• go vet ./...
• go build ./...
• golangci-lint run ./... after a clean cache
• bats --print-output-on-failure tests/
• shellcheck and go run ./cmd/rt fragment-check changelog.d

Refs #914 This adds input-aware diagnostics to the branch-protection preflight: - HTTP 404 is reported as no protection configured. - HTTP 403 is reported as protection not visible to the authenticated identity. - malformed responses, other API statuses, and transport failures retain distinct WARN diagnostics. - repository, branch, and push identity are included in the diagnostic. All outcomes remain fail-safe `WARN + proceed`; the change does not assert a cause for the historical v0.46.0 wrong-skip. Verification: - `go test ./... -count=1` - `go vet ./...` - `go build ./...` - `golangci-lint run ./...` after a clean cache - `bats --print-output-on-failure tests/` - shellcheck and `go run ./cmd/rt fragment-check changelog.d`

carpenter added 1 commit 2026-08-27 21:29:21 +02:00

fix(preflight): explain branch protection read outcomes e3d61588af

pullings requested review from sentry 2026-08-27 21:30:55 +02:00

sentry approved these changes 2026-08-27 21:38:10 +02:00

sentry left a comment

Copy link

Reviewed exact head e3d61588af5f64b45a62d94f49523210e007149e against base df1e307c98276b1624db437c4e20fa0102305617.

APPROVED. The shared scalar reader preserves the existing sentinel contract: 404 remains ErrNotFound, strict 2xx shape failures remain ErrUnexpectedResponse, transport failures remain broad ErrAPI errors, and other non-2xx responses now retain their status in HTTPStatusError while unwrapping to ErrAPI. The preflight remains fail-safe WARN + proceed, while its diagnostics distinguish absent 404, hidden 403, decode/unreadable, other API status, and transport outcomes and include repo/branch/identity.

The controls cover each diagnostic with inverse assertions, exercise a real 403 through the client, and retain the dry-run GetReleaseByTag versus executing-read sentinel distinction. Exact-head local checks passed: go test ./... -count=1, go vet ./..., go build ./..., 118 Bats tests, fragment-check, and golangci-lint. Forgejo CI is 25/25 success at this head.

Reviewed exact head `e3d61588af5f64b45a62d94f49523210e007149e` against base `df1e307c98276b1624db437c4e20fa0102305617`. APPROVED. The shared scalar reader preserves the existing sentinel contract: 404 remains `ErrNotFound`, strict 2xx shape failures remain `ErrUnexpectedResponse`, transport failures remain broad `ErrAPI` errors, and other non-2xx responses now retain their status in `HTTPStatusError` while unwrapping to `ErrAPI`. The preflight remains fail-safe `WARN + proceed`, while its diagnostics distinguish absent 404, hidden 403, decode/unreadable, other API status, and transport outcomes and include repo/branch/identity. The controls cover each diagnostic with inverse assertions, exercise a real 403 through the client, and retain the dry-run `GetReleaseByTag` versus executing-read sentinel distinction. Exact-head local checks passed: `go test ./... -count=1`, `go vet ./...`, `go build ./...`, 118 Bats tests, fragment-check, and golangci-lint. Forgejo CI is 25/25 success at this head.

pullings merged commit e3d61588af into main 2026-08-27 21:39:08 +02:00

pullings deleted branch i/914-preflight-input-diagnostics 2026-08-27 21:39:09 +02:00

pullings referenced this pull request 2026-08-27 21:42:01 +02:00

bug(post-cut): the idempotent-skip decision is logged without the inputs it was made from #914

pullings referenced this pull request 2026-08-28 09:56:49 +02:00

bug(post-cut): the idempotent-skip decision is logged without the inputs it was made from #914

Sign in to join this conversation.

Reviewers

No reviewers

sentry

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!1012

No description provided.