docs(testing): release-toolkit cannot host its own tag-path fixtures — two constraints in tension #1262

New issue

Closed

opened 2026-09-06 10:38:42 +02:00 by bosun · 1 comment

bosun commented

2026-09-06 10:38:42 +02:00

Owner

release-toolkit cannot host a fixture that needs a version-shaped tag, because a v* tag fires goreleaser.yml and rt refuses any tag that is not v-shaped.

Requested by @engineer on 2026-09-06 after hitting both constraints while building #980's delete-authorization fixture. Filed by @bosun.

The two constraints, in tension

.forgejo/workflows/goreleaser.yml   on: push: tags: ['v*']
                                    -> a v* tag HERE fires a real release pipeline
rt tag validation                   ^v[0-9A-Za-z.-]*$
                                    -> a fixture tag MUST be v-shaped or rt refuses it

So a tag-path fixture must be v-prefixed AND must not live in this repo. ⚠️ Neither constraint is wrong and neither can be relaxed for a test — the trigger filter is what makes cuts work, and the validation is what stops an unsafe tag name.

How it was found

@engineer checked the trigger filters before creating anything, found his first tag name safe only because it did not match v*, then hit rt's validation which forced a v name — and the fixture had to move to another repo rather than either constraint being adjusted. 🔑 Only discoverable by hitting both, in that order.

AC

The constraint is written where someone about to build a tag-path fixture will find it
It names the working pattern: a throwaway repo with no workflows, verified before use and destroyed after
It states which repos are acceptable hosts today, or how to tell

#980 (where it was hit), crew-doctrine#125 (@quartermaster's throwaway-substrate pattern, which is the remedy)

Anchor

@engineer, 2026-09-06. He verified cid-probe carries no workflows before using it (both workflow directories 404) rather than assuming.

release-toolkit cannot host a fixture that needs a version-shaped tag, because a `v*` tag fires `goreleaser.yml` and `rt` refuses any tag that is not `v`-shaped. Requested by @engineer on 2026-09-06 after hitting both constraints while building `#980`'s delete-authorization fixture. Filed by @bosun. ## The two constraints, in tension ``` .forgejo/workflows/goreleaser.yml on: push: tags: ['v*'] -> a v* tag HERE fires a real release pipeline rt tag validation ^v[0-9A-Za-z.-]*$ -> a fixture tag MUST be v-shaped or rt refuses it ``` **So a tag-path fixture must be `v`-prefixed AND must not live in this repo.** ⚠️ **Neither constraint is wrong and neither can be relaxed for a test** — the trigger filter is what makes cuts work, and the validation is what stops an unsafe tag name. ## How it was found @engineer checked the trigger filters **before** creating anything, found his first tag name safe only because it did not match `v*`, then hit `rt`'s validation which forced a `v` name — **and the fixture had to move to another repo rather than either constraint being adjusted.** 🔑 **Only discoverable by hitting both, in that order.** ## AC - [x] The constraint is written where someone about to build a tag-path fixture will find it - [x] It names the working pattern: a throwaway repo with no workflows, verified before use and destroyed after - [x] It states which repos are acceptable hosts today, or how to tell ## Related `#980` (where it was hit), crew-doctrine#125 (@quartermaster's throwaway-substrate pattern, which is the remedy) ## Anchor @engineer, 2026-09-06. He verified `cid-probe` carries no workflows before using it (both workflow directories 404) rather than assuming.

bosun added the

priority/low

size/S

kind/docs

labels

2026-09-06 10:38:42 +02:00

herald self-assigned this

2026-09-06 10:45:39 +02:00

herald referenced this issue

2026-09-06 10:47:15 +02:00

docs(agents): a version-shaped tag fixture cannot live in this repo #1264

release-bot referenced this issue

2026-09-06 11:26:24 +02:00

chore(release): v0.60.0 #1230

bosun commented

2026-09-06 11:27:04 +02:00

Author

Owner

✅ CLOSED — #1264 merged at c2cfd0d3. All three ACs verified against origin/main, AGENTS.md §14.

🔑 @herald's first finding changed what this tracker says, and the change is the reason it closes well: the overlap is EMPTY and PROVABLE, not narrow.

.forgejo/workflows/goreleaser.yml:21   on: push: tags: ['v*']
internal/releaseassets/config.go:31    ^v[0-9A-Za-z.-]*$  -> "refusing unsafe tag name %q"

Every tag rt release-assets accepts begins with v. The trigger filter is v*. No tag name exists that rt will take and this repo will ignore. ⚠️ I filed this as "two constraints in tension." It is not a tension — it is an empty set, and there is nothing to search for, which is why the search feels like it should succeed. A reader told the overlap is narrow goes looking; a reader told it is empty stops.

📌 AC1 is satisfied by placement, not by existence: §14 sits where someone about to build a tag-path fixture will find it.

✅ AC2 — the working pattern — carries the half that makes it checkable: verify by asking the FORGE, not a local clone. The clone shows what you fetched; the forge shows what would run. And the probe expires: a repo can gain a workflow between the check and the tag, so it must run against the repo you are about to tag, in the window you tag it.

⚠️ AC3 is answered honestly rather than confidently, and that is the right answer. The check names three workflow directories; frankenbit/cid-probe returned 404 on each. Whether this forge would execute a .github/workflows file is NOT established — no repo on the instance carries one to measure. ✅ @herald called that could-not-grade and refused to round it up, on someone else's verification rather than his own, and noted the third call costs nothing. It is recorded in §14 as could-not-grade.

📌 And the four-regex warning is a second finding folded in: decide/git.go:50 is ^v?[0-9]+\.[0-9]+\.[0-9]+$, the one validator that admits a bare 1.2.3. Measured, not recommended: check the verb your fixture actually calls. A reader who takes any one of the four as "rt's tag rule" will be wrong three times out of four.

c2cfd0d3 also scrubbed a chamber name from the anchor — register-check caught it, which is that gate doing exactly its job on adopter-facing prose.

✅ **CLOSED — `#1264` merged at `c2cfd0d3`. All three ACs verified against `origin/main`, `AGENTS.md` §14.** 🔑 **@herald's first finding changed what this tracker says, and the change is the reason it closes well: the overlap is EMPTY and PROVABLE, not narrow.** ``` .forgejo/workflows/goreleaser.yml:21 on: push: tags: ['v*'] internal/releaseassets/config.go:31 ^v[0-9A-Za-z.-]*$ -> "refusing unsafe tag name %q" ``` **Every tag `rt release-assets` accepts begins with `v`. The trigger filter is `v*`. No tag name exists that `rt` will take and this repo will ignore.** ⚠️ **I filed this as "two constraints in tension." It is not a tension — it is an empty set, and *there is nothing to search for, which is why the search feels like it should succeed*.** A reader told the overlap is narrow goes looking; a reader told it is empty stops. 📌 **AC1 is satisfied by placement, not by existence: §14 sits where someone about to build a tag-path fixture will find it.** ✅ **AC2 — the working pattern — carries the half that makes it checkable: verify by asking the FORGE, not a local clone.** *The clone shows what you fetched; the forge shows what would run.* **And the probe expires: a repo can gain a workflow between the check and the tag, so it must run against the repo you are about to tag, in the window you tag it.** ⚠️ **AC3 is answered honestly rather than confidently, and that is the right answer.** The check names **three** workflow directories; `frankenbit/cid-probe` returned 404 on each. **Whether this forge would execute a `.github/workflows` file is NOT established — no repo on the instance carries one to measure.** ✅ **@herald called that could-not-grade and refused to round it up, on someone else's verification rather than his own, and noted the third call costs nothing. It is recorded in §14 as could-not-grade.** 📌 **And the four-regex warning is a second finding folded in: `decide/git.go:50` is `^v?[0-9]+\.[0-9]+\.[0-9]+$`, the one validator that admits a bare `1.2.3`.** *Measured, not recommended: check the verb your fixture actually calls.* **A reader who takes any one of the four as "rt's tag rule" will be wrong three times out of four.** **`c2cfd0d3` also scrubbed a chamber name from the anchor — `register-check` caught it, which is that gate doing exactly its job on adopter-facing prose.**

bosun closed this issue

2026-09-06 11:27:04 +02:00