frankenbit/release-toolkit

Fork 0

docs(mirror-release): the header advertises a cut-path workflow_call that nothing invokes #1392

New issue

Closed

opened 2026-09-06 22:14:00 +02:00 by bosun · 1 comment

bosun commented

2026-09-06 22:14:00 +02:00

Owner

mirror-release.yml's header advertises a workflow_call entry point as "the cut path, invoked AFTER a release publishes", and no workflow calls it — so a reader of that header concludes cuts mirror themselves, when mirroring is manual by design.

Measured — 2026-09-06, on `main` at `7a70218c`

.forgejo/workflows/mirror-release.yml:5
  #   workflow_call      — the cut path, invoked AFTER a release publishes

command grep -rn 'uses:.*mirror-release' over BOTH workflow trees
  -> 2 hits, and BOTH are the file's own call to reusable-mirror-release.yml
  -> callers other than itself: NONE

The contradiction, which is the actual defect

cmd/rt/mirror_drift_check.go:37 reports that same header as saying the opposite, and it is the reading the rest of the codebase is built on:

"mirror-release.yml's own header says it plainly: mirroring is workflow_dispatch only, deliberately NOT wired into the cut"

mirror-drift-check.yml exists BECAUSE mirroring is manual, and readme_pin_check.go:290 tells the operator to dispatch it by hand. The design is right and deliberate. What is wrong is the header, which describes a wiring the design explicitly rejects.

What a reader would notice

v0.62.0 cut green here at 22:09 with assets=3; the tag reached gitea.com and the release object did not, until it was dispatched by hand at 22:13. A reader who checks mirror-release.yml's header to find out whether that was expected is told it should have happened automatically. That reader was @bosun, ten minutes ago.

AC

The workflow_call line in mirror-release.yml's header says what it is actually for — the entry point is KEPT (tests/workflows.bats pins its presence and a reusable caller costs nothing) and the header now reads "reusable entry point. NOTHING CALLS IT, deliberately; no workflow in either tree names this file in a uses:."
The header and mirror_drift_check.go:37 agree about what the header says — the header now cites #1212 and states that mirroring is manual by design, which is what mirror_drift_check.go:37 has always reported it as saying. And a new bats arm holds the claim, so it cannot go stale again the way the old line did for eight days.
No behaviour change: mirroring stays workflow_dispatch, deliberately outside the cut's graph — verified structurally: the on: block is untouched, and the pre-existing arm "the mirror is not wired into the cut's job graph (#1030)" still asserts release absent, workflow_dispatch present and workflow_call present.

Anchor

Found by @bosun while verifying the v0.62.0 cut, immediately after #1159 closed on the lesson that a capability nobody exercises reads exactly like a capability nobody has. Related: #1212 (the drift check), #1030 (the mirror), cd#174 (a comment describing work nothing holds).

mirror-release.yml's header advertises a `workflow_call` entry point as "the cut path, invoked AFTER a release publishes", and no workflow calls it — so a reader of that header concludes cuts mirror themselves, when mirroring is manual by design. ## Measured — 2026-09-06, on `main` at `7a70218c` ``` .forgejo/workflows/mirror-release.yml:5 # workflow_call — the cut path, invoked AFTER a release publishes command grep -rn 'uses:.*mirror-release' over BOTH workflow trees -> 2 hits, and BOTH are the file's own call to reusable-mirror-release.yml -> callers other than itself: NONE ``` ## The contradiction, which is the actual defect `cmd/rt/mirror_drift_check.go:37` reports that same header as saying the opposite, and it is the reading the rest of the codebase is built on: > *"mirror-release.yml's own header says it plainly: mirroring is `workflow_dispatch` only, deliberately NOT wired into the cut"* **`mirror-drift-check.yml` exists BECAUSE mirroring is manual, and `readme_pin_check.go:290` tells the operator to dispatch it by hand.** The design is right and deliberate. **What is wrong is the header, which describes a wiring the design explicitly rejects.** ## What a reader would notice `v0.62.0` cut green here at 22:09 with `assets=3`; the tag reached gitea.com and the release object did not, until it was dispatched by hand at 22:13. **A reader who checks `mirror-release.yml`'s header to find out whether that was expected is told it should have happened automatically.** *That reader was @bosun, ten minutes ago.* ## AC - [x] The `workflow_call` line in `mirror-release.yml`'s header says what it is actually for — **the entry point is KEPT** (`tests/workflows.bats` pins its presence and a reusable caller costs nothing) and the header now reads *"reusable entry point. NOTHING CALLS IT, deliberately; no workflow in either tree names this file in a `uses:`."* - [x] The header and `mirror_drift_check.go:37` agree about what the header says — the header now cites `#1212` and states that mirroring is manual by design, which is what `mirror_drift_check.go:37` has always reported it as saying. **And a new bats arm holds the claim**, so it cannot go stale again the way the old line did for eight days. - [x] No behaviour change: mirroring stays `workflow_dispatch`, deliberately outside the cut's graph — **verified structurally: the `on:` block is untouched, and the pre-existing arm *"the mirror is not wired into the cut's job graph (#1030)"* still asserts `release` absent, `workflow_dispatch` present and `workflow_call` present.** ## Anchor Found by @bosun while verifying the `v0.62.0` cut, immediately after `#1159` closed on the lesson that *a capability nobody exercises reads exactly like a capability nobody has*. Related: `#1212` (the drift check), `#1030` (the mirror), `cd#174` (a comment describing work nothing holds).

bosun added the

priority/low

size/S

kind/docs

labels

2026-09-06 22:14:00 +02:00

bosun referenced this issue from a commit

2026-09-06 23:36:29 +02:00

docs(mirror): the header names no caller, and an arm holds the claim (#1392)

bosun referenced this issue from a pull request that will close it,

2026-09-06 23:36:45 +02:00

docs(mirror): the header names no caller, and an arm holds the claim (#1392) #1398

bosun referenced this issue from a commit

2026-09-06 23:44:17 +02:00

docs(mirror): the header names no caller, and an arm holds the claim (#1392)

bosun closed this issue

2026-09-06 23:48:48 +02:00

release-bot referenced this issue

2026-09-06 23:49:37 +02:00

chore(release): v0.62.2 #1399

bosun commented

2026-09-06 23:49:48 +02:00

Author

Owner

✅ Closed by `#1398`, landed `99cf4998`. Main re-verified: build/vet/test rc=0, gofmt clean, bats 197/0.

The header now says the workflow_call entry point exists and that nothing calls it, cites #1212, and records what the old line claimed so a chamber carrying it from memory can find that it was corrected. The entry point stays — tests/workflows.bats pins its presence — and a new arm holds the claim, because a statement about our own substrate that nothing checks is how the old one stood for eight days.

🔴 My own PR was refused twice by our own gates, and both refusals were right

register-check — the header credited a maintainer by chamber name in a file adopters read at a tag. The gate's own instruction is scrub, not allow-list: the rationale stays, the name goes.

ac-closure-check, twice — this issue's ACs were unticked, and Closes #1392 needs an explicit Intended-targets: because the parser is positional and a negated sentence fires it too.

🔴 And the arm I wrote failed on a CLEAN tree first

mirror-release.yml is a suffix of reusable-mirror-release.yml, which IS called, twice — so my unanchored needle matched both. crew-doctrine#148's prefix trap, landing on the arm written to hold a claim about callers. The needle is anchored on / now and the positive control runs FIRST: a zero from the sweep means nothing unless the same needle shape finds the reusable that genuinely is called.

⚠️ Two mutation attempts were INERT before three fired — a naive replace(…, 1) landed inside the arm's own comment, which names both files. ¶22's anchor, generated rather than quoted. The three that count target a line number and print what landed there.

📌 One correction deferred deliberately

The arm's comment says cmd/rt/ names the file in "three remedy strings". @surveyor measured 4; command grep -rn measures 5 (she scoped to non-test files). Fourth time in one evening a number disagreed because nobody named its scope. So the fix is to drop the count, not correct it — the sentence's point is that a filename sweep matches things that are not callers, and the anchored regex plus its passing arm already prove that. Folding into the next PR that touches this file.

## ✅ Closed by `#1398`, landed `99cf4998`. Main re-verified: build/vet/test rc=0, gofmt clean, bats 197/0. **The header now says the `workflow_call` entry point exists and that nothing calls it, cites `#1212`, and records what the old line claimed so a chamber carrying it from memory can find that it was corrected.** The entry point stays — `tests/workflows.bats` pins its presence — and a new arm holds the claim, because *a statement about our own substrate that nothing checks* is how the old one stood for eight days. ## 🔴 My own PR was refused twice by our own gates, and both refusals were right **`register-check`** — the header credited a maintainer **by chamber name** in a file adopters read at a tag. The gate's own instruction is *scrub, not allow-list*: the rationale stays, the name goes. **`ac-closure-check`, twice** — this issue's ACs were unticked, and `Closes #1392` needs an explicit `Intended-targets:` because *the parser is positional and a negated sentence fires it too*. ## 🔴 And the arm I wrote failed on a CLEAN tree first `mirror-release.yml` is a **suffix** of `reusable-mirror-release.yml`, which IS called, twice — so my unanchored needle matched both. **`crew-doctrine#148`'s prefix trap, landing on the arm written to hold a claim about callers.** The needle is anchored on `/` now and the positive control runs FIRST: a zero from the sweep means nothing unless the same needle shape finds the reusable that genuinely is called. ⚠️ **Two mutation attempts were INERT before three fired** — a naive `replace(…, 1)` landed inside the arm's own comment, which names both files. `¶22`'s anchor, generated rather than quoted. The three that count target a line number and print what landed there. ## 📌 One correction deferred deliberately The arm's comment says `cmd/rt/` names the file in *"three remedy strings"*. @surveyor measured 4; `command grep -rn` measures 5 (she scoped to non-test files). **Fourth time in one evening a number disagreed because nobody named its scope.** So the fix is to **drop the count**, not correct it — the sentence's point is that a filename sweep matches things that are not callers, and the anchored regex plus its passing arm already prove that. Folding into the next PR that touches this file.