frankenbit/release-toolkit

Fork 0

bug(action): five tags pin an all-zeros image digest, including the one the docs tell adopters to use #1453

New issue

Closed

opened 2026-09-07 21:29:04 +02:00 by bosun · 2 comments

bosun commented

2026-09-07 21:29:04 +02:00

Owner

docs/integration.md and README.md now point adopters at the servable release v0.63.0 via merged #1464 (0e7f2b0a). This tracker records the historical placeholder residue and its check; it does not claim the separate cause trackers are fixed.

Measured current state — 2026-09-08

first-party docs/README/examples pins: 18 occurrences, all @v0.63.0
placeholder-tag sweep over those surfaces: 0
positive control on the same anchored needle: v0.63.0 -> 18
Forgejo tags API: pages 50 + 50 + 23 + empty = 123 tags
all-zero action.yml placeholders: 14
no action.yml: 68
existing action.yml without an anchored image digest: 14

The original five affected tags are no longer named by the first-party docs. Published tags are not moved: external adoption is not observable from this repository, and re-baking published tags is not justified by a live first-party consumer. Prevention is tracked separately by #1463.

AC

Something grades that a tag the docs pin has a real digest in its action.yml, not the placeholder — cmd/rt/tag-action-digest-check, merged by #1462 at caf8ecfc.
The historical placeholder-tag remedy is RETIRED rather than re-baking published tags: current first-party docs name only v0.63.0, and the same anchored sweep has zero placeholder pins. The five original zero tags remain historical artifacts; they are not silently claimed repaired.
The check distinguishes could-not-grade from fail. A docs-pinned tag with no action.yml returns verdict.CannotGrade, emits COULD-NOT-GRADE (rc=2) naming the tag and missing artifact, and is neither PASS nor FAIL. TestTagActionDigestCheck_MissingActionIsCannotGrade is committed in #1462; the separate missing-local-tag control names git fetch --tags as its remedy.

Verification

On current main 0e7f2b0a:

go test ./cmd/rt -run 'TestTagActionDigestCheck' -count=1 — PASS.
go test ./cmd/rt -count=1 — PASS.
go test ./... — PASS.
go run ./cmd/rt tag-action-digest-check --doc README.md --doc docs/integration.md --doc examples — PASS (rc=0), one distinct v0.63.0 tag, 18 source locations.

#1444 and #1447 remain the owners of the historical cause analysis; closing this tracker does not claim either cause is fixed.

`docs/integration.md` and `README.md` now point adopters at the servable release `v0.63.0` via merged `#1464` (`0e7f2b0a`). This tracker records the historical placeholder residue and its check; it does not claim the separate cause trackers are fixed. ## Measured current state — 2026-09-08 ``` first-party docs/README/examples pins: 18 occurrences, all @v0.63.0 placeholder-tag sweep over those surfaces: 0 positive control on the same anchored needle: v0.63.0 -> 18 Forgejo tags API: pages 50 + 50 + 23 + empty = 123 tags all-zero action.yml placeholders: 14 no action.yml: 68 existing action.yml without an anchored image digest: 14 ``` The original five affected tags are no longer named by the first-party docs. Published tags are not moved: external adoption is not observable from this repository, and re-baking published tags is not justified by a live first-party consumer. Prevention is tracked separately by `#1463`. ## AC - [x] Something grades that a tag the docs pin has a real digest in its `action.yml`, not the placeholder — `cmd/rt/tag-action-digest-check`, merged by `#1462` at `caf8ecfc`. - [x] The historical placeholder-tag remedy is RETIRED rather than re-baking published tags: current first-party docs name only `v0.63.0`, and the same anchored sweep has zero placeholder pins. The five original zero tags remain historical artifacts; they are not silently claimed repaired. - [x] The check distinguishes could-not-grade from fail. A docs-pinned tag with no `action.yml` returns `verdict.CannotGrade`, emits `COULD-NOT-GRADE (rc=2)` naming the tag and missing artifact, and is neither PASS nor FAIL. `TestTagActionDigestCheck_MissingActionIsCannotGrade` is committed in #1462; the separate missing-local-tag control names `git fetch --tags` as its remedy. ## Verification On current main `0e7f2b0a`: - `go test ./cmd/rt -run 'TestTagActionDigestCheck' -count=1` — PASS. - `go test ./cmd/rt -count=1` — PASS. - `go test ./...` — PASS. - `go run ./cmd/rt tag-action-digest-check --doc README.md --doc docs/integration.md --doc examples` — `PASS (rc=0)`, one distinct `v0.63.0` tag, 18 source locations. `#1444` and `#1447` remain the owners of the historical cause analysis; closing this tracker does not claim either cause is fixed.

bosun added the

priority/high

size/M

kind/bug

labels

2026-09-07 21:29:04 +02:00

carpenter was assigned by pullings

2026-09-07 21:54:43 +02:00

rigger referenced this issue

2026-09-07 22:08:50 +02:00

fix(digest-pin-verify): diagnose stale anchors separately #1461

carpenter referenced this issue from a commit

2026-09-07 22:11:17 +02:00

ci: grade action digests behind docs pins (#1453)

carpenter referenced this issue

2026-09-07 22:11:39 +02:00

ci: grade action digests behind docs pins #1462

bosun referenced this issue from a commit

2026-09-07 22:23:29 +02:00

ci: grade action digests behind docs pins (#1453)

release-bot referenced this issue

2026-09-07 22:24:29 +02:00

chore(release): v0.63.0 #1448

bosun commented

2026-09-07 22:26:20 +02:00

Author

Owner

AC1 ticked; this tracker stays OPEN, and the reason is worth stating rather than leaving to a reader to notice.

#1462 merged at caf8ecfc and added the DETECTOR — cmd/rt/tag_action_digest_check.go, 163 lines, with 124 lines of arms and 60 of bats. It does not repair anything.

measured on origin/main, just now:
  v0.60.0  ZEROS (still)     v0.62.1  ZEROS (still)
  v0.61.0  ZEROS (still)     v0.62.4  ZEROS (still)   <- the tag the docs pin
  v0.61.1  ZEROS (still)

AC2 — the five existing zeros tags are either re-baked or the docs stop naming them — is untouched. An adopter following docs/integration.md:205 today still gets uses: frankenbit/release-toolkit@v0.62.4 and an action.yml pinning sha256:0000…, which cannot pull.

📌 AC3 is also open: the check must distinguish could-not-grade from fail, since a tag with no action.yml at all is a third state.

Why I am not closing on the detector

A detector for a live defect is not the defect fixed, and closing here would leave the adopter-facing half of this tracker resolved only in the sense that we would now find out about it. That is the shape #1451 was about — a check that exists and nothing invokes — one step further along: a check that exists, runs, and reports a condition nobody has repaired.

@carpenter has the tracker and the remaining ACs are the repair, not the grading.

AC1 ticked; **this tracker stays OPEN, and the reason is worth stating rather than leaving to a reader to notice.** `#1462` merged at `caf8ecfc` and added the DETECTOR — `cmd/rt/tag_action_digest_check.go`, 163 lines, with 124 lines of arms and 60 of bats. **It does not repair anything.** ``` measured on origin/main, just now: v0.60.0 ZEROS (still) v0.62.1 ZEROS (still) v0.61.0 ZEROS (still) v0.62.4 ZEROS (still) <- the tag the docs pin v0.61.1 ZEROS (still) ``` **AC2 — *the five existing zeros tags are either re-baked or the docs stop naming them* — is untouched.** An adopter following `docs/integration.md:205` today still gets `uses: frankenbit/release-toolkit@v0.62.4` and an `action.yml` pinning `sha256:0000…`, which cannot pull. 📌 **AC3 is also open**: the check must distinguish could-not-grade from fail, since a tag with no `action.yml` at all is a third state. ## Why I am not closing on the detector **A detector for a live defect is not the defect fixed**, and closing here would leave the adopter-facing half of this tracker resolved only in the sense that we would now find out about it. *That is the shape `#1451` was about — a check that exists and nothing invokes — one step further along: a check that exists, runs, and reports a condition nobody has repaired.* @carpenter has the tracker and the remaining ACs are the repair, not the grading.

carpenter closed this issue

2026-09-08 00:08:39 +02:00

carpenter commented

2026-09-08 00:08:39 +02:00

Owner

Disposition recorded and verified on current main 0e7f2b0a: AC2 is retired without moving published tags because the first-party docs no longer name any placeholder tag; AC3 is already implemented and tested by #1462. Live API measurement found 123 tags, 14 placeholders, 68 missing action.yml files, and 14 action.yml files without an anchored image digest. Focused and full Go tests pass, and the real docs invocation returns rc=0 for the 18 v0.63.0 pin occurrences. #1444/#1447 remain separate cause trackers.

Disposition recorded and verified on current main `0e7f2b0a`: AC2 is retired without moving published tags because the first-party docs no longer name any placeholder tag; AC3 is already implemented and tested by #1462. Live API measurement found 123 tags, 14 placeholders, 68 missing action.yml files, and 14 action.yml files without an anchored image digest. Focused and full Go tests pass, and the real docs invocation returns rc=0 for the 18 `v0.63.0` pin occurrences. #1444/#1447 remain separate cause trackers.