chore: replace ambiguous Unicode characters in workflow YAML (Forgejo lint warning) #149

New issue

Closed

opened 2026-06-27 01:30:33 +02:00 by quartermaster · 0 comments

quartermaster commented

2026-06-27 01:30:33 +02:00

Owner

The phenomenon

Forgejo's workflow YAML lint flags _release.yml and release.yml for ambiguous Unicode characters. These look-alike characters are a security concern in code contexts (a hyphen vs em-dash distinction can hide malicious content); Forgejo's lint surfaces them broadly even in YAML comments.

Inventory

Non-ASCII characters present in the two flagged files:

Character	Codepoint	Where used	Context
`—`	U+2014 (em-dash)	comments + a few bash echo lines	sentence dashes
`→`	U+2192 (right arrow)	bash echo + comments	flow descriptions ("root → direct")
`α`	U+03B1 (Greek alpha)	comments	"path-α" jargon (ADR-0007 mechanism naming)
`γ`	U+03B3 (Greek gamma)	comments	"path-γ" jargon (same source)
`§`	U+00A7 (section sign)	comments	"AGENTS.md §2" references

Line counts: ~25 occurrences across _release.yml + release.yml.

Replacement scheme

From	To	Rationale
`—`	`-` (or `--` where the em-dash separates clauses)	ASCII hyphen / double-hyphen
`→`	`->`	ASCII arrow
`α`	`alpha`	Spell out the Greek letter; preserves jargon readability
`γ`	`gamma`	Same
`§`	`section` or `sec.`	ASCII equivalent

For the bash echo lines (2 sites in _release.yml), the substitution is cosmetic (changes the workflow log text); for comment lines, it's invisible at runtime. No behavioral change.

Composition with #148 + AGENTS.md §2

Compose-script touch: _release.yml is in the AGENTS.md §2 mechanism-of-touch list. After this PR merges, the in-cycle re-pin discipline applies (10+ embodied in this session; #124 backstop will surface red on push:main).
Sequencing relative to #148: this cleanup is independent and can ship first OR after #148. If after #148, the build-bake mechanism would rewrite _release.yml's ref line; that line shouldn't have Unicode anyway, but worth a sanity check during #148's implementation that no comment-Unicode gets reintroduced in the rewrite path.

Other Unicode in the repo (out of scope here)

The Greek letter "path-α/path-γ" jargon is established in ADR-0007 + AGENTS.md + various comments outside the two flagged workflow files. Forgejo's lint isn't complaining about those (only the workflow YAMLs are linted by the workflow editor). This tracker scopes the cleanup to the lint-surfaced files only; broader Unicode sweep is a separate consideration if/when Forgejo's lint extends.

Implementation surface

.forgejo/workflows/_release.yml: ~20 substitutions (mostly em-dash → hyphen)
.forgejo/workflows/release.yml: ~6 substitutions
bats sanity: no schema test changes needed (substitutions are in comments + echo strings)
AGENTS.md or operations.md: maybe a brief note about ASCII-only in workflow YAML? Or just maintain the discipline going forward via review

What this PR does NOT do

Does NOT touch ADR documents or other markdown — those have full Unicode latitude and aren't subject to the same lint
Does NOT change runtime behavior — comments are no-op; echo strings change cosmetic log text only
Does NOT add a workflow-lint regression guard — out of scope; could be a follow-up if the pattern recurs

Refs

Operator engagement 2026-06-27: surfaced the Forgejo lint warning
Composition: AGENTS.md §2 (mechanism-of-touch applies post-merge), #124 backstop (will surface red post-merge until re-pin)
Sister sequencing: #148 (build-bake refactor)

## The phenomenon Forgejo's workflow YAML lint flags `_release.yml` and `release.yml` for ambiguous Unicode characters. These look-alike characters are a security concern in code contexts (a hyphen vs em-dash distinction can hide malicious content); Forgejo's lint surfaces them broadly even in YAML comments. ## Inventory Non-ASCII characters present in the two flagged files: | Character | Codepoint | Where used | Context | |---|---|---|---| | `—` | U+2014 (em-dash) | comments + a few bash echo lines | sentence dashes | | `→` | U+2192 (right arrow) | bash echo + comments | flow descriptions ("root → direct") | | `α` | U+03B1 (Greek alpha) | comments | "path-α" jargon (ADR-0007 mechanism naming) | | `γ` | U+03B3 (Greek gamma) | comments | "path-γ" jargon (same source) | | `§` | U+00A7 (section sign) | comments | "AGENTS.md §2" references | Line counts: ~25 occurrences across `_release.yml` + `release.yml`. ## Replacement scheme | From | To | Rationale | |---|---|---| | `—` | `-` (or `--` where the em-dash separates clauses) | ASCII hyphen / double-hyphen | | `→` | `->` | ASCII arrow | | `α` | `alpha` | Spell out the Greek letter; preserves jargon readability | | `γ` | `gamma` | Same | | `§` | `section` or `sec.` | ASCII equivalent | For the bash `echo` lines (2 sites in `_release.yml`), the substitution is cosmetic (changes the workflow log text); for comment lines, it's invisible at runtime. **No behavioral change.** ## Composition with #148 + AGENTS.md §2 - **Compose-script touch**: `_release.yml` is in the AGENTS.md §2 mechanism-of-touch list. After this PR merges, the in-cycle re-pin discipline applies (10+ embodied in this session; #124 backstop will surface red on push:main). - **Sequencing relative to [#148](https://git.frankenbit.de/frankenbit/release-toolkit/issues/148)**: this cleanup is independent and can ship first OR after #148. If after #148, the build-bake mechanism would rewrite `_release.yml`'s ref line; that line shouldn't have Unicode anyway, but worth a sanity check during #148's implementation that no comment-Unicode gets reintroduced in the rewrite path. ## Other Unicode in the repo (out of scope here) The Greek letter "path-α/path-γ" jargon is established in ADR-0007 + AGENTS.md + various comments outside the two flagged workflow files. Forgejo's lint isn't complaining about those (only the workflow YAMLs are linted by the workflow editor). This tracker scopes the cleanup to the lint-surfaced files only; broader Unicode sweep is a separate consideration if/when Forgejo's lint extends. ## Implementation surface - `.forgejo/workflows/_release.yml`: ~20 substitutions (mostly em-dash → hyphen) - `.forgejo/workflows/release.yml`: ~6 substitutions - bats sanity: no schema test changes needed (substitutions are in comments + echo strings) - AGENTS.md or operations.md: maybe a brief note about ASCII-only in workflow YAML? Or just maintain the discipline going forward via review ## What this PR does NOT do - **Does NOT touch ADR documents or other markdown** — those have full Unicode latitude and aren't subject to the same lint - **Does NOT change runtime behavior** — comments are no-op; echo strings change cosmetic log text only - **Does NOT add a workflow-lint regression guard** — out of scope; could be a follow-up if the pattern recurs ## Refs - **Operator engagement 2026-06-27**: surfaced the Forgejo lint warning - **Composition**: AGENTS.md §2 (mechanism-of-touch applies post-merge), #124 backstop (will surface red post-merge until re-pin) - **Sister sequencing**: [#148](https://git.frankenbit.de/frankenbit/release-toolkit/issues/148) (build-bake refactor)

quartermaster referenced this issue

2026-06-27 01:32:13 +02:00

chore: replace ambiguous Unicode characters across compose-scripts + bats tests (sister of #149) #150

quartermaster referenced this issue

2026-06-27 01:34:19 +02:00

chore: audit-cleanup of .keep files (drop unused, document load-bearing ones) #151

quartermaster referenced this issue

2026-06-27 01:37:30 +02:00

chore: prune orphaned -rc.N tags + automate self-bootstrap rc-tag lifecycle #153

quartermaster referenced this issue

2026-06-27 01:46:13 +02:00

chore: reconsider underscore-prefix convention for reusable workflow filenames (aesthetic) #155