feat(bootstrap): let a consumer pinned by commit SHA run the reusables that install rt #1517

New issue

Open

opened 2026-10-02 19:53:55 +02:00 by claude · 0 comments

claude commented

2026-10-02 19:53:55 +02:00

Member

Deferred from #1514. Since #1515 (0156d84), a consumer that pins a reusable by commit SHA gets a clear refusal at bootstrap rt in every reusable that installs rt, and docs/SECURITY.md says so. This issue tracks making that pin work, and should be picked up when a consumer wants to pin by SHA. None does today: all six consumers on this instance pin tags (#1514's census, 2026-10-02).

What is missing

The resolve-ref SHA arms (#336) already send the second checkout to the SHA. What is missing is an rt that matches the pinned commit. rt is published per release tag, so a SHA has nothing to fetch (scripts/bootstrap-rt.sh, the hex refusal in its *) arm).

Options

Carried over from #1514's decision tree, which has the measurements:

	Mechanism	`rt` bound to	Works for	Cost
(C)	run `rt` from the image digest pinned in `action.yml` at the SHA	the pinned tree (content-addressed digest)	tag commits only (`vX.Y.Z^{commit}`); cut and main commits carry the all-zeros placeholder	image path wired into the composite; runners must pull images; related to #1476
(A)	FETCH the release named by `BUILD_BAKED_TOOLKIT_REF` at the SHA	the signing key and tag name, not the SHA	tag and cut commits	small; inherits #1516's replay gap until that lands
(B)	BUILD `rt` from `.release-toolkit` at the SHA	the pinned tree	any commit	Go on adopter runners; amends ADR-0008 §4a

Commits that none of these cover keep the #1515 refusal.

Acceptance criteria

First, measure on a throwaway consumer repo, verified workflow-free per AGENTS.md §14, that Forgejo resolves uses: …/reusable-*.yml@<40-hex> for a called reusable. Link the run here. If it does not, close this issue as not reachable and narrow docs/SECURITY.md further.
A decision is recorded among (C), (A) and (B), stating what a SHA pin then guarantees for rt.
The #1514 composition test in tests/bootstrap-rt.bats changes its commit-pin rows to the new outcome and stays mutation-verified.
docs/SECURITY.md and composite/bootstrap-rt/action.yml's ref description match the shipped behaviour.
A changelog fragment.

Deferred from #1514. Since #1515 (`0156d84`), a consumer that pins a reusable by commit SHA gets a clear refusal at `bootstrap rt` in every reusable that installs `rt`, and `docs/SECURITY.md` says so. This issue tracks making that pin *work*, and should be picked up **when a consumer wants to pin by SHA**. None does today: all six consumers on this instance pin tags (#1514's census, 2026-10-02). ## What is missing The resolve-ref SHA arms (#336) already send the second checkout to the SHA. What is missing is an `rt` that matches the pinned commit. `rt` is published per release tag, so a SHA has nothing to fetch (`scripts/bootstrap-rt.sh`, the hex refusal in its `*)` arm). ## Options Carried over from #1514's decision tree, which has the measurements: | | Mechanism | `rt` bound to | Works for | Cost | |---|---|---|---|---| | **(C)** | run `rt` from the image digest pinned in `action.yml` at the SHA | the pinned tree (content-addressed digest) | tag commits only (`vX.Y.Z^{commit}`); cut and main commits carry the all-zeros placeholder | image path wired into the composite; runners must pull images; related to #1476 | | **(A)** | FETCH the release named by `BUILD_BAKED_TOOLKIT_REF` at the SHA | the signing key and tag name, not the SHA | tag and cut commits | small; inherits #1516's replay gap until that lands | | **(B)** | BUILD `rt` from `.release-toolkit` at the SHA | the pinned tree | any commit | Go on adopter runners; amends ADR-0008 §4a | Commits that none of these cover keep the #1515 refusal. ## Acceptance criteria - [ ] **First, measure** on a throwaway consumer repo, verified workflow-free per AGENTS.md §14, that Forgejo resolves `uses: …/reusable-*.yml@<40-hex>` for a called reusable. Link the run here. If it does not, close this issue as not reachable and narrow `docs/SECURITY.md` further. - [ ] A decision is recorded among (C), (A) and (B), stating what a SHA pin then guarantees for `rt`. - [ ] The `#1514` composition test in `tests/bootstrap-rt.bats` changes its commit-pin rows to the new outcome and stays mutation-verified. - [ ] `docs/SECURITY.md` and `composite/bootstrap-rt/action.yml`'s `ref` description match the shipped behaviour. - [ ] A changelog fragment.

claude added the

labels

2026-10-02 19:53:55 +02:00

claude referenced this issue

2026-10-02 19:54:12 +02:00

bug(bootstrap): a SHA-pinned consumer fails at bootstrap rt in 16 of 18 reusable files; resolve-ref emits the SHA and bootstrap-rt.sh has no arm for it #1514

claude referenced this issue