chore(workflows)!: remove the six single-gate reusables, their wrappers and twins #1552
No reviewers
Labels
No labels
bump
major
bump
minor
bump
patch
kind
bug
kind
chore
kind
docs
kind
epic
kind
feature
loop/paused
mirror-drift
priority
critical
priority
high
priority
low
priority
medium
size
L
size
M
size
S
size
XL
status
blocked
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
frankenbit/release-toolkit!1552
Loading…
Reference in a new issue
No description provided.
Delete branch "claude/1542-remove-single-gate-reusables"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
.gitea/twins and their six toolkit-self wrappers.reusable-pr-gates.yml(v0.66.0, #1547) already runs all six gates frompr.yml.pr.ymlonreusable-pr-gates.ymlwith a gate'on'for each wrapper they had, and requirepr / gates (pull_request). Old tags keep serving the old reusables, so nothing breaks until an adopter moves its pin.rt decide --dry-runon this head printsbump downgraded major -> minor,next: version=0.67.0).Refs #1542
Refs #1530
Refs #1548
Required-check swap (Alex, after approving, right before merging)
Read live on 2026-10-05 (
GET /repos/frankenbit/release-toolkit/branch_protections):mainrequires 18 contexts.Remove these 14:
ac-closure-check / ac-closure check (pull_request)ac-closure-check / check (pull_request)changelog-body-check / changelog body Cold-Read linter (pull_request)changelog-body-check / check (pull_request)fragment-check / check (pull_request)fragment-check / coverage (pull_request)fragment-check / density (pull_request)manifest-check / check (pull_request)manifest-check / manifest-vs-tag consistency (pull_request)register-check / check (pull_request)register-check / register-drift check (pull_request)workflow-parse-check / check (pull_request)workflow-parse-check / toolkit-self parse guard and controls (pull_request)workflow-parse-check / workflow parse and schema (pull_request)Add this 1:
pr / gates (pull_request). It has posted on every PR since #1547 merged, and it posts on this one.Result, 5 contexts:
go-ci / lint + build + test,tests / bats,tests / checks,toolkit-self-gates / toolkit-self gates (PR's own rt)andpr / gates, each with(pull_request). That is under the "at most 6" in #1542's acceptance criteria, and it is the 5 that ADR-0013's Consequences predicts.cmd/rt/pre_push.goalready matches the post-swap set. Against the live pre-swap set,rt pre-pushreportspr / gatesas a dead declaration until the swap is made. Nothing in CI runsrt pre-push.Decision tree
pr-gates@v0.66.0(tmux-tell#964), so the replacement is proven on the tag-pinned path.secretsinherit: keep the six names in aRetiredNoSecretsset is right because tags up to v0.66.0 still serve them. An adopter that bumpsrelease.ymlbefore moving its gate wrappers would otherwise get "NeedsSecrets does not know whether that reusable needs a secret" fromrt secrets-inherit-check(acontinue-on-errorwarning in the release workflow). Deleting the entries outright is right only if no caller could still use an old tag. The derivation test refuses a retired name that still has a file or is also inNeedsSecrets.reusable-pr-gates.ymlorscripts/pr-gates.sh. Dropping is right wheretests/pr-gates.batsalready grades the same property. Each disposition is in the table below.(#1542).build-ref-checkon an old tag now checks the 4 remaining canonical files, not 10. On a tag push it buildsrtfrom the tagged tree, so new tags are unaffected. Only aworkflow_dispatchgrading an old tag with today'srtsees fewer files. Keeping the six names in the bake list is right only if that dispatch matters more than one source of truth.Carry-forward (AGENTS.md section 1)
The wrappers. Each of the five small wrappers had only its
checkjob, the call to its reusable. Theirselfjobs had already moved totoolkit-self-gates(#1253, #1540); the comments left behind them were orphans.check: call the reusablepr / gates, every gate'on',layout: combined(pr.yml)on: pull_request(andeditedon ac-closure, fragment)pr.yml's types are the union,[opened, synchronize, reopened, edited], with nopaths:filter (pinned bytests/pr-gates.bats)register-check.ymlcheck_commit_subjects: 'true'workflow-parse-check.ymlself: checkouttests / checkscheckoutworkflow-parse-check.ymlself: replay onto the landing base (#1195)tests / checkshas the same replay step, andpr / gatesreplays inside the reusableworkflow-parse-check.ymlself: fetch the pinned validator (v12.8.2, sha2567be27f32...)tests / checksfetches the same version and hash;scripts/pr-gates.shpins the same pair for theworkflow_parsegateworkflow-parse-check.ymlself: positive control, guard over this tree with a non-zeroPARSED=TOTALtests / checksc1 runsscripts/workflow-parse-check.sh .. The script itself exits 1 on a zero or short count (lines 19-22 and 40-45;tests/workflow-parse-check.bats), andpr / gates'workflow_parsegate runs it tooworkflow-parse-check.ymlself: mutation control (fatal-block-scalar-comment.ymlmust fail)tests / checksc13, moved there by #1541. Its comment no longer says the wrapper runs it tooThe reusables. Every input of the six maps to a
reusable-pr-gates.ymlinput of the same name:config_path,fragments_dir,valid_kinds,fragment_length_warn_chars,density, the five thresholds,changelog_pathandregister_patterns_override. The one exception ischeck_commit_subjects(above). Their steps (checkout, replay, resolve, checkout toolkit, bootstrap, run) are each a step ofreusable-pr-gates.yml, and #1547 carried them.The lists.
canonicalFiles(internal/bake/marker.go) andbakeRefFiles(cmd/rt/prep.go)DefaultComposeScripts(internal/gates/selfboot_check.go)scripts/workflow-parse-check.shandscripts/pr-gates.shstayNeedsSecretsRetiredNoSecretspre_push.golocallyUnreproduciblerows for ac-closure, manifest and the parse self job removed;pr / gates (pull_request)added;register-check's two contexts dropped from its gatetests/workflows.batsdocs/architecture.md,docs/integration.md, the fragment, parse-guard, coverage, Cold-Read, conventions and SECURITY docs,examples/, the README, AGENTS.md section 2 counts and the section 15 tablepr.ymlandreusable-pr-gates.ymlHistorical records are left as written: the ADRs,
CHANGELOG.md, the test fixtures undertestdata/and the provenance markers intoolkit-self-gates.yml.Bats arms that graded a removed file
tests.yml(c1, c13, replay) andworkflow_parse: 'on'inpr.ymltoolkit-self-gatesassertions stay,ac_closure: 'on'inpr.ymlpr.ymlandscripts/pr-gates.shpr-gates.bats"both modes run, and a red coverage still reports density"pr-gates.batspinschangelog_body: 'on'and the triggerpr-gates.batsdrives every D6 resolve armfragment-check.ymlname mapping removedreusable-pr-gates.ymlreusable-pr-gates.ymlandreusable-release.yml, every bootstrap callpr-gates.batsrequires env transport for every inputreusable-pr-gates.yml(job env) andscripts/pr-gates.sh(quoted path inputs)gatesandfragmentsjobs andscripts/pr-gates.shreusable-pr-gates.ymlscripts/pr-gates.shRETIRED_UNIONNo re-pin
No re-pin: toolkit-self floats
@main(AGENTS.md section 2.1). Adopters get the change from v0.67.0. On this head:Evidence (local, on head
0de3876018392134d38dfda82ac1b35bcdcfb7be)go vet ./...andgo test -count=1 ./...: all packages ok.golangci-lint run(forgejo-ci-go:latest, caps off):0 issues.bats tests/(rt-bats:local, LF clone): 241 tests, 0 failures. There were 246; 5 arms were dropped, as listed above.scripts/workflow-parse-check.sh .with the pinned validator:PARSED=26 TOTAL=26. Each example project:PASS: 2/2.rt gitea-twin --check:PASS — 6 twin(s) match their source.rt register-check:OK: 0 register-drift hits.rt changelog-body-check CHANGELOG.md: rc=0.rt fragment-check(content mode, density on):density PASS, with the non-blocking 500-character warning on the new fragment.rt prep --dry-runin a disposable clone:next_version=0.67.0, and every cut-time changelog check PASS on the composed section.pre_push.goagainst both sets, in a scratch test that was not committed: post-swapstale=[] undeclared=[] dead=[]; live pre-swapdead=[pr / gates (pull_request)]and the 14 old contexts undeclared.Mutants (each in a disposable copy,
git diff --statshowing the change, then the named arm):RetiredNoSecretsarm removed fromCheckTestCheck_RetiredReusableIsSilentAtItsOldTagpr-gatesadded toRetiredNoSecretsTestNeedsSecrets_MatchesWhatTheReusablesActuallyReferenceRetiredNoSecretsemptied--diff-filter=ddropped inpr-gates.sh--diff-filter=Dtests.ymlworkflow_parse: 'off'inpr.ymlac_closure: 'off'fragments: 'off'${{ inputs.layout }}in a run blockPR_GATES_CONFIG_PATHunbound--configpath unquoted inpr-gates.shPR_GATES_BASE_SHAbound togithub.shatokendropped from one bootstrapminisign-public-keydropped from one bootstrapediteddropped fromtoolkit-self-gates.ymlpr.ymlwith a short transportprepared-uncutwrapper probe renamedNot verified here
mainand its task timings.rt build-ref-checkbyworkflow_dispatchon an old tag, which now grades 4 files (decision tree above).Verify-at-source request
@alex, please verify at source (AGENTS.md section 6): the swap list against live protection, the carry-forward table against
workflow-parse-check.ymlatorigin/main, and the CI job logs once they post. I will post the per-check log evidence in a comment.🤖 Generated with Claude Code
CI on head
0de3876018392134d38dfda82ac1b35bcdcfb7be, read from the job logs in the browser (step logs fetched per step), not from the statuses.18 contexts posted, all
success. None of the 14 old wrapper contexts posted, as expected: their workflows are deleted. So under today's protection this PR waits on 14 contexts that never come, until the swap.8 jobs ran steps; 9 posted as skipped (every step
skipped, 0 s):pr / plan, and run every gate when combined(19873/1)layout=combined; on gates: manifest fragments changelog_body register ac_closure workflow_parse;resolved toolkit ref: main (source=toolkit-self local invocation (ADR-0013 D6));landing-tree replay: PASS; manifest[manifest-check] all checks passed;fragment-coverage: PASS - fragment present: changelog.d/1542-remove-single-gate-reusables.removed.md, coverage PASS, density PASS;changelog-body-check: PASS (CHANGELOG.md);register-check: file scan only; the commit-subject scan is not part of this gate (#1548).; ac-closureno same-repo Closes-target found on either surface;PARSED=26 TOTAL=26; tree unchanged;attest: every expected gate ran (...)pr / gates(19873/0)pr / manifest,fragments,changelog_body,register,ac_closure,workflow_parse,split result(19873/2-8)skipped(combined layout)tests / checks(19875/1)landing-tree replay: PASS; c1PARSED=26 TOTAL=26andPASS: 26/26; c24 fatal fixture(s) rejected, 3 safe fixture(s) accepted; c13PARSED=26 TOTAL=27andnegative control OK: mutation.yml made the executed guard fail (rc=1);attest: all 13 gate steps AND the shared-tree guard ran (14 of 14 ...)tests / bats(19875/0)1..241, 241ok, 0not oktoolkit-self-gates(19876/0)control OK;check-self-bootstrap{"result":"pass","pinned_ref":"main"};gitea-twin: PASS — 6 twin(s) match their source.;prep-order-check: PASS;tag-action-digest-check: PASS (rc=0)go-ci / lint + build + test(19872/0)binary-size-check PASS: binary 10723490 B vs v0.66.0 baseline 10735778 B (delta -12288 B)go-ci / page landing-tree failure,record reviewed vs landed commit(19872/1-2)readme-pin-check / mirror(19874/0)PASS: all 15 prescriptive pin(s) across 11 document(s) name v0.66.0(the new examplepr.ymlpins included)base-divergence-check / check(19871/0)PASS - graded against origin/main at 6172d9f26c1d8df0da979683ed420271a9419f4ffork-pr-approval-notice(19870/0)pull_request_target)So, measured on this PR before the merge: 8 jobs with steps, and 5 required contexts after the swap. #1542's fourth criterion asks for the same measurement after the merge; that is still open.
Verdict: APPROVE at
0de3876018Summary: the removal is complete and loses nothing. The parse wrapper's toolkit-self
selfjob is carried in full: the replay, the pinned validator, the positive control's count rule and the mutation control. The bump resolves to v0.67.0, adopters on old tags get no false "unknown reusable" finding, and every dropped bats arm is covered elsewhere. Nothing is blocking.Head pinned with
rt review-submit-check(rc=0, READY) immediately before this review. One commit,0de3876 chore(workflows)!, on base6172d9f, which is live main.The swap (read live just now)
mainrequires 18 contexts. The 14 to remove are all present:checkandac-closure check;checkandchangelog body Cold-Read linter;check,coverageanddensity;checkandmanifest-vs-tag consistency;checkandregister-drift check;check,toolkit-self parse guard and controlsandworkflow parse and schema.Each is
(pull_request). Addpr / gates (pull_request). That leaves 5:go-ci / lint + build + test,tests / bats,tests / checks,toolkit-self-gates / ...andpr / gates. All five posted success on this head. Do the swap after approving, right before merging.1. The
selfjob's carry-forward, verified at sourceThe old
workflow-parse-check.ymlselfjob at6172d9fhad four parts.selfsteptests / checksreplay step; the log showslanding-tree replay: PASS7be27f32...tests / checkssetup step, andpr-gates.sh gate_workflow_parse, with the same version and hashPARSED/TOTALrecord,parsed == totalc1runs the guard underset -emutation.yml, aPARSED/TOTALrecordc13, verbatimThe positive control's count rule is not lost.
scripts/workflow-parse-check.shitself exits 1 onexpected == 0and onparsed != expected("A zero or short count is not a clean result"), soc1's rc carries it. Only the outer re-assertion of the emitted record is gone.Mutant Mp: I deleted the script's
parsed != expectedblock.tests/workflow-parse-check.batsgoes red onrejects a short success countandrejects a silent zero-work validator. So the count rule is graded by its own tests, not only by the old control. The guard also runs a second time aspr / gates'workflow_parsegate (PARSED=26 TOTAL=26).2. The bump
I built
rtat the head in an LF clone and ranrt decide --dry-run:bump source: auto = major,pre_v1_breaking_to_minor: bump downgraded major -> minor,next: version=0.67.0 tag=v0.67.0. The fragment's summary line carries the migration ("wire onepr.ymlonreusable-pr-gates.ymland requirepr / gates (pull_request)"). Its body carriesBREAKING CHANGE:, the six names, the migration and the renamed statuses.3.
secrets-inherit-check's retired namesRetiredNoSecretsholds the six names, andCheckskips them only when they are not inNeedsSecrets. Mutants:pr-gatestoRetiredNoSecrets:TestNeedsSecrets_MatchesWhatTheReusablesActuallyReferencegoes red twice: "still has reusable-pr-gates.yml" and "in both NeedsSecrets and RetiredNoSecrets".manifest-checkfrom it:TestCheck_RetiredReusableIsSilentAtItsOldTaggoes red.4. The five dropped bats arms are covered
pr-gates.bats"both modes run, and a red coverage still reports density"pr-gates.batspr.ymlarm: every gate'on', trigger and wiringpr-gates.batsD6 arm, all 20 cases, both providers (mutants in review 7235)pr-gates.bats"inputs, defaults, job wiring": refuses any input other thanruns_onwithout env transportThe other removed arm headers were rewritten under new names, as the PR's table says.
5. Docs, examples, C3
adopter-workflow-parse-guard.md, with its "The mechanism moved" note;CHANGELOG.mdandtestdata/.examples/: both projects havepr.ymlat@v0.66.0withedited,layout: combined, and manifest and fragments'on';manifest-check.ymlis gone.readme-pin-check / mirrorlogsPASS: all 15 prescriptive pin(s) across 11 document(s) name v0.66.0.docs/integration.mdhas thepr.ymlrecipe (edited, nopaths:,layout: combined) and "Require one status onmain: ...pr / gates (pull_request)", gated on it having posted on the rolling release PR (#809), plus the migration.6. #1548
check_commit_subjectsgoes withreusable-register-check.yml. C3 records it as not carried over.CI, read in job logs (Axis C)
18 statuses, all success.
pr / plan, and run every gate when combined(run 19873, job 1, commit0de3876018): it resolved the toolkit ref tomain(source=toolkit-self local invocation, ADR-0013 D6). The replay passed against6172d9f, andbootstrap rtbuilt from source atmain. All six gates passed, withworkflow_parseatPARSED=26 TOTAL=26. The tree was unchanged and attest passed.tests / checks(run 19875, job 1): c1PARSED=26 TOTAL=26; c13PARSED=26 TOTAL=27andnegative control OK: mutation.yml made the executed guard fail (rc=1); tree unchanged for c1-c13; attest14 of 14.tests / bats(job 0):1..241, nonot ok.toolkit-self-gates(run 19876): attest15 of 15.Left open (as the coordinator says)
rt build-ref-checkagainst an old tag now grades the 4 canonical files, not 10. That is expected after the removal.Landing identity record
0de3876018392134d38dfda82ac1b35bcdcfb7be0de3876018392134d38dfda82ac1b35bcdcfb7beThis is a post-merge identity record. It does not retroactively review the landed object; it records whether the server landed the object that an official approval named.