toolkit-self-gates g7/g9 run a backticked word as a command; mirror-release.yml comment stale after #1540 #1555

New issue

Closed

opened 2026-10-06 00:32:42 +02:00 by claude · 0 comments

claude commented

2026-10-06 00:32:42 +02:00

Member

Two small pre-existing defects, found while reviewing PR #1546 (tracker #1530). Both were out of scope there.

1. g7 and g9 print `check: command not found`

In .forgejo/workflows/toolkit-self-gates.yml, the closing NOTE lines of g7 (from manifest-check) and g9 (from register-check) put backticks inside a double-quoted echo:

echo "repo's real manifest (the `check` job does) nor the adopter FETCH arm."
echo "repo's surface (the `check` job does) and does NOT exercise --git-log."

Bash runs check as a command substitution. Measured on main's own run 19639 (PR #1544, job toolkit-self gates (PR's own rt)):

/var/run/act/workflow/g7.sh: line 33: check: command not found
repo's real manifest (the  job does) nor the adopter FETCH arm.
/var/run/act/workflow/g9.sh: line 5: check: command not found
repo's surface (the  job does) and does NOT exercise --git-log.

The steps still pass, because a failed substitution inside an argument does not change echo's exit status. But the log has a stray error line, and the NOTE loses the name it was meant to give.

That name is stale too. "The check job" meant the check: job of manifest-check.yml and register-check.yml. Both files are gone (0de3876). The real scans now run as the manifest and register gates of pr / gates (reusable-pr-gates.yml). Escaping the backticks alone would print a job that no longer exists.

Scope check: a quote-aware scan of every run: block in .forgejo/workflows/*.yml and .gitea/workflows/*.yml finds live backticks only in these two steps. go-ci.yml:190 and mirror-drift-check.yml:227 already escape theirs.

2. `mirror-release.yml` comment names a verdict readme-pin-check.yml no longer posts

.forgejo/workflows/mirror-release.yml, at about line 289, in the set-adopter-pin job (step "set the pin and land it"):

this step runs both verdicts readme-pin-check.yml would post on a PR

Since #1540 (PR #1546), readme-pin-check.yml posts only the mirror verdict on a PR. The digest verdict moved to gate g14 of toolkit-self-gates.yml. The step itself still runs both checks (readme-pin-check and tag-action-digest-check); only the comment's attribution is stale.

The file is twinned to .gitea/workflows/mirror-release.yml but not baked: it is not in canonicalFiles (internal/bake/marker.go). So the twin has to be regenerated with rt gitea-twin, or gitea-twin-check goes red.

Acceptance criteria

g7 and g9 no longer run a command substitution, and their NOTE names where the real scan runs now.
No other step in .forgejo/workflows/*.yml has a live backtick in a double-quoted string.
The mirror-release.yml comment says where each of the two verdicts runs on a PR.
The Gitea twin is regenerated with the repo's generator, and rt gitea-twin --check passes.
The job log of g7 and g9 on the PR's run has no command not found line.

Two small pre-existing defects, found while reviewing PR #1546 (tracker #1530). Both were out of scope there. ## 1. g7 and g9 print `check: command not found` In `.forgejo/workflows/toolkit-self-gates.yml`, the closing NOTE lines of g7 (from manifest-check) and g9 (from register-check) put backticks inside a double-quoted `echo`: ```bash echo "repo's real manifest (the `check` job does) nor the adopter FETCH arm." echo "repo's surface (the `check` job does) and does NOT exercise --git-log." ``` Bash runs `check` as a command substitution. Measured on main's own run 19639 (PR #1544, job `toolkit-self gates (PR's own rt)`): ``` /var/run/act/workflow/g7.sh: line 33: check: command not found repo's real manifest (the job does) nor the adopter FETCH arm. /var/run/act/workflow/g9.sh: line 5: check: command not found repo's surface (the job does) and does NOT exercise --git-log. ``` The steps still pass, because a failed substitution inside an argument does not change `echo`'s exit status. But the log has a stray error line, and the NOTE loses the name it was meant to give. That name is stale too. "The `check` job" meant the `check:` job of `manifest-check.yml` and `register-check.yml`. Both files are gone (`0de3876`). The real scans now run as the `manifest` and `register` gates of `pr / gates` (`reusable-pr-gates.yml`). Escaping the backticks alone would print a job that no longer exists. Scope check: a quote-aware scan of every `run:` block in `.forgejo/workflows/*.yml` and `.gitea/workflows/*.yml` finds live backticks only in these two steps. `go-ci.yml:190` and `mirror-drift-check.yml:227` already escape theirs. ## 2. `mirror-release.yml` comment names a verdict readme-pin-check.yml no longer posts `.forgejo/workflows/mirror-release.yml`, at about line 289, in the `set-adopter-pin` job (step "set the pin and land it"): > this step runs both verdicts readme-pin-check.yml would post on a PR Since #1540 (PR #1546), `readme-pin-check.yml` posts only the `mirror` verdict on a PR. The digest verdict moved to gate g14 of `toolkit-self-gates.yml`. The step itself still runs both checks (`readme-pin-check` and `tag-action-digest-check`); only the comment's attribution is stale. The file is twinned to `.gitea/workflows/mirror-release.yml` but not baked: it is not in `canonicalFiles` (`internal/bake/marker.go`). So the twin has to be regenerated with `rt gitea-twin`, or `gitea-twin-check` goes red. ## Acceptance criteria - [x] g7 and g9 no longer run a command substitution, and their NOTE names where the real scan runs now. - [x] No other step in `.forgejo/workflows/*.yml` has a live backtick in a double-quoted string. - [x] The `mirror-release.yml` comment says where each of the two verdicts runs on a PR. - [x] The Gitea twin is regenerated with the repo's generator, and `rt gitea-twin --check` passes. - [x] The job log of g7 and g9 on the PR's run has no `command not found` line.

claude added the

labels

2026-10-06 00:32:42 +02:00

claude referenced this issue from a commit

2026-10-06 00:39:07 +02:00

chore(ci): stop g7/g9 running a backticked word; refresh a stale mirror-release comment

claude referenced this issue