chore(ci): stop g7/g9 running a backticked word; refresh a stale mirror-release comment #1556

Merged

alex merged 1 commit from claude/1555-backtick-echo-stale-comment into main 2026-10-06 00:55:54 +02:00

Conversation 4 Commits 1 Files changed 3 +10 -6

claude commented 2026-10-06 00:39:20 +02:00

Member

• Copy link
• Copy Markdown

Summary

Two small pre-existing defects, found while reviewing PR #1546.

• g7 and g9 (toolkit-self-gates.yml) ended in a double-quoted echo with backticks around check. Bash ran it as a command, so each log had check: command not found and the NOTE printed (the job does) with the name missing. The backticks are now escaped (\``), the same form go-ci.yml:190uses. The name was stale too:manifest-check.ymlandregister-check.ymlare gone. So the NOTE now names themanifestandregistergates ofpr / gates`.
• mirror-release.yml (set-adopter-pin, about line 289): the comment said readme-pin-check.yml posts both verdicts on a PR. Since #1540 it posts only the mirror verdict, and the digest verdict is g14 of toolkit-self-gates.yml. The comment now names both. The Gitea twin is regenerated with rt gitea-twin --write. The file is twinned but not baked: it is not in canonicalFiles.

Refs #1555

Decision tree

• Escape or single-quote? Single quotes are right when the string has no apostrophe. Both lines contain repo's, so single quotes would need '\'' splicing. Escaping the backticks is right here: it is one character each and matches go-ci.yml:190.
• Keep the old wording or update it? Escaping alone is right when the named job still exists. It does not, so the escaped text would print a dead name. Updating it costs one phrase per line.

Scope check

A quote-aware scan of every run: block in .forgejo/workflows/*.yml and .gitea/workflows/*.yml finds live backticks (outside single quotes, comments and heredoc bodies) only in g7 and g9 before this change, and none after. mirror-drift-check.yml:227 already escapes its own.

Tests

In an LF clone, at head a4aab90:

• go test -count=1 ./... (native): all ok.
• bats tests/ in docker rt-bats:local: 1..241, 241 ok.
• rt gitea-twin --check: PASS - 6 twin(s) match their source. Only .gitea/workflows/mirror-release.yml changed on --write.
• rt check-self-bootstrap: floating-pin pass, pinned_ref: main.
• The two edited echo lines, run under bash -eo pipefail, print the backticked names literally and no error.
• Added lines are ASCII-only (AGENTS.md section 11). mirror-release.yml already had non-ASCII comments before this change; this PR does not touch them.

I'll read the g7 and g9 job logs on this PR's toolkit-self-gates run and post them as a comment.

Self-bootstrap (AGENTS.md section 2)

No re-pin: toolkit-self floats @main (AGENTS.md section 2.1). Nothing here touches a reusable or gates.DefaultComposeScripts. Adopters see nothing.

no-changelog: toolkit-self CI log text and a comment only; no adopter sees it

Verify at source (@alex)

Please check against the tree:

1. The two echo lines in g7 and g9, and that pr / gates has manifest and register gates (reusable-pr-gates.yml).
2. The mirror-release.yml comment against g14 in toolkit-self-gates.yml.
3. The g7 and g9 logs on this PR's run (I'll post them below).

🤖 Generated with Claude Code

## Summary Two small pre-existing defects, found while reviewing PR #1546. - **g7 and g9** (`toolkit-self-gates.yml`) ended in a double-quoted `echo` with backticks around `check`. Bash ran it as a command, so each log had `check: command not found` and the NOTE printed `(the job does)` with the name missing. The backticks are now escaped (`\``), the same form `go-ci.yml:190` uses. The name was stale too: `manifest-check.yml` and `register-check.yml` are gone. So the NOTE now names the `manifest` and `register` gates of `pr / gates`. - **`mirror-release.yml`** (`set-adopter-pin`, about line 289): the comment said readme-pin-check.yml posts both verdicts on a PR. Since #1540 it posts only the mirror verdict, and the digest verdict is g14 of `toolkit-self-gates.yml`. The comment now names both. The Gitea twin is regenerated with `rt gitea-twin --write`. The file is twinned but not baked: it is not in `canonicalFiles`. Refs #1555 ## Decision tree - **Escape or single-quote?** Single quotes are right when the string has no apostrophe. Both lines contain `repo's`, so single quotes would need `'\''` splicing. Escaping the backticks is right here: it is one character each and matches `go-ci.yml:190`. - **Keep the old wording or update it?** Escaping alone is right when the named job still exists. It does not, so the escaped text would print a dead name. Updating it costs one phrase per line. ## Scope check A quote-aware scan of every `run:` block in `.forgejo/workflows/*.yml` and `.gitea/workflows/*.yml` finds live backticks (outside single quotes, comments and heredoc bodies) only in g7 and g9 before this change, and none after. `mirror-drift-check.yml:227` already escapes its own. ## Tests In an LF clone, at head `a4aab90`: - `go test -count=1 ./...` (native): all ok. - `bats tests/` in docker `rt-bats:local`: `1..241`, 241 ok. - `rt gitea-twin --check`: `PASS - 6 twin(s) match their source.` Only `.gitea/workflows/mirror-release.yml` changed on `--write`. - `rt check-self-bootstrap`: floating-pin pass, `pinned_ref: main`. - The two edited `echo` lines, run under `bash -eo pipefail`, print the backticked names literally and no error. - Added lines are ASCII-only (AGENTS.md section 11). `mirror-release.yml` already had non-ASCII comments before this change; this PR does not touch them. I'll read the g7 and g9 job logs on this PR's `toolkit-self-gates` run and post them as a comment. ## Self-bootstrap (AGENTS.md section 2) No re-pin: toolkit-self floats `@main` (AGENTS.md section 2.1). Nothing here touches a reusable or `gates.DefaultComposeScripts`. Adopters see nothing. no-changelog: toolkit-self CI log text and a comment only; no adopter sees it ## Verify at source (@alex) Please check against the tree: 1. The two `echo` lines in g7 and g9, and that `pr / gates` has `manifest` and `register` gates (`reusable-pr-gates.yml`). 2. The `mirror-release.yml` comment against g14 in `toolkit-self-gates.yml`. 3. The g7 and g9 logs on this PR's run (I'll post them below). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude added 1 commit 2026-10-06 00:39:20 +02:00

chore(ci): stop g7/g9 running a backticked word; refresh a stale mirror-release comment ... a4aab90b2b

g7 and g9 of toolkit-self-gates.yml ended in a double-quoted echo with
backticks around `check`, so bash ran it as a command substitution and
logged "check: command not found" (run 19639). The name was stale as
well: manifest-check.yml and register-check.yml are gone, and the real
scans run as the manifest and register gates of pr / gates. The
backticks are now escaped and the NOTE names those gates.

mirror-release.yml's set-adopter-pin comment said readme-pin-check.yml
posts both verdicts on a PR. Since #1540 the digest verdict is g14 of
toolkit-self-gates.yml. The Gitea twin is regenerated with
rt gitea-twin --write.

Refs #1555

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude requested review from alex 2026-10-06 00:39:24 +02:00

claude commented 2026-10-06 00:42:38 +02:00

Author

Member

• Copy link
• Copy Markdown

CI on head a4aab90b2b35a1974ba319cf6baa610e8f9d2642: all 18 commit-status contexts are success. Evidence below comes from the job logs, not the run status.

toolkit-self-gates run 19916, g7 (last two lines):

NOTE: grades the PR's own rt against a SCRATCH tree. Does NOT check this
repo's real manifest (the `manifest` gate of `pr / gates` does) nor the adopter FETCH arm.

g9:

[register-check] OK: 0 register-drift hits in stdin content.
NOTE: grades the PR's own rt on ONE line each way. Does NOT scan this
repo's surface (the `register` gate of `pr / gates` does) and does NOT exercise --git-log.

Neither step has a command not found line. On main's run 19639, each one did (g7.sh: line 33, g9.sh: line 5).

g11 (gitea-twin): gitea-twin: PASS - 6 twin(s) match their source.
attest: all 14 gate steps AND the shared-tree guard ran (15 of 15 reported success or failure), and every green gate wrote its own verdict and no other.

pr run 19913, plan job: fragment-coverage: PASS - legitimate none: no-changelog reason="toolkit-self CI log text and a comment only; no adopter sees it". Attest saw all 6 gates. The run list's API reports this run as blocked, although its plan job is green and the split jobs were skipped in combined mode. Every pr / ... context posted success.

Head for review: a4aab90b2b35a1974ba319cf6baa610e8f9d2642.

CI on head `a4aab90b2b35a1974ba319cf6baa610e8f9d2642`: all 18 commit-status contexts are `success`. Evidence below comes from the job logs, not the run status. **`toolkit-self-gates` run 19916, g7** (last two lines): ``` NOTE: grades the PR's own rt against a SCRATCH tree. Does NOT check this repo's real manifest (the `manifest` gate of `pr / gates` does) nor the adopter FETCH arm. ``` **g9:** ``` [register-check] OK: 0 register-drift hits in stdin content. NOTE: grades the PR's own rt on ONE line each way. Does NOT scan this repo's surface (the `register` gate of `pr / gates` does) and does NOT exercise --git-log. ``` Neither step has a `command not found` line. On main's run 19639, each one did (`g7.sh: line 33`, `g9.sh: line 5`). **g11 (gitea-twin):** `gitea-twin: PASS - 6 twin(s) match their source.` **attest:** `all 14 gate steps AND the shared-tree guard ran (15 of 15 reported success or failure), and every green gate wrote its own verdict and no other.` **`pr` run 19913, plan job:** `fragment-coverage: PASS - legitimate none: no-changelog reason="toolkit-self CI log text and a comment only; no adopter sees it"`. Attest saw all 6 gates. The run list's API reports this run as `blocked`, although its plan job is green and the split jobs were skipped in combined mode. Every `pr / ...` context posted `success`. Head for review: `a4aab90b2b35a1974ba319cf6baa610e8f9d2642`.

claude reviewed 2026-10-06 00:55:22 +02:00

claude left a comment

• Copy link
• Copy Markdown

Verdict: APPROVE at a4aab90b2b

Summary: both fixes are correct and complete. g7 and g9 no longer run check as a command, and they now name gates that exist. The mirror-release comment matches what its step runs. My own scan finds no other live backtick in any workflow run: block. Nothing is blocking.

Head pinned with rt review-submit-check (rc=0, READY) immediately before this review. One commit on b342615, which is live main.

Verified at source

• g7 and g9 (toolkit-self-gates.yml:522, :561). Each backtick is now escaped as \``. I ran the two new lines under bash -eo pipefail: they print (the manifest gate of pr / gates does)and(the register gate of pr / gates does)` literally, rc 0.
• The new names are true. scripts/pr-gates.sh gate_manifest runs rt manifest-check --config ... on the real tree, and gate_register runs the rt register-check file scan. Toolkit-self's pr.yml has both gates on. "Does NOT exercise --git-log" still holds for g9 and for the register gate (#1548).
• The mirror-release comment (both providers, same wording). The step that follows runs rt readme-pin-check and then rt tag-action-digest-check, which are exactly the two verdicts the comment now names. g14 of toolkit-self-gates.yml is the PR-time digest check since #1540. The .gitea twin hunk is identical to the .forgejo one, and g11 (gitea-twin --check) passed on this head.
• Added lines are ASCII-only (AGENTS.md section 11).
• No-changelog is declared in the body, and Refs #1555 has no close keyword.

The scope claim, re-measured independently

I wrote my own quote-aware scanner. It tracks single and double quotes, skips comments, and skips quoted heredoc bodies but still checks unquoted ones. I ran it over every run: | block in .forgejo/workflows/*.yml and .gitea/workflows/*.yml:

• main (b342615): exactly 2 hits, toolkit-self-gates.yml:522 and :561, the g7 and g9 lines.
• This head: 0 hits.

So the scanner tells the defect apart from its fix, and the PR's "only g7 and g9" holds.

CI, read in job logs (Axis C)

18 statuses, all success. toolkit-self-gates (run 19916, job 0, commit a4aab90b2b):

• command not found appears nowhere in the job log. On main's run 19639 it appeared once in g7 and once in g9.
• The two NOTE lines print repo's real manifest (the manifestgate ofpr / gates does) nor the adopter FETCH arm. and repo's surface (the registergate ofpr / gates does) and does NOT exercise --git-log.
• g7 and g9 succeed, and attest reads 15 of 15.

Next: Alex approves and merges, then #1555 is ticked and closed by hand.

Verdict: APPROVE at a4aab90b2b35a1974ba319cf6baa610e8f9d2642 Summary: both fixes are correct and complete. g7 and g9 no longer run `check` as a command, and they now name gates that exist. The mirror-release comment matches what its step runs. My own scan finds no other live backtick in any workflow `run:` block. Nothing is blocking. Head pinned with `rt review-submit-check` (rc=0, READY) immediately before this review. One commit on `b342615`, which is live main. ## Verified at source - **g7 and g9 (`toolkit-self-gates.yml:522`, `:561`).** Each backtick is now escaped as `\``. I ran the two new lines under `bash -eo pipefail`: they print `(the `manifest` gate of `pr / gates` does)` and `(the `register` gate of `pr / gates` does)` literally, rc 0. - **The new names are true.** `scripts/pr-gates.sh` `gate_manifest` runs `rt manifest-check --config ...` on the real tree, and `gate_register` runs the `rt register-check` file scan. Toolkit-self's `pr.yml` has both gates on. "Does NOT exercise --git-log" still holds for g9 and for the register gate (#1548). - **The mirror-release comment** (both providers, same wording). The step that follows runs `rt readme-pin-check` and then `rt tag-action-digest-check`, which are exactly the two verdicts the comment now names. g14 of `toolkit-self-gates.yml` is the PR-time digest check since #1540. The `.gitea` twin hunk is identical to the `.forgejo` one, and g11 (`gitea-twin --check`) passed on this head. - **Added lines are ASCII-only** (AGENTS.md section 11). - **No-changelog** is declared in the body, and `Refs #1555` has no close keyword. ## The scope claim, re-measured independently I wrote my own quote-aware scanner. It tracks single and double quotes, skips comments, and skips quoted heredoc bodies but still checks unquoted ones. I ran it over every `run: |` block in `.forgejo/workflows/*.yml` and `.gitea/workflows/*.yml`: - **main (`b342615`):** exactly 2 hits, `toolkit-self-gates.yml:522` and `:561`, the g7 and g9 lines. - **This head:** 0 hits. So the scanner tells the defect apart from its fix, and the PR's "only g7 and g9" holds. ## CI, read in job logs (Axis C) 18 statuses, all success. `toolkit-self-gates` (run 19916, job 0, commit a4aab90b2b): - `command not found` appears nowhere in the job log. On main's run 19639 it appeared once in g7 and once in g9. - The two NOTE lines print `repo's real manifest (the `manifest` gate of `pr / gates` does) nor the adopter FETCH arm.` and `repo's surface (the `register` gate of `pr / gates` does) and does NOT exercise --git-log.` - g7 and g9 succeed, and attest reads `15 of 15`. **Next:** Alex approves and merges, then #1555 is ticked and closed by hand.

alex approved these changes 2026-10-06 00:55:49 +02:00

alex merged commit a4aab90b2b into main 2026-10-06 00:55:54 +02:00

alex deleted branch claude/1555-backtick-echo-stale-comment 2026-10-06 00:55:54 +02:00

forgejo-actions commented 2026-10-06 00:56:44 +02:00

• Copy link
• Copy Markdown

Landing identity record

• PR: #1556
• landed commit (server merge_commit_sha): a4aab90b2b35a1974ba319cf6baa610e8f9d2642
• effective official approval(s):
  • @alex, review #7265, stamped commit: a4aab90b2b35a1974ba319cf6baa610e8f9d2642
• replay comparison: no identity change (stamped SHA equals landed SHA)

This is a post-merge identity record. It does not retroactively review the landed object; it records whether the server landed the object that an official approval named.

<!-- release-toolkit:landing-review-record-v1 landed=a4aab90b2b35a1974ba319cf6baa610e8f9d2642 --> ## Landing identity record - PR: #1556 - landed commit (server merge_commit_sha): `a4aab90b2b35a1974ba319cf6baa610e8f9d2642` - effective official approval(s): - @alex, review #7265, stamped commit: `a4aab90b2b35a1974ba319cf6baa610e8f9d2642` - replay comparison: no identity change (stamped SHA equals landed SHA) This is a post-merge identity record. It does not retroactively review the landed object; it records whether the server landed the object that an official approval named.

Sign in to join this conversation.

Reviewers

No reviewers

alex

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind

bug

Something is broken

  

kind

chore

Maintenance, tooling, refactor

  

kind

docs

Documentation work

  

kind

epic

Tracker: its acceptance criteria are sub-issues; closed by hand when all are ticked

  

kind

feature

New feature or capability

  

loop/paused

rt-bugfix-loop kill switch: while this is on the loop log issue, no round claims or merges

  

mirror-drift

Automated: a release here has no asset-bearing counterpart on the mirror. One tracker per drift episode; the check never reopens a closed one (#1586)

  

priority

critical

Critical: must be addressed immediately

  

priority

high

Important, should be addressed soon

  

priority

low

Low priority, address when convenient

  

priority

medium

Normal priority

  

size

L

Large: significant feature, ~6-16h

  

size

M

Medium: moderate feature, ~2-6h

  

size

S

Small: simple change, ~1-2h

  

size

XL

Extra large: major feature or refactor, 16h+

  

status

blocked

Cannot start until a named dependency resolves

No labels

bump

major

bump

minor

bump

patch

kind

bug

kind

chore

kind

docs

kind

epic

kind

feature

loop/paused

mirror-drift

priority

critical

priority

high

priority

low

priority

medium

size

L

size

M

size

S

size

XL

status

blocked

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

3 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

frankenbit/release-toolkit!1556

No description provided.