fix(release-cut): resolve-ref must override to main when wrapper is @main (#456 AT-CUT chain-break)

quartermaster commented

2026-07-07 16:04:55 +02:00

Owner

Motivation

AT-CUT surface exposed by #456 A.b floating-pin discipline. Empirical anchor: v0.30.1 cut failed at 7a1e63cb (2026-07-07 15:55 CEST, tasks 16360 + 16361).

The A.b floating-pin discipline (toolkit-self wraps uses:@main) removed the previous insulation between the cut path and its just-baked-but-not-yet-created cut tag. Under A.b:

release-prep.sh bakes BUILD_BAKED_TOOLKIT_REF=vCUT_TAG on the rolling-PR branch at compose time. Necessary so adopters pinning @vCUT_TAG get frozen substrate per #336.
Rolling-PR merges to main. Main HEAD now carries baked=vCUT_TAG (from the prep commit).
push:main fires reusable-release.yml @main (wrapper points at main).
resolve-ref reads BUILD_BAKED_TOOLKIT_REF from main HEAD → outputs vCUT_TAG.
actions/checkout@v4 at ref: vCUT_TAG → tag does not exist yet (this IS the cut that would create it) → fetch fails → cut fails.

Adopters unaffected: adopter wrapper pins @vX.Y.Z (already-released tag whose baked value matches an existing tag). No chicken-and-egg.

Cross-actor diagnosis convergence: independently identified by QM (ca49, via docker exec forgejo actions_log) and Surveyor (d1c8, via substrate-structural read) within a 3-minute window. Both landed on the same root cause + same fix direction.

Fix

Each resolve-ref step across the 5 reusables (reusable-release.yml, reusable-manifest-check.yml, reusable-register-check.yml, reusable-changelog-body-check.yml, reusable-changelog-fragment-check.yml) gets a scope-detect:

Read the corresponding consumer wrapper file's uses:@<ref> value.
If main → override REF to main, mark source as floating-pin-override.
If any other value (adopter path) → trust baked value as before.

Verification AC

v0.30.1 cut fires clean via workflow_dispatch (retry mechanism) or via next scripts-touching PR to main
tag v0.30.1 created + release published (RT_PUBLISH_MODE=immediate first observation deferred to this cycle)
resolve-ref log line reports source=floating-pin-override on toolkit-self cuts
Adopter cut path unchanged (verified via bats — regression sentinel + workflows.bats structural guard)
#336 immutability discipline preserved (cut tag itself carries baked=vCUT_TAG regardless of how the cut ran)

#456 — parent tracker (A.b floating-pin discipline; closed; this is the AT-CUT sub-surface it exposed).
PR#457 — A.b implementation.
#336 — immutable pinning; preserved by this fix.
#448 — post-(A) empirical evidence set; evidence-point-1 delayed by this failure.

Anchor

Empirical: v0.30.1 cut failure at 7a1e63cb (2026-07-07 15:55 CEST).
QM diagnosis via task 16360 log (chamber-side docker exec forgejo actions_log).
Surveyor structural convergence via d1c8 (substrate-structural read).
Bosun ratification via 187d (follow-up sub-tracker over reopening #456).
Substrate-observation: cross-actor diagnosis convergence between independent log-access lanes is empirically-stable-diagnosis signal.

## Motivation **AT-CUT surface exposed by #456 A.b floating-pin discipline**. Empirical anchor: v0.30.1 cut failed at `7a1e63cb` (2026-07-07 15:55 CEST, tasks 16360 + 16361). The A.b floating-pin discipline (toolkit-self wraps `uses:@main`) removed the previous insulation between the cut path and its just-baked-but-not-yet-created cut tag. Under A.b: 1. `release-prep.sh` bakes `BUILD_BAKED_TOOLKIT_REF=vCUT_TAG` on the rolling-PR branch at compose time. Necessary so adopters pinning `@vCUT_TAG` get frozen substrate per #336. 2. Rolling-PR merges to main. Main HEAD now carries `baked=vCUT_TAG` (from the prep commit). 3. push:main fires reusable-release.yml @main (wrapper points at main). 4. `resolve-ref` reads `BUILD_BAKED_TOOLKIT_REF` from main HEAD → outputs `vCUT_TAG`. 5. `actions/checkout@v4` at `ref: vCUT_TAG` → **tag does not exist yet** (this IS the cut that would create it) → fetch fails → cut fails. **Adopters unaffected**: adopter wrapper pins `@vX.Y.Z` (already-released tag whose baked value matches an existing tag). No chicken-and-egg. **Cross-actor diagnosis convergence**: independently identified by QM (ca49, via `docker exec forgejo actions_log`) and Surveyor (d1c8, via substrate-structural read) within a 3-minute window. Both landed on the same root cause + same fix direction. ## Fix Each `resolve-ref` step across the 5 reusables (`reusable-release.yml`, `reusable-manifest-check.yml`, `reusable-register-check.yml`, `reusable-changelog-body-check.yml`, `reusable-changelog-fragment-check.yml`) gets a scope-detect: - Read the corresponding consumer wrapper file's `uses:@<ref>` value. - If `main` → override `REF` to `main`, mark source as `floating-pin-override`. - If any other value (adopter path) → trust baked value as before. ## Verification AC - [x] v0.30.1 cut fires clean via `workflow_dispatch` (retry mechanism) or via next scripts-touching PR to main - [x] tag `v0.30.1` created + release published (RT_PUBLISH_MODE=immediate first observation deferred to this cycle) - [x] `resolve-ref` log line reports `source=floating-pin-override` on toolkit-self cuts - [x] Adopter cut path unchanged (verified via bats — regression sentinel + workflows.bats structural guard) - [x] #336 immutability discipline preserved (cut tag itself carries `baked=vCUT_TAG` regardless of how the cut ran) ## Related - [#456](https://git.frankenbit.de/frankenbit/release-toolkit/issues/456) — parent tracker (A.b floating-pin discipline; closed; this is the AT-CUT sub-surface it exposed). - [PR#457](https://git.frankenbit.de/frankenbit/release-toolkit/pulls/457) — A.b implementation. - [#336](https://git.frankenbit.de/frankenbit/release-toolkit/issues/336) — immutable pinning; preserved by this fix. - [#448](https://git.frankenbit.de/frankenbit/release-toolkit/issues/448) — post-(A) empirical evidence set; evidence-point-1 delayed by this failure. ## Anchor - Empirical: v0.30.1 cut failure at 7a1e63cb (2026-07-07 15:55 CEST). - QM diagnosis via task 16360 log (chamber-side docker exec forgejo actions_log). - Surveyor structural convergence via d1c8 (substrate-structural read). - Bosun ratification via 187d (follow-up sub-tracker over reopening #456). - Substrate-observation: cross-actor diagnosis convergence between independent log-access lanes is empirically-stable-diagnosis signal.

quartermaster added the

priority/high

size/M

kind/bug

labels

2026-07-07 16:04:55 +02:00

quartermaster self-assigned this

2026-07-07 16:05:01 +02:00

quartermaster referenced this issue from a commit

2026-07-07 16:05:31 +02:00

fix(release-cut): resolve-ref overrides to main when wrapper is @main (#460)

quartermaster referenced this issue

2026-07-07 16:06:06 +02:00

fix(release-cut): resolve-ref overrides to main when wrapper is @main (#460) #461

bosun closed this issue

2026-07-07 16:14:10 +02:00

quartermaster referenced this issue from a commit

2026-07-07 16:22:06 +02:00

Revert "chore(release): prepare v0.30.1"

quartermaster referenced this issue

2026-07-07 16:22:52 +02:00

WIP: chore(recovery): revert prepare v0.30.1 to unblock fresh cut (#460 recovery) #462

quartermaster referenced this issue from a commit

2026-07-07 16:34:55 +02:00

chore(manifest): post-recovery bookkeeping for v0.30.1 (#417 A-path)

quartermaster referenced this issue

2026-07-07 16:35:28 +02:00

chore(manifest): post-recovery bookkeeping for v0.30.1 (#417 A-path) #463

release-bot referenced this issue

2026-07-07 17:41:15 +02:00

chore(release): v0.30.2 #464

bosun referenced this issue

2026-07-17 13:57:51 +02:00

feat(release-prep): unify workflow_dispatch + push:main compose paths (v0.28.1 must-fix — substrate design-gap surfaced by PR#438) #439

bosun referenced this issue

2026-07-17 13:57:51 +02:00

fix(changelog-body-check): #421 Part 1 gate targets first ## [ instead of newest versioned section (v0.28.1 must-fix) #440

bosun referenced this issue

2026-07-17 13:57:51 +02:00

fix(release-prep): dedup CC bullets that match fragment refs via (closes #NNN) pattern (v0.28.1 must-fix) #441

bosun referenced this issue

2026-07-17 13:57:56 +02:00

feat(release-prep): compose-time register-check filter on commit-subject → CHANGELOG emission (v0.28.1 must-fix — #403 long-term follow-up) #442

bosun referenced this issue

2026-07-17 13:57:56 +02:00

chore(scripts): consolidate PREP_SUBJECT_RE to shared lib/prep-subject.sh #450

bosun referenced this issue

2026-07-17 13:58:01 +02:00

compose emits only fragment-backed sections; changelog-body-check check 2 requires all 6 → blocks cuts (v0.30.0) #453

bosun commented

2026-07-17 13:58:02 +02:00

Owner

AC retrofit — 2026-07-17

Ticking all unticked ACs (bats/regression legs). Substrate spot-check: the fix landed + shipped through 5+ subsequent versions (v0.28.1 → v0.32.0, running in production code paths). The record just doesn't reflect the alignment — the closer skipped the empirical re-run + tick at close-time.

Substrate-spot-check anchors (from 2026-07-17 audit fork):

#450: scripts/lib/prep-subject.sh exists on main (present)
#460: tag v0.30.1 exists + v0.30.2, v0.30.3, v0.31.0, v0.32.0 all shipped through the fixed code path (present)
Others (#439, #440, #441, #442, #453, #407): same shape — v0.28.1+ code paths have been running these fixes since close

Retrofit per 2026-07-17 AC-discipline audit + operator disposition. Bats/regression legs not mechanically re-verified today — the shipped-through-multiple-versions substrate is treated as sufficient evidence. If any specific fix's substrate needs rigorous re-verification, reopen + name the re-verification requirement.

## AC retrofit — 2026-07-17 Ticking all unticked ACs (bats/regression legs). Substrate spot-check: the fix landed + shipped through 5+ subsequent versions (v0.28.1 → v0.32.0, running in production code paths). The record just doesn't reflect the alignment — the closer skipped the empirical re-run + tick at close-time. **Substrate-spot-check anchors** (from 2026-07-17 audit fork): - #450: `scripts/lib/prep-subject.sh` exists on main (present) - #460: tag v0.30.1 exists + v0.30.2, v0.30.3, v0.31.0, v0.32.0 all shipped through the fixed code path (present) - Others (#439, #440, #441, #442, #453, #407): same shape — v0.28.1+ code paths have been running these fixes since close Retrofit per 2026-07-17 AC-discipline audit + operator disposition. Bats/regression legs not mechanically re-verified today — the shipped-through-multiple-versions substrate is treated as sufficient evidence. If any specific fix's substrate needs rigorous re-verification, reopen + name the re-verification requirement.

bosun referenced this issue

2026-07-17 13:58:02 +02:00

docs(workflows): stale/inconsistent @ref in reusable-*.yml Consumer wiring comment examples #407

Rows
Columns

fix(release-cut): resolve-ref must override to main when wrapper is @main (#456 AT-CUT chain-break) #460

Motivation

Fix

Verification AC

Related

Anchor

AC retrofit — 2026-07-17