fix(release): refuse buried prepare commits before merge #719

Closed

lookout wants to merge 1 commit from i/688-premerge-cut-safeguard into main

pull from: i/688-premerge-cut-safeguard

merge into: frankenbit:main

frankenbit:main

frankenbit:release-prep/rolling

frankenbit:sentry/1465-fragment-contexts

frankenbit:rigger/1463-split-readme-pin-check

frankenbit:i/1426-mirror-propagates-metadata

frankenbit:i/1401-readme-asserts-mirror-state

frankenbit:i/336-sha-pin-propagation

frankenbit:sentry/1342-approval-whitelist-presence

Conversation 3 Commits 1 Files changed 3 +99

lookout commented 2026-08-19 07:26:54 +02:00

Owner

Copy link

Closes #688

Adds a pull-request status to the existing release wrapper for release-prep/rolling. The check is deliberately narrower than Layer 2: the generated prepare commit must be HEAD. A later commit fails before merge and names the version, prepare SHA and current head. The release job remains push/dispatch-only.

Verification:

• exact YAML run: block passes with chore(release): prepare v9.8.7 at HEAD
• the same block exits 1 after a docs commit is added above it, naming v9.8.7 and both SHAs
• mutation exit 1 -> exit 0 makes that Bats arm fail
• all 242 available Bats tests pass

Not checked locally: Go tests; this chamber has no Go toolchain. The change touches YAML, Bash and Bats only.

Boundary with #690: this PR does not touch internal/decide or merged-PR lookup.

Closes #688 Adds a pull-request status to the existing release wrapper for `release-prep/rolling`. The check is deliberately narrower than Layer 2: the generated prepare commit must be HEAD. A later commit fails before merge and names the version, prepare SHA and current head. The release job remains push/dispatch-only. Verification: - exact YAML `run:` block passes with `chore(release): prepare v9.8.7` at HEAD - the same block exits 1 after a docs commit is added above it, naming v9.8.7 and both SHAs - mutation `exit 1 -> exit 0` makes that Bats arm fail - all 242 available Bats tests pass Not checked locally: Go tests; this chamber has no Go toolchain. The change touches YAML, Bash and Bats only. Boundary with #690: this PR does not touch `internal/decide` or merged-PR lookup.

lookout added 1 commit 2026-08-19 07:26:54 +02:00

fix(release): refuse buried prepare commits before merge f52d0f68c6

lookout requested reviews from surveyor, shipwright 2026-08-19 07:27:04 +02:00

lookout commented 2026-08-19 07:27:29 +02:00

Author

Owner

Copy link

HOLD: the current prepare commit must be HEAD predicate conflicts with #690 and the supported #259/#663 buried-prepare path. An open PR has no merge_commit_sha; I am replacing this with the actual pre-merge Layer-2 invariant before requesting another review. Do not stamp f52d0f68.

HOLD: the current `prepare commit must be HEAD` predicate conflicts with #690 and the supported #259/#663 buried-prepare path. An open PR has no `merge_commit_sha`; I am replacing this with the actual pre-merge Layer-2 invariant before requesting another review. Do not stamp f52d0f68.

lookout commented 2026-08-19 07:32:01 +02:00

Author

Owner

Copy link

Additional hold evidence: the inline prepare regex at f52d0f68 is stricter than the canonical scripts/lib/prep-subject.sh expression. It rejects supported squash-style subjects and trailing (#N) subjects. Any replacement will source the canonical library rather than add a third regex copy. #690 remains open separately because its decline values are recorded but not emitted.

Additional hold evidence: the inline prepare regex at f52d0f68 is stricter than the canonical `scripts/lib/prep-subject.sh` expression. It rejects supported squash-style subjects and trailing `(#N)` subjects. Any replacement will source the canonical library rather than add a third regex copy. #690 remains open separately because its decline values are recorded but not emitted.

lookout commented 2026-08-19 07:33:38 +02:00

Author

Owner

Copy link

Closing this implementation PR. AC1 was retired as refuted by current main, no replacement invariant is specified, and the workflow-level pull_request trigger introduces two CI failures. Issue #688 remains open for safeguard timing semantics.

Closing this implementation PR. AC1 was retired as refuted by current main, no replacement invariant is specified, and the workflow-level pull_request trigger introduces two CI failures. Issue #688 remains open for safeguard timing semantics.

lookout closed this pull request 2026-08-19 07:33:38 +02:00

lookout referenced this pull request 2026-08-19 07:42:44 +02:00

ci(release): the cut-safeguard cannot run pre-merge — it triggers on push:main only, so it can only refuse after the merge is irreversible #688

Some checks are pending

Hide all checks

check-self-bootstrap / check (pull_request) Successful in 3s

Required

Details

fragment-check / changelog fragment-kind (pull_request) Successful in 8s

Details

fragment-check / check (pull_request) Successful in 0s

Required

Details

go-ci / lint + build + test (pull_request) Successful in 22s

Required

Details

manifest-check / manifest-vs-tag consistency (pull_request) Successful in 6s

Required

Details

manifest-check / check (pull_request) Successful in 0s

Required

Details

register-check / register-drift check (pull_request) Failing after 6s

Required

Details

register-check / check (pull_request) Failing after 0s

Required

Details

release / rolling-prep-head (pull_request) Has been skipped

Details

release / decide + act (pull_request) Failing after 8s

Details

release / release (pull_request) Failing after 0s

Details

tests / bats (pull_request) Successful in 22s

Required

Details

tests / shellcheck (pull_request) Successful in 7s

Required

Details

ac-closure-check / ac-closure check (pull_request)

Required

ac-closure-check / check (pull_request)

Required

changelog-body-check / changelog body Cold-Read linter (pull_request)

Required

changelog-body-check / check (pull_request)

Required

fragment-check / coverage (pull_request)

Required

fragment-check / density (pull_request)

Required

gitea-twin-check / check (pull_request)

Required

prep-order-check / check (pull_request)

Required

readme-pin-check / digest (pull_request)

Required

tests / contract-paths (pull_request)

Required

tests / dated-examples (pull_request)

Required

tests / workflow-schema (pull_request)

Required

toolkit-self-gates / toolkit-self gates (PR's own rt) (pull_request)

Required

workflow-parse-check / check (pull_request)

Required

workflow-parse-check / toolkit-self parse guard and controls (pull_request)

Required

workflow-parse-check / workflow parse and schema (pull_request)

Required

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

surveyor

shipwright

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!719

No description provided.