bug(manifest-pr): the #113 self-assign guard hardcodes "release-bot" while the identity is configurable #722

Closed
opened 2026-08-19 07:32:04 +02:00 by shipwright · 3 comments
Owner

The guard and the identity disagree

The #113 auto-assign routes the post-cut manifest PR to whoever merged the rolling PR, and skips
the assignment when that identity is the bot itself:

reusable-release.yml   if [[ -n "$MERGER_LOGIN" && "$MERGER_LOGIN" != "release-bot" ]]; then

But the bot identity is configurable, and release-bot is only its DEFAULT:

reusable-release.yml:660   git config user.name  "${RELEASE_TOOLKIT_GIT_NAME:-release-bot}"
reusable-release.yml:661   git config user.email "${RELEASE_TOOLKIT_GIT_EMAIL:-release-bot@noreply…}"

So a consumer who sets RELEASE_TOOLKIT_GIT_NAME gets the manifest PR assigned to the bot that
just opened it
— the exact outcome the guard exists to prevent. Cosmetic, but it is a
consumer-visible wrong assignee on every cut, and it is invisible to the toolkit itself because the
toolkit uses the default.

Why it is filed rather than fixed

#705 ported this path to rt manifest-pr and carried the literal across deliberately. A
retirement PR that silently changes behaviour is worse than the defect: the whole argument for the
port is that it does the same thing in a testable place. Changing the predicate inside it would
make the diff unreviewable against the bash.

The port pins the gap rather than hiding it — TestManifestPR_SelfAssignGuard has a custom-bot
arm asserting the CURRENT (wrong) behaviour, so whoever fixes this gets a red test pointing here
instead of a silent semantic change.

Fix shape

Thread the configured identity in (the workflow already knows it) and compare against that, with
release-bot as the fallback — mirroring ${RELEASE_TOOLKIT_GIT_NAME:-release-bot} rather than
re-stating half of it.

Anchor

Found by Shipwright while porting the callsite for #705 unit 2.

## The guard and the identity disagree The `#113` auto-assign routes the post-cut manifest PR to whoever merged the rolling PR, and skips the assignment when that identity is the bot itself: ```bash reusable-release.yml if [[ -n "$MERGER_LOGIN" && "$MERGER_LOGIN" != "release-bot" ]]; then ``` **But the bot identity is configurable, and `release-bot` is only its DEFAULT:** ```bash reusable-release.yml:660 git config user.name "${RELEASE_TOOLKIT_GIT_NAME:-release-bot}" reusable-release.yml:661 git config user.email "${RELEASE_TOOLKIT_GIT_EMAIL:-release-bot@noreply…}" ``` So a consumer who sets `RELEASE_TOOLKIT_GIT_NAME` gets the manifest PR **assigned to the bot that just opened it** — the exact outcome the guard exists to prevent. Cosmetic, but it is a consumer-visible wrong assignee on every cut, and it is invisible to the toolkit itself because the toolkit uses the default. ## Why it is filed rather than fixed `#705` ported this path to `rt manifest-pr` and carried the literal across **deliberately**. A retirement PR that silently changes behaviour is worse than the defect: the whole argument for the port is that it does the same thing in a testable place. Changing the predicate inside it would make the diff unreviewable against the bash. The port pins the gap rather than hiding it — `TestManifestPR_SelfAssignGuard` has a `custom-bot` arm asserting the CURRENT (wrong) behaviour, so whoever fixes this gets a red test pointing here instead of a silent semantic change. ## Fix shape Thread the configured identity in (the workflow already knows it) and compare against that, with `release-bot` as the fallback — mirroring `${RELEASE_TOOLKIT_GIT_NAME:-release-bot}` rather than re-stating half of it. ## Anchor Found by **Shipwright** while porting the callsite for `#705` unit 2.
Owner

Delegated to @carpenter under the active deck handover, now that #851 and #796 are complete. Implement the configured bot-identity self-assign fix with a regression control for custom identity and default fallback; keep the change scoped to #722 and do not touch the open release PR #866. Pullings will request Lookout once the PR exists and coordinate the merge.

Delegated to @carpenter under the active deck handover, now that #851 and #796 are complete. Implement the configured bot-identity self-assign fix with a regression control for custom identity and default fallback; keep the change scoped to #722 and do not touch the open release PR #866. Pullings will request Lookout once the PR exists and coordinate the merge.
Owner

Release PR #866 merged fast-forward-only at 55c35c72; #722 is now unblocked for implementation. Pullings will coordinate Lookout review and the eventual merge.

Release PR #866 merged fast-forward-only at 55c35c72; #722 is now unblocked for implementation. Pullings will coordinate Lookout review and the eventual merge.
Owner

Closed by PR #868, merged fast-forward-only at b38c61c049; verified against the merged tree. The workflow now passes the configured BOT_IDENTITY with release-bot fallback to rt manifest-pr --bot-identity; manifest_pr.go retains the same fallback for direct command use. TestManifestPR_SelfAssignGuard covers both default and custom identities in both directions (skip configured bot, assign non-bot merger), plus empty merger. The changelog fragment is present, and the PR’s Go test/vet/build/lint, workflow, fragment, bats, and diff checks passed.

Closed by PR #868, merged fast-forward-only at b38c61c049b4bce445bc72f31eb0b58f03b81c55; verified against the merged tree. The workflow now passes the configured BOT_IDENTITY with release-bot fallback to rt manifest-pr --bot-identity; manifest_pr.go retains the same fallback for direct command use. TestManifestPR_SelfAssignGuard covers both default and custom identities in both directions (skip configured bot, assign non-bot merger), plus empty merger. The changelog fragment is present, and the PR’s Go test/vet/build/lint, workflow, fragment, bats, and diff checks passed.
Sign in to join this conversation.
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
frankenbit/release-toolkit#722
No description provided.