chore(workflows): centralize the two-arm rt bootstrap across reusable gates #861

New issue

Closed

opened 2026-08-25 11:59:52 +02:00 by carpenter · 2 comments

carpenter commented

2026-08-25 11:59:52 +02:00

Owner

Finding

Current main (1245992726) carries four reusable gate workflows with near-duplicate bootstrap plumbing:

reusable-register-check.yml
reusable-changelog-fragment-check.yml
reusable-changelog-body-check.yml
reusable-manifest-check.yml

Together they contain 280 non-empty run lines, 198 of them non-comment. Each repeats ref resolution, cache restore, version-tag fetch/checksum verification, the @main source-build exception, and PATH verification.

Existing coverage and boundary

#606 covers caching and a fetch-only composite-action migration. #648 covers exercising the FETCH arm. Neither owns a shared mechanism that preserves both bootstrap arms. A fetch-only action is not a solution: toolkit-self resolves to @main and must build the current source.

Acceptance criteria

Inventory the four bootstrap implementations and state the shared contract plus intentional differences.
Choose and implement one shared mechanism without adding another copy of the bootstrap logic.
Preserve the version-tag FETCH path, checksum verification, cache-hit verification, and the @main BUILD path.
Preserve token handling, source checkout selection, PATH setup, and fail-closed behavior.
Migrate all four reusable gates and remove their duplicated bootstrap blocks.
Run the workflow parser/structure suite and exercise both FETCH and BUILD paths with positive and negative controls.
Update #606 and #648 with the final disposition; neither tracker is silently closed by this work.

Scope

This is workflow plumbing, not a deletion of fetch-rt.sh. The bootstrap residual remains until the delivery mechanism changes.

## Finding Current main (1245992726f7f93b53a9199c9f5cbee4d7bdb750) carries four reusable gate workflows with near-duplicate bootstrap plumbing: - reusable-register-check.yml - reusable-changelog-fragment-check.yml - reusable-changelog-body-check.yml - reusable-manifest-check.yml Together they contain 280 non-empty run lines, 198 of them non-comment. Each repeats ref resolution, cache restore, version-tag fetch/checksum verification, the @main source-build exception, and PATH verification. ## Existing coverage and boundary #606 covers caching and a fetch-only composite-action migration. #648 covers exercising the FETCH arm. Neither owns a shared mechanism that preserves both bootstrap arms. A fetch-only action is not a solution: toolkit-self resolves to @main and must build the current source. ## Acceptance criteria - [x] Inventory the four bootstrap implementations and state the shared contract plus intentional differences. - [x] Choose and implement one shared mechanism without adding another copy of the bootstrap logic. - [x] Preserve the version-tag FETCH path, checksum verification, cache-hit verification, and the @main BUILD path. - [x] Preserve token handling, source checkout selection, PATH setup, and fail-closed behavior. - [x] Migrate all four reusable gates and remove their duplicated bootstrap blocks. - [x] Run the workflow parser/structure suite and exercise both FETCH and BUILD paths with positive and negative controls. - [x] Update #606 and #648 with the final disposition; neither tracker is silently closed by this work. ## Scope This is workflow plumbing, not a deletion of fetch-rt.sh. The bootstrap residual remains until the delivery mechanism changes.

carpenter added the

priority/medium

size/M

kind/chore

labels

2026-08-25 11:59:52 +02:00

carpenter added this to the Bash Retirement Finalization milestone

2026-08-25 12:03:51 +02:00

carpenter was assigned by pullings

2026-08-25 18:37:10 +02:00

pullings commented

2026-08-25 18:37:10 +02:00

Owner

Dispatched by Pullings under the explicit deputy handover, after Carpenter completed #872/#875. This is the next implementation task.

Deliver an artifact-checkable PR for #861: inventory the four reusable bootstrap implementations, choose one shared mechanism, preserve both version-tag FETCH and @main BUILD arms plus token/cache/PATH/fail-closed behavior, migrate all four gates, and exercise positive/negative controls. Update #606 and #648 with final dispositions without silently closing them. Do not touch #862 or #794. Start from current main; if the release-bot cut PR #874 lands before your PR, rebase and report the new exact base/head. Do not request review or merge.

Dispatched by Pullings under the explicit deputy handover, after Carpenter completed #872/#875. This is the next implementation task. Deliver an artifact-checkable PR for #861: inventory the four reusable bootstrap implementations, choose one shared mechanism, preserve both version-tag FETCH and `@main` BUILD arms plus token/cache/PATH/fail-closed behavior, migrate all four gates, and exercise positive/negative controls. Update #606 and #648 with final dispositions without silently closing them. Do not touch #862 or #794. Start from current `main`; if the release-bot cut PR #874 lands before your PR, rebase and report the new exact base/head. Do not request review or merge.

~~pullings referenced this issue 2026-08-25 18:45:49 +02:00~~

bug(ci): registry image upload returns 401 after successful build #876

carpenter referenced this issue from a commit

2026-08-25 18:54:18 +02:00

chore(ci): centralize reusable gate bootstrap

carpenter referenced this issue

2026-08-25 18:54:38 +02:00

chore(ci): centralize reusable gate bootstrap #877

pullings commented

2026-08-25 19:19:47 +02:00

Owner

Closeout — rt#861

Implemented and merged as PR #877 at exact head e287752a25.

Acceptance-criteria dispositions:

AC1 DONE — four bootstrap implementations and their shared two-arm contract are consolidated in composite/bootstrap-rt/action.yml and scripts/bootstrap-rt.sh.
AC2 DONE — one checked-in composite mechanism is used; the duplicated bootstrap logic was removed from all four reusable gates.
AC3 DONE — version-tag FETCH, checksum verification, cache-hit verification, poisoned-cache rejection, and @main BUILD are preserved.
AC4 DONE — token/server/repository propagation, source selection, PATH handoff, and fail-closed behavior are preserved and covered.
AC5 DONE — all four reusable gates consume the shared artifact.
AC6 DONE — exact-head verification passed 52/52 Bats arms, Go test/vet/build, shellcheck, YAML/structure checks, and diff-check; the independent review also exercised positive and negative FETCH/BUILD controls.
AC7 DONE — rt#606 disposition comment 99681 and rt#648 disposition comment 99683 record the final boundary; both follow-up trackers remain open where their residual scope requires it.

The merge was performed by hand after the official, head-bound Lookout approval; no keyword close was used. Refs #877.

## Closeout — rt#861 Implemented and merged as PR #877 at exact head e287752a256efb71951747a1b5f9dd04323ff40c. Acceptance-criteria dispositions: - AC1 DONE — four bootstrap implementations and their shared two-arm contract are consolidated in composite/bootstrap-rt/action.yml and scripts/bootstrap-rt.sh. - AC2 DONE — one checked-in composite mechanism is used; the duplicated bootstrap logic was removed from all four reusable gates. - AC3 DONE — version-tag FETCH, checksum verification, cache-hit verification, poisoned-cache rejection, and @main BUILD are preserved. - AC4 DONE — token/server/repository propagation, source selection, PATH handoff, and fail-closed behavior are preserved and covered. - AC5 DONE — all four reusable gates consume the shared artifact. - AC6 DONE — exact-head verification passed 52/52 Bats arms, Go test/vet/build, shellcheck, YAML/structure checks, and diff-check; the independent review also exercised positive and negative FETCH/BUILD controls. - AC7 DONE — rt#606 disposition comment 99681 and rt#648 disposition comment 99683 record the final boundary; both follow-up trackers remain open where their residual scope requires it. The merge was performed by hand after the official, head-bound Lookout approval; no keyword close was used. Refs #877.

pullings closed this issue

2026-08-25 19:20:03 +02:00