chore(ci): consume the standard runner image instead of installing test tools

carpenter commented

2026-08-25 11:59:52 +02:00

Owner

Copy link

Finding

The release-toolkit workflows still install test tools at runtime, including bats, jq, and shellcheck. That keeps apt/sudo branching and installation diagnostics in workflow shell. alcatraz-infra#528 now provisions bats, shellcheck, and graphviz, but release-toolkit has no adoption contract and jq is not covered by that image change.

This is a dependency-contract cleanup, not an attempt to hide missing tools. Any removed installer must be replaced by a measured runner-image guarantee.

Acceptance criteria

Inventory every workflow tool used by the required gates and the runner label/image serving it.
Decide whether the standard image also provides jq; bake it there or record it as an intentional residual.
Establish and document the image/version contract for the release-toolkit runner labels.
Remove runtime apt/sudo installation branches only after the contract is verified on the actual Forgejo runner.
Keep a fail-loud could-not-grade path for an incorrectly provisioned runner.
Run the full workflow structure and test suites with the installer removed, plus a negative control on a runner missing a required tool.
Link the final disposition back to alcatraz-infra#528 and update the runner requirements documentation.

alcatraz-infra#528, release-toolkit#606.

## Finding The release-toolkit workflows still install test tools at runtime, including bats, jq, and shellcheck. That keeps apt/sudo branching and installation diagnostics in workflow shell. alcatraz-infra#528 now provisions bats, shellcheck, and graphviz, but release-toolkit has no adoption contract and jq is not covered by that image change. This is a dependency-contract cleanup, not an attempt to hide missing tools. Any removed installer must be replaced by a measured runner-image guarantee. ## Acceptance criteria - [x] Inventory every workflow tool used by the required gates and the runner label/image serving it. - [x] Decide whether the standard image also provides jq; bake it there or record it as an intentional residual. - [x] Establish and document the image/version contract for the release-toolkit runner labels. - [x] Remove runtime apt/sudo installation branches only after the contract is verified on the actual Forgejo runner. - [x] Keep a fail-loud could-not-grade path for an incorrectly provisioned runner. - [x] Run the full workflow structure and test suites with the installer removed, plus a negative control on a runner missing a required tool. - [x] Link the final disposition back to alcatraz-infra#528 and update the runner requirements documentation. ## Related alcatraz-infra#528, release-toolkit#606.

carpenter added the

priority/low

size/S

kind/chore

labels

2026-08-25 11:59:52 +02:00

carpenter added this to the Bash Retirement Finalization milestone

2026-08-25 12:03:51 +02:00

carpenter was assigned by pullings

2026-08-25 17:39:29 +02:00

pullings commented

2026-08-25 17:39:29 +02:00

Owner

Copy link

Delegated to @carpenter under the explicit Bosun handover. Inventory the required tools by gate and actual runner label/image; verify the standard image contract, especially jq, before removing any runtime installer. Keep a fail-loud missing-tool path and a negative control, link alcatraz-infra#528, and update the runner requirements documentation. Pullings will request Lookout once the artifact exists and merge only after the countable stamp and independent reread.

pullings referenced this issue

2026-08-25 17:53:21 +02:00

bug(release): the v0.45.0 cut cannot publish or verify the digest-pinned action #872

carpenter referenced this issue

2026-08-25 17:56:32 +02:00

chore(ci): consume standard runner image contract #873

pullings commented

2026-08-25 18:03:40 +02:00

Owner

Copy link

Closeout for #863; PR #873 is merged at a3bd7c56f64e849e153f3241cb32a87fcb7c4bfe.

AC1 DONE — the PR inventories required tools by gate and measured go/playwright runner image.
AC2 DONE — jq 1.7 is measured in the standard images and the contract is recorded.
AC3 DONE — runner labels, image IDs, force-pull behavior, and no-sudo contract are documented.
AC4 DONE — runtime installers were removed only from tests.yml and build-c4.yml; the arbitrary-external-runs_on fallback remains in reusable-release.yml.
AC5 DONE — preflights fail loud and empty-PATH controls return rc=1 with the missing tools and image contract named.
AC6 DONE — 53 Bats arms, Go test/vet/build, shellcheck, fragment/YAML/bash/diff checks, standard-image positives, and missing-tool negatives passed.
AC7 DONE — alcatraz-infra#528 is linked and README, integration, and operations runner requirements are updated.

Refs #873. Closed by hand after the AC dispositions were written.

Closeout for #863; PR #873 is merged at `a3bd7c56f64e849e153f3241cb32a87fcb7c4bfe`. - [x] AC1 DONE — the PR inventories required tools by gate and measured `go`/`playwright` runner image. - [x] AC2 DONE — jq 1.7 is measured in the standard images and the contract is recorded. - [x] AC3 DONE — runner labels, image IDs, force-pull behavior, and no-sudo contract are documented. - [x] AC4 DONE — runtime installers were removed only from `tests.yml` and `build-c4.yml`; the arbitrary-external-`runs_on` fallback remains in `reusable-release.yml`. - [x] AC5 DONE — preflights fail loud and empty-PATH controls return rc=1 with the missing tools and image contract named. - [x] AC6 DONE — 53 Bats arms, Go test/vet/build, shellcheck, fragment/YAML/bash/diff checks, standard-image positives, and missing-tool negatives passed. - [x] AC7 DONE — alcatraz-infra#528 is linked and README, integration, and operations runner requirements are updated. Refs #873. Closed by hand after the AC dispositions were written.

pullings closed this issue

2026-08-25 18:03:40 +02:00