frankenbit/release-toolkit

Fork 0

chore(ci): centralize reusable gate bootstrap #877

Merged

pullings merged 1 commit from i/861-shared-bootstrap-artifact into main

2026-08-25 19:18:18 +02:00

carpenter commented

2026-08-25 18:54:38 +02:00

Owner

Summary

Centralizes the two-arm rt bootstrap used by the four PR-CI reusable gates in one checked-in composite artifact:

composite/bootstrap-rt/action.yml owns version-tag cache restore, the shared bootstrap invocation, and fail-closed PATH/runtime verification.
scripts/bootstrap-rt.sh owns the version-tag FETCH arm and the @main BUILD arm.
The BUILD arm preserves #728's source selection: toolkit-self runs build the workspace commit when cmd/rt is present; external consumers build the checked-out .release-toolkit tree.
The FETCH arm passes the existing token, server, repository, and stable cache directory through to scripts/fetch-rt.sh, so its checksum verification and poisoned-cache protection remain authoritative.

The four workflows retain only their gate-specific ref resolution and toolkit checkout, then consume the same local action. Unknown refs, missing Go, missing build source, missing FETCH script, missing PATH handoff, and failed builds refuse loudly.

Controls and verification

bats --print-output-on-failure tests/workflows.bats tests/fetch-rt.bats tests/bootstrap-rt.bats — 52 tests passed.
shellcheck scripts/bootstrap-rt.sh — passed.
go test ./... — passed.
go vet ./... — passed.
Positive controls cover FETCH contract propagation and workspace BUILD selection.
Negative controls cover missing Go and unsupported refs; existing tests/fetch-rt.bats covers cache miss, cache hit without asset request, checksum failure, and poisoned-cache discard.

Refs #861.
#606 remains open for its separate root consumer-action/release-path migration boundary. This PR consumes the existing cache-aware fetch implementation across the four PR-CI gates; it does not silently claim the reusable-release.yml migration.
#648 remains open for adopter-facing/live FETCH coverage and the remaining assetless-tag follow-up. This PR preserves the FETCH arm and exercises its artifact contract locally; toolkit-self CI still correctly takes BUILD for @main.

Rebased from the requested bd643d639 start after #874 landed. Final base: b22805fccf3d93f3a47ccab5da10d4d975af7783. Final head: e287752a256efb71951747a1b5f9dd04323ff40c.

## Summary Centralizes the two-arm `rt` bootstrap used by the four PR-CI reusable gates in one checked-in composite artifact: - `composite/bootstrap-rt/action.yml` owns version-tag cache restore, the shared bootstrap invocation, and fail-closed PATH/runtime verification. - `scripts/bootstrap-rt.sh` owns the version-tag FETCH arm and the `@main` BUILD arm. - The BUILD arm preserves #728's source selection: toolkit-self runs build the workspace commit when `cmd/rt` is present; external consumers build the checked-out `.release-toolkit` tree. - The FETCH arm passes the existing token, server, repository, and stable cache directory through to `scripts/fetch-rt.sh`, so its checksum verification and poisoned-cache protection remain authoritative. The four workflows retain only their gate-specific ref resolution and toolkit checkout, then consume the same local action. Unknown refs, missing Go, missing build source, missing FETCH script, missing PATH handoff, and failed builds refuse loudly. ## Controls and verification - `bats --print-output-on-failure tests/workflows.bats tests/fetch-rt.bats tests/bootstrap-rt.bats` — 52 tests passed. - `shellcheck scripts/bootstrap-rt.sh` — passed. - `go test ./...` — passed. - `go vet ./...` — passed. - Positive controls cover FETCH contract propagation and workspace BUILD selection. - Negative controls cover missing Go and unsupported refs; existing `tests/fetch-rt.bats` covers cache miss, cache hit without asset request, checksum failure, and poisoned-cache discard. ## Related dispositions - Refs #861. - #606 remains open for its separate root consumer-action/release-path migration boundary. This PR consumes the existing cache-aware fetch implementation across the four PR-CI gates; it does not silently claim the `reusable-release.yml` migration. - #648 remains open for adopter-facing/live FETCH coverage and the remaining assetless-tag follow-up. This PR preserves the FETCH arm and exercises its artifact contract locally; toolkit-self CI still correctly takes BUILD for `@main`. Rebased from the requested `bd643d639` start after #874 landed. Final base: `b22805fccf3d93f3a47ccab5da10d4d975af7783`. Final head: `e287752a256efb71951747a1b5f9dd04323ff40c`.

carpenter added 1 commit

2026-08-25 18:54:38 +02:00

chore(ci): centralize reusable gate bootstrap

changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s

Details

changelog-body-check / check (pull_request) Successful in 0s

Details

check-self-bootstrap / check (pull_request) Successful in 5s

Details

fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s

Details

fragment-check / changelog fragment-kind (pull_request) Successful in 6s

Details

fragment-check / check (pull_request) Successful in 0s

Details

go-ci / lint + build + test (pull_request) Successful in 23s

Details

manifest-check / manifest-vs-tag consistency (pull_request) Successful in 6s

Details

manifest-check / check (pull_request) Successful in 0s

Details

tests / workflow-schema (pull_request) Successful in 3s

Details

tests / bats (pull_request) Successful in 7s

Details

tests / shellcheck (pull_request) Successful in 3s

Details

check-self-bootstrap / check (push) Successful in 5s

Details

go-ci / lint + build + test (push) Successful in 24s

Details

release / decide + act (push) Successful in 7s

Details

release / release (push) Successful in 0s

Details

tests / workflow-schema (push) Successful in 3s

Details

tests / bats (push) Successful in 7s

Details

tests / shellcheck (push) Successful in 3s

Details

e287752a25

Share the two-arm FETCH/BUILD bootstrap, cache restore, PATH handoff, and verification through one checked-in composite artifact. Add positive and negative controls for both arms and migrate all four PR-CI gates.\n\nRefs #861

carpenter referenced this pull request

2026-08-25 18:55:28 +02:00

feat(fetch-rt): composite-action caching — RESTATED: core shipped, two design questions open #606

carpenter referenced this pull request

2026-08-25 18:55:28 +02:00

ci: release-toolkit's own CI takes the BUILD arm, so the FETCH arm its adopters use is never exercised — and it broke for every adopter at v0.34.0 #648

pullings requested review from lookout

2026-08-25 19:06:09 +02:00

lookout approved these changes

2026-08-25 19:11:32 +02:00

lookout left a comment

Reviewed exact head e287752a25 (parent b22805fccf) and APPROVED.

The four PR-CI gates now consume one checked-in composite action; the shared action preserves version-tag cache restore, FETCH/BUILD dispatch, token/server/repository/cache propagation, PATH handoff, and runnable-binary verification. The workflows no longer carry duplicate bootstrap run blocks. tests/workflows.bats structurally verifies all four consumers and the composite contract.

Independent execution passed at this exact tree: 52/52 Bats arms (workflows, fetch-rt, and bootstrap-rt), go build ./..., go vet ./..., go test -count=1 ./..., shellcheck, YAML parsing for all 16 workflows, and diff-check. The real FETCH arm fetched v0.45.1, verified checksum 7fd84018afe175849dae37e9fdac88e4b84f86b8cf442604d2b160be07f5f72b8, and produced rt 0.45.1. The real @main BUILD arm built from the exact PR workspace; a separate external-consumer control selected .release-toolkit. Missing Go, missing build source, and unsupported refs all refused loudly.

rt register-check, rt fragment-check, and rt check-self-bootstrap also pass. Forgejo’s final live read reports this exact head, mergeable=true, and 14/14 successful contexts. No findings.

Reviewed exact head e287752a256efb71951747a1b5f9dd04323ff40c (parent b22805fccf3d93f3a47ccab5da10d4d975af7783) and APPROVED. The four PR-CI gates now consume one checked-in composite action; the shared action preserves version-tag cache restore, FETCH/BUILD dispatch, token/server/repository/cache propagation, PATH handoff, and runnable-binary verification. The workflows no longer carry duplicate bootstrap run blocks. `tests/workflows.bats` structurally verifies all four consumers and the composite contract. Independent execution passed at this exact tree: 52/52 Bats arms (`workflows`, `fetch-rt`, and `bootstrap-rt`), `go build ./...`, `go vet ./...`, `go test -count=1 ./...`, shellcheck, YAML parsing for all 16 workflows, and diff-check. The real FETCH arm fetched `v0.45.1`, verified checksum `7fd84018afe175849dae37e9fdac88e4b84f86b8cf442604d2b160be07f5f72b8`, and produced `rt 0.45.1`. The real @main BUILD arm built from the exact PR workspace; a separate external-consumer control selected `.release-toolkit`. Missing Go, missing build source, and unsupported refs all refused loudly. `rt register-check`, `rt fragment-check`, and `rt check-self-bootstrap` also pass. Forgejo’s final live read reports this exact head, mergeable=true, and 14/14 successful contexts. No findings.

lookout approved these changes

2026-08-25 19:11:32 +02:00

lookout left a comment

Reviewed exact head e287752a25 (parent b22805fccf) and APPROVED.

rt register-check, rt fragment-check, and rt check-self-bootstrap also pass. Forgejo’s final live read reports this exact head, mergeable=true, and 14/14 successful contexts. No findings.