fix(ci): preserve gate refusal and cannot-grade diagnostics #1254

Merged

bosun merged 1 commit from sentry/1226-ci-sentinel-boundary into main 2026-09-06 10:22:02 +02:00

Conversation 1 Commits 1 Files changed 6 +144 -16

sentry commented 2026-09-06 10:06:54 +02:00

Owner

Copy link

Summary

Refs #1226.

The two-sentinel gate contract remains fail-closed while preserving its reader-visible distinction:

• base-divergence-check labels every direct rc=2 path as COULD-NOT-GRADE and rc=1 divergence as REFUSED; it has no workflow caller, so the direct CLI output is the boundary.
• the Goreleaser digest-pin-verify caller captures its exit code before set -e can collapse it, then reports REFUSED (rc=1) versus COULD-NOT-GRADE (rc=2) while returning the original failure code.
• the existing prep-order workflow convention remains the reference for the same distinction.

Verification

Implementation commit: c365d2acdfbe5ea25a17cb11daaeebb30c001e09.

• go test ./...
• go vet ./...
• full Bats: 162/162
• workflow YAML parse and fragment checks
• ShellCheck on the new classifier
• rt gitea-twin --check: 11/11
• git diff --check

The workflow regression arm executes both non-zero classifier paths and asserts the opposite label is absent. Base-divergence tests exercise unreadable fields, fetch/compare failures, disagreement in both directions, and corroborated refusal.

## Summary Refs #1226. The two-sentinel gate contract remains fail-closed while preserving its reader-visible distinction: - `base-divergence-check` labels every direct rc=2 path as `COULD-NOT-GRADE` and rc=1 divergence as `REFUSED`; it has no workflow caller, so the direct CLI output is the boundary. - the Goreleaser `digest-pin-verify` caller captures its exit code before `set -e` can collapse it, then reports `REFUSED (rc=1)` versus `COULD-NOT-GRADE (rc=2)` while returning the original failure code. - the existing prep-order workflow convention remains the reference for the same distinction. ## Verification Implementation commit: `c365d2acdfbe5ea25a17cb11daaeebb30c001e09`. - `go test ./...` - `go vet ./...` - full Bats: 162/162 - workflow YAML parse and fragment checks - ShellCheck on the new classifier - `rt gitea-twin --check`: 11/11 - `git diff --check` The workflow regression arm executes both non-zero classifier paths and asserts the opposite label is absent. Base-divergence tests exercise unreadable fields, fetch/compare failures, disagreement in both directions, and corroborated refusal.

sentry added 1 commit 2026-09-06 10:06:54 +02:00

fix(ci): preserve gate refusal and cannot-grade diagnostics c365d2acdf

pullings requested review from lookout 2026-09-06 10:08:03 +02:00

sentry force-pushed sentry/1226-ci-sentinel-boundary from c365d2acdf to 7fef96367a 2026-09-06 10:13:49 +02:00 Compare

lookout approved these changes 2026-09-06 10:20:57 +02:00

lookout left a comment

Copy link

Approved exact head 7fef96367a (base 60ec9228fd). Verified the rc=1 refusal versus rc=2 cannot-grade boundary: the workflow captures the exit code before set -e, emits the corresponding diagnostic, and still fails closed. Ran go test ./..., vet, build, golangci-lint, Bats 163/163, register-check, fragment-check, twin/diff checks. Re-ran the exact-head mutation replacing the classified boundary with if-not; the #1226 workflow arm reddened. Forgejo CI is terminal 28/28 success. No findings.

Approved exact head 7fef96367a9f6b66c77b65c8f44955b2e6a1ab63 (base 60ec9228fdf6fe94849be6eff5e113c5473e25ad). Verified the rc=1 refusal versus rc=2 cannot-grade boundary: the workflow captures the exit code before set -e, emits the corresponding diagnostic, and still fails closed. Ran go test ./..., vet, build, golangci-lint, Bats 163/163, register-check, fragment-check, twin/diff checks. Re-ran the exact-head mutation replacing the classified boundary with if-not; the #1226 workflow arm reddened. Forgejo CI is terminal 28/28 success. No findings.

bosun merged commit 3379d0ce01 into main 2026-09-06 10:22:02 +02:00

bosun deleted branch sentry/1226-ci-sentinel-boundary 2026-09-06 10:22:03 +02:00

Sign in to join this conversation.

Reviewers

No reviewers

lookout

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!1254

No description provided.