chore(release): v0.10.2 #137

Merged

alex merged 1 commit from release-prep/rolling into main

2026-06-26 23:01:56 +02:00

release-bot commented

2026-06-26 22:57:16 +02:00

Member

Added

Test-seams + docs sprint — closes three small open trackers in one bundled PR per operator's "close all currently closable" framing 2026-06-26.

#122: `read_rolling_pr_bump_label` bats coverage

Surveyor 116b flagged at the v0.9.0 sprint approval: the read_rolling_pr_bump_label function in scripts/release-decide.sh had no direct bats coverage. The function pre-existed v0.9.0 as untested (Forgejo API path; no test seam), but the namespace shift bump: → bump/ flipped it from "planned" to "live + load-bearing." Same shape as the #134 test-seam follow-up — planned→load-bearing as the trigger.

Implementation: new FORGEJO_TEST_OPEN_PRS_FILE env hook in read_rolling_pr_bump_label. Mirrors the existing FORGEJO_TEST_PR_LOOKUP_FILE pattern (line-consumed canned response). When set, the function bypasses both the dry-run skip + the real API call. 7 new bats tests cover the matrix: single bump/patch / bump/minor / bump/major (overrides auto-detect), no labels (auto-detect prevails), multiple bump/* (FATAL fail-loud — the defense-in-depth guard Surveyor 116b specifically wanted mutation-verified), no rolling PR open (no override), non-bump labels mixed with bump/patch (only bump/* recognized).

#134: `manifest-precheck.sh` extraction + bats coverage

Surveyor 3bd4 flagged at the #131 idempotency approval: the new _release.yml manifest pre-check had no bats coverage. Same planned→load-bearing trigger. Surveyor's (A) lean: extract the 6-line inline check to a script.

Implementation: new scripts/manifest-precheck.sh — single-responsibility script that takes (MANIFEST_PATH, HEAD_SHA) and outputs "skip" or "proceed". Fail-safe design: any uncertainty (missing field, malformed JSON, missing file) produces "proceed" — false-positive proceed = re-do work (benign); false-positive skip = miss work (would land inconsistent substrate). The _release.yml cut path now calls the script instead of inlining the jq check. 9 new bats tests cover the matrix in tests/manifest-precheck.bats: HEAD_SHA match → skip, HEAD_SHA mismatch → proceed, manifest absent → proceed (first cut bootstrap), field missing → proceed (fail-safe), invalid JSON → proceed (fail-safe), empty file → proceed, null value → proceed, missing args → fail loud, case-sensitive matching (no normalization fuzzing).

#135: `secrets: inherit` docs fix + regression guard

Surveyor dec5 surfaced at the cellblock first-cut adoption review (cellblock#168 2026-06-26): integration.md's quick-start under-specifies the workflow_call secrets contract — toolkit-self's _release.yml references secrets.RELEASE_TOOLKIT_TOKEN unconditionally, but the quick-start template omits secrets: inherit. The toolkit's own consumer wrapper HAS inherit; the quick-start template was the gap.

Empirical update during cellblock cut: the un-inherit shape worked end-to-end (Forgejo resolved the missing reference benignly; bash ${VAR:-} fell back to GITHUB_TOKEN per ADR-0007). So the gap was a docs-consistency issue rather than a substrate-blocker.

Implementation: docs/integration.md quick-start template updated to show secrets: inherit with an inline comment explaining the substrate-honest reason (unconditional reference + bash fallback chain). Tag refs bumped to current @v0.10.1-rc.1. 1 new bats regression guard in tests/workflows.bats asserts that the toolkit's own consumer wrapper has secrets: inherit on every workflow_call job — catches a future edit that would drop inherit and re-introduce the documented-vs-validated gap.

Test count

343/343 green (was 326; +17 new tests across the three sub-items).

What this PR does NOT do

Does NOT touch #124 (structural re-pin backstop) — that's substantive work warranting its own sprint
Does NOT make the secrets.RELEASE_TOOLKIT_TOKEN reference conditional in _release.yml — the optional substrate-hardening sub-scope from #135. The empirical evidence shows the unconditional reference is fine; deferred lower priority.

Refs

Closes: #122, #134, #135
Operator engagement 2026-06-26: "run a sprint to close all currently closable release-toolkit issues"
Surveyor advisories: 116b (#122 + #134 trigger pattern), 3bd4 ((A) extract-to-script lean for #134), dec5 (#135 abstraction-boundary catch)
test-seams + docs sprint — closes #122 + #134 + #135

### Added **Test-seams + docs sprint** — closes three small open trackers in one bundled PR per operator's "close all currently closable" framing 2026-06-26. ## #122: `read_rolling_pr_bump_label` bats coverage Surveyor 116b flagged at the v0.9.0 sprint approval: the `read_rolling_pr_bump_label` function in `scripts/release-decide.sh` had no direct bats coverage. The function pre-existed v0.9.0 as untested (Forgejo API path; no test seam), but the namespace shift `bump:` → `bump/` flipped it from "planned" to "live + load-bearing." Same shape as the [#134 test-seam follow-up](https://git.frankenbit.de/frankenbit/release-toolkit/issues/134) — planned→load-bearing as the trigger. **Implementation**: new `FORGEJO_TEST_OPEN_PRS_FILE` env hook in `read_rolling_pr_bump_label`. Mirrors the existing `FORGEJO_TEST_PR_LOOKUP_FILE` pattern (line-consumed canned response). When set, the function bypasses both the dry-run skip + the real API call. **7 new bats tests** cover the matrix: single bump/patch / bump/minor / bump/major (overrides auto-detect), no labels (auto-detect prevails), multiple bump/* (FATAL fail-loud — the defense-in-depth guard Surveyor 116b specifically wanted mutation-verified), no rolling PR open (no override), non-bump labels mixed with bump/patch (only bump/* recognized). ## #134: `manifest-precheck.sh` extraction + bats coverage Surveyor 3bd4 flagged at the [#131 idempotency approval](https://git.frankenbit.de/frankenbit/release-toolkit/pulls/131): the new `_release.yml` manifest pre-check had no bats coverage. Same planned→load-bearing trigger. Surveyor's (A) lean: extract the 6-line inline check to a script. **Implementation**: new `scripts/manifest-precheck.sh` — single-responsibility script that takes `(MANIFEST_PATH, HEAD_SHA)` and outputs `"skip"` or `"proceed"`. **Fail-safe design**: any uncertainty (missing field, malformed JSON, missing file) produces "proceed" — false-positive proceed = re-do work (benign); false-positive skip = miss work (would land inconsistent substrate). The `_release.yml` cut path now calls the script instead of inlining the jq check. **9 new bats tests** cover the matrix in `tests/manifest-precheck.bats`: HEAD_SHA match → skip, HEAD_SHA mismatch → proceed, manifest absent → proceed (first cut bootstrap), field missing → proceed (fail-safe), invalid JSON → proceed (fail-safe), empty file → proceed, null value → proceed, missing args → fail loud, case-sensitive matching (no normalization fuzzing). ## #135: `secrets: inherit` docs fix + regression guard Surveyor dec5 surfaced at the cellblock first-cut adoption review (cellblock#168 2026-06-26): integration.md's quick-start under-specifies the workflow_call secrets contract — toolkit-self's `_release.yml` references `secrets.RELEASE_TOOLKIT_TOKEN` unconditionally, but the quick-start template omits `secrets: inherit`. The toolkit's own consumer wrapper HAS inherit; the quick-start template was the gap. **Empirical update during cellblock cut**: the un-inherit shape worked end-to-end (Forgejo resolved the missing reference benignly; bash `${VAR:-}` fell back to GITHUB_TOKEN per ADR-0007). So the gap was a docs-consistency issue rather than a substrate-blocker. **Implementation**: `docs/integration.md` quick-start template updated to show `secrets: inherit` with an inline comment explaining the substrate-honest reason (unconditional reference + bash fallback chain). Tag refs bumped to current `@v0.10.1-rc.1`. **1 new bats regression guard** in `tests/workflows.bats` asserts that the toolkit's own consumer wrapper has `secrets: inherit` on every workflow_call job — catches a future edit that would drop inherit and re-introduce the documented-vs-validated gap. ## Test count **343/343 green** (was 326; +17 new tests across the three sub-items). ## What this PR does NOT do - **Does NOT touch #124** (structural re-pin backstop) — that's substantive work warranting its own sprint - **Does NOT make the `secrets.RELEASE_TOOLKIT_TOKEN` reference conditional in `_release.yml`** — the optional substrate-hardening sub-scope from #135. The empirical evidence shows the unconditional reference is fine; deferred lower priority. ## Refs - **Closes**: [#122](https://git.frankenbit.de/frankenbit/release-toolkit/issues/122), [#134](https://git.frankenbit.de/frankenbit/release-toolkit/issues/134), [#135](https://git.frankenbit.de/frankenbit/release-toolkit/issues/135) - **Operator engagement 2026-06-26**: "run a sprint to close all currently closable release-toolkit issues" - **Surveyor advisories**: 116b (#122 + #134 trigger pattern), 3bd4 ((A) extract-to-script lean for #134), dec5 (#135 abstraction-boundary catch) - test-seams + docs sprint — closes #122 + #134 + #135