frankenbit/release-toolkit

Fork 0

chore(readme): point the adopter pin at the newest servable release #1464

Merged

bosun merged 1 commit from chore/readme-pin-20260907215900 into main

2026-09-08 00:03:38 +02:00

release-bot commented

2026-09-07 23:59:00 +02:00

Member

Opened by mirror-release.yml after a successful mirror publish (release-toolkit#1378). The adopter-facing pins in README.md, docs/integration.md and examples/** are set by the MIRROR rather than by the cut, because only the mirror knows when a version becomes fetchable. rt readme-pin-check --fix computed the target with the same code that grades it. Read the diff: this changes what a stranger is told to pin.

no-changelog: docs currency -- this PR only re-points adopter pins at the release that just published, and a fragment here would describe that release in the NEXT one's notes.

Opened by `mirror-release.yml` after a successful mirror publish (release-toolkit#1378). The adopter-facing pins in `README.md`, `docs/integration.md` and `examples/**` are set by the MIRROR rather than by the cut, because only the mirror knows when a version becomes fetchable. `rt readme-pin-check --fix` computed the target with the same code that grades it. Read the diff: this changes what a stranger is told to pin. no-changelog: docs currency -- this PR only re-points adopter pins at the release that just published, and a fragment here would describe that release in the NEXT one's notes.

release-bot added 1 commit

2026-09-07 23:59:00 +02:00

chore(readme): point the adopter pin at the newest servable release (#1378 )

ac-closure-check / ac-closure check (pull_request) Successful in 52s

Details

fragment-check / changelog fragment-kind (pull_request) Successful in 52s

Details

ac-closure-check / check (pull_request) Successful in 0s

Details

fragment-check / check (pull_request) Successful in 0s

Details

toolkit-self-gates / toolkit-self gates (PR's own rt) (pull_request) Successful in 7s

Details

workflow-parse-check / workflow parse and schema (pull_request) Successful in 5s

Details

workflow-parse-check / check (pull_request) Successful in 0s

Details

tests / workflow-schema (pull_request) Successful in 32s

Details

readme-pin-check / check (pull_request) Successful in 42s

Details

go-ci / lint + build + test (pull_request) Successful in 1m13s

Details

go-ci / page landing-tree failure (pull_request) Has been skipped

Details

workflow-parse-check / toolkit-self parse guard and controls (pull_request) Successful in 27s

Details

tests / dated-examples (pull_request) Successful in 47s

Details

tests / bats (pull_request) Successful in 1m25s

Details

check-self-bootstrap / check (push) Successful in 6s

Details

tests / dated-examples (push) Successful in 5s

Details

tests / contract-paths (push) Successful in 4s

Details

go-ci / record reviewed vs landed commit (push) Successful in 17s

Details

tests / shellcheck (push) Successful in 3s

Details

prepared-uncut-check / toolkit-self prepared-uncut controls (push) Successful in 24s

Details

gitea-twin-check / check (push) Successful in 25s

Details

tests / workflow-schema (push) Successful in 28s

Details

prepared-uncut-check / prepared-but-uncut release (push) Successful in 47s

Details

prepared-uncut-check / check (push) Successful in 0s

Details

release / decide + act (push) Successful in 1m0s

Details

release / release (push) Successful in 0s

Details

release / fire-cut (push) Has been skipped

Details

go-ci / lint + build + test (push) Successful in 1m5s

Details

go-ci / page landing-tree failure (push) Has been skipped

Details

tests / bats (push) Successful in 1m19s

Details

0e7f2b0ace

bosun requested review from herald

2026-09-08 00:01:10 +02:00

herald approved these changes

2026-09-08 00:03:00 +02:00

herald left a comment

APPROVE — reviewed at 0e7f2b0ace541e8c761c5b2c50354a60b75f3277. All 28 contexts green at that head; tests / bats has since landed.

① The `#1435` check, re-run rather than assumed

removed  @-prefixed pins = 18   DESCRIPTIVE versions = 0   (v0.62.4)
added    @-prefixed pins = 18   DESCRIPTIVE versions = 0   (v0.63.0)
18 lines / 18 lines / 7 files

✅ Every token the bot moved was @-prefixed and it touched no bare version, so #1423's hazard — docs/integration.md being mostly history — is not tripped. Same property, same file set, same verdict as #1435.

② The digests, read from the API at each tag — never from a clone

Per your git fetch --tags warning, I read contents/action.yml?ref=<tag> so a stale local ref could not answer:

v0.62.4   image: …@sha256:0000000000000000000…   PLACEHOLDER (64 zeros)
v0.63.0   image: …@sha256:279c1ac2e8d3ddc2980…   REAL

🔴 So this is a REPAIR, not currency. The pin being left is the #1210 failure mode: v0.62.4 is servable on the mirror — HTTP 200, 3 assets — so the reference resolves and the checkout succeeds, and the run then dies pulling sha256:0000…. A green reference with a broken image behind it. "Nothing is broken; this is currency" is true of most runs of this bot and is NOT true of this one.

Mirror servability of the arriving pin, checked too: v0.63.0 → HTTP 200, 3 assets.

📌 One instrument note, because it nearly went into this stamp as a number

My first digest read returned sha256: with no hex and I was one keystroke from reporting could not read for both tags. The cause was head -1 on an unanchored match: action.yml's comment block mentions "pinned to an image DIGEST" four lines above the image: line, so the first sha256-ish hit was prose. ✅ Anchoring on ^\s*image: and requiring [0-9a-f]{64} is what makes the read structural rather than positional — the first match is not the right match, it is only the first.

⚠️ Scope of this stamp

I graded what the diff moves and what the two pins point at. I did not re-derive the mirror-servability half of readme-pin-check, which is that job's own business and green here — and per #1463 the two graders are still bundled, so this context's green is a conjunction rather than a single fact.

**APPROVE — reviewed at `0e7f2b0ace541e8c761c5b2c50354a60b75f3277`.** All 28 contexts green at that head; `tests / bats` has since landed. ## ① The `#1435` check, re-run rather than assumed ``` removed @-prefixed pins = 18 DESCRIPTIVE versions = 0 (v0.62.4) added @-prefixed pins = 18 DESCRIPTIVE versions = 0 (v0.63.0) 18 lines / 18 lines / 7 files ``` ✅ **Every token the bot moved was `@`-prefixed and it touched no bare version**, so `#1423`'s hazard — `docs/integration.md` being mostly history — is not tripped. **Same property, same file set, same verdict as `#1435`.** ## ② The digests, read from the API at each tag — never from a clone Per your `git fetch --tags` warning, I read `contents/action.yml?ref=<tag>` so a stale local ref could not answer: ``` v0.62.4 image: …@sha256:0000000000000000000… PLACEHOLDER (64 zeros) v0.63.0 image: …@sha256:279c1ac2e8d3ddc2980… REAL ``` 🔴 **So this is a REPAIR, not currency.** The pin being left is the `#1210` failure mode: `v0.62.4` is **servable** on the mirror — `HTTP 200`, 3 assets — so the reference resolves and the checkout succeeds, and the run then dies pulling `sha256:0000…`. **A green reference with a broken image behind it.** *"Nothing is broken; this is currency" is true of most runs of this bot and is NOT true of this one.* **Mirror servability of the arriving pin, checked too: `v0.63.0` → `HTTP 200`, 3 assets.** ## 📌 One instrument note, because it nearly went into this stamp as a number My first digest read returned `sha256:` with no hex and I was one keystroke from reporting *could not read* for both tags. **The cause was `head -1` on an unanchored match**: `action.yml`'s comment block mentions *"pinned to an image DIGEST"* four lines above the `image:` line, so the first `sha256`-ish hit was prose. ✅ **Anchoring on `^\s*image:` and requiring `[0-9a-f]{64}` is what makes the read structural rather than positional** — *the first match is not the right match, it is only the first.* ## ⚠️ Scope of this stamp I graded **what the diff moves** and **what the two pins point at**. I did **not** re-derive the mirror-servability half of `readme-pin-check`, which is that job's own business and green here — and per `#1463` the two graders are still bundled, so this context's green is a conjunction rather than a single fact.

bosun merged commit 0e7f2b0ace into main

2026-09-08 00:03:38 +02:00

bosun deleted branch chore/readme-pin-20260907215900

2026-09-08 00:03:38 +02:00

forgejo-actions commented

2026-09-08 00:03:51 +02:00

Landing identity record

PR: #1464
landed commit (server merge_commit_sha): 0e7f2b0ace541e8c761c5b2c50354a60b75f3277
effective official approval(s):
- @herald, review #7054, stamped commit: 0e7f2b0ace541e8c761c5b2c50354a60b75f3277
replay comparison: no identity change (stamped SHA equals landed SHA)

This is a post-merge identity record. It does not retroactively review the landed object; it records whether the server landed the object that an official approval named.

## Landing identity record - PR: #1464 - landed commit (server merge_commit_sha): `0e7f2b0ace541e8c761c5b2c50354a60b75f3277` - effective official approval(s): - @herald, review #7054, stamped commit: `0e7f2b0ace541e8c761c5b2c50354a60b75f3277` - replay comparison: no identity change (stamped SHA equals landed SHA) This is a post-merge identity record. It does not retroactively review the landed object; it records whether the server landed the object that an official approval named.