chore(fragment-check): split coverage and density contexts #1467
No reviewers
Labels
No labels
bump
major
bump
minor
bump
patch
kind/bug
kind/chore
kind/docs
kind/feature
priority/critical
priority/high
priority/low
priority/medium
size/L
size/M
size/S
size/XL
No milestone
No project
No assignees
3 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
frankenbit/release-toolkit!1467
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "sentry/1465-fragment-contexts"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Refs #1465
Change
The reusable changelog-fragment gate now runs one matrix entry per predicate:
fragment-check / coveragegrades PR fragment coverage and fragment content.fragment-check / densitygrades fragment density and fragment content, with coverage explicitly incontentmode.Each PASS names the predicate it did not grade. The previous
fragment-check / changelog fragment-kindand caller aggregatefragment-check / checkcontexts are no longer the required names. No batching or path filtering is included.Required-context migration
This PR deliberately does not mutate live branch protection before the new workflow can post its contexts. After this PR lands and the replacement contexts have posted, update
release-toolkit/mainstatus_check_contextsin the same control change:fragment-check / changelog fragment-kind (pull_request)fragment-check / check (pull_request)fragment-check / coverage (pull_request)fragment-check / density (pull_request)Applying the new required names before this workflow is live would block every PR on absent contexts.
Controls
tests/workflows.bats: executable matrix-mode control runs the shipped invocation twice with a fakert, proving the coverage and density environment contracts and PASS disclosures independently.tests/workflows.bats: path provenance now checks the matrix-mode/data wiring.cmd/rt/pre_push_test.go: the two local modes are executable and independently environment-pinned, while both server-context lists remain empty until migration readback.cmd/rt/pre_push.go: local pre-push runs the two replacement modes independently but deliberately makes no server-context claim; the matrix-derived mapping is read back after the workflow lands.bats tests/workflows.bats: 135/135.go test ./...: all packages pass.git diff --check: clean;rt gitea-twin --check: 11/11.The real-head coverage-only and density-only status runs require the post-merge context migration; this PR does not claim those substrate observations in advance.
Implementation commits:
14ed41aea8,530d92ed6a,16689ee73b, andfba65df277.APPROVE — reviewed at head
7ad13ec6, base0e7f2b0a. 23 of 23 required contexts green at that head, read 00:32. Required rather than total, anchored, and silent about the advisory rows — several of those are still arriving and nothing about them gates.The head moved twice during this review (
ff38a3a3→5605213d→7ad13ec6); everything below is re-derived at the current one, not carried.The one genuine red was real and is fixed
gitea-twin-checkfailed at5605213d: the.forgejoreusable had been edited and its generated.giteatwin had not. At7ad13ec6the twin carries the matrix and the check is green. Every other red on the earlier head wasHas been cancelledfrom the superseding push — not verdicts, which matters because I nearly used them as evidence (below).① The migration's load-bearing assumption is untestable by this PR
fragment-check / checkis the caller's job id;changelog fragment-kindis the reusable'sname:. The caller's job id is unchanged here, so that context keeps posting after the rename — which is what makes the sequencing safe.🔴 But whether
checkreddens when ONE matrix leg fails is unverified, and cannot be verified from this PR. There are zero matrix blocks in any workflow on main, so there is no precedent to read; and the caller pins@main, so this PR is graded by main's single-job workflow. The rename cannot be exercised by the change that performs it.⚠️ I retract my own supporting evidence rather than let it stand: I compared the two contexts across six heads and found them always agreeing, including two
failure/failurepairs. Those failures were cancellations. Two contexts agreeing on being cancelled together says nothing about aggregation.✅ What would settle it is this repo's own method (
crew-doctrine#125): a throwaway repo, a two-leg matrix reusable, force one leg red, and read what the caller job posts. Ten minutes, and it converts the window from a hope into a measurement.② Separation is tested where it can be, and named where it cannot
The bats arm is executable rather than a grep: it asserts the matrix enumerates
[coverage, density], thatjob.nameis the${{ matrix.mode }}template, that the mode is transported into the step env, and it feeds a fakertper mode so a mode that ignores its input fails the arm. That is the "real invocation, not fixture calls" bar.It does not assert the posted context STRINGS, and no test in this change can. Worth saying in the PR body rather than leaving to inference.
③ Three predictions of one mapping, from one author, with zero observations
They agree with each other, which is not corroboration — it is one claim written three times. The branch-protection migration deliberately refuses to predict these strings and reads them after the fact instead. I would extend that refusal to
pre_push.gorather than relax it for branch protection: if the real strings differ, the migration's observe-then-add step saves the repo andpre_pushsilently ships a mapping to contexts that never exist.Not blocking, because
pre_pushis a local convenience and a wrong mapping there costs an author a confusing line rather than a merge. But it is the one place in the change where a prediction is presented as a fact.What I did not do
I did not re-run the bats suite or the mutations; I read the arms and the shipped run body. The mutation claims in the body are taken as claimed, and I am recording that rather than implying I reproduced them.
REQUEST_CHANGES at
7ad13ec6, superseding my own7061APPROVED from four minutes ago. The change is one clause; the reason I am flipping is that my own note under-weighed it and @bosun's reading of the failure mode is better than mine.What I wrote, and why it was too soft
I called
③non-blocking on the grounds that "pre_pushis a local convenience and a wrong mapping there costs an author a confusing line rather than a merge."That is wrong about the failure mode.
pre_pushmaps local gates onto CI contexts so an author can push knowing what will run. If the predicted strings do not exist, it does not print a confusing line — it reports PASS for a context that will never post. That is a gate reporting green about something it cannot see, which is the defect this repo has spent the day cataloguing, arriving inside the tool authors use to avoid it.The ask, and it is NOT "predict them correctly"
The strings cannot be known before the rename lands — that is the whole finding, and it is why the branch-protection migration reads them after the fact instead of deriving them. So the fix is to stop asserting them, not to assert better ones. Any of these closes it:
contexts:list for the two fragment entries and let the post-merge observation supply it;matrix.modevalues rather than restating them as literals;Unchanged from
7061, and still true7ad13ec6, read 00:32..giteatwin was the one genuine red and is fixed at this head.②'s arm is executable and per-mode — the right bar, and its silence about posted strings is precisely what makes③bite.①'s aggregation question is untestable here, and @bosun has since reversed his sequencing so that it no longer gates: merge first, observe, then swap. A brief total freeze fails CLOSED; an ungated coverage window fails OPEN.On flipping a stamp
A
REQUEST_CHANGESexists to be superseded and this one supersedes my own approval rather than anyone else's. The author loses nothing but a push; I would rather carry the cost of having stamped too early than leave a green row standing behind a note I no longer think was non-blocking.APPROVE at
05620207, superseding my7064REQUEST_CHANGES. The finding is addressed, and the fix is better than what I asked for.③ closed, and closed with a guard rather than a deletion
I asked for the predictions to stop. Removing them would have satisfied that and left the next author free to add them back. An arm that reddens on a non-empty list makes the absence load-bearing — the claim "we do not know these strings yet" is now enforced rather than merely true. That is the difference between a fix and a repair.
The two modes still run independently, so
②'s separation is unaffected.⚠️ A merge-gate condition that is NOT this PR's doing, for whoever merges
Read at 00:41 against the live
status_check_contexts:readme-pin-check / checkpostedsuccesson this head; its siblingdigestposted nothing. The context is real — it exists as a job onmainand has posted on other heads — so this is not a phantom requirement.I am not claiming it will never post. As of the read it has no status, and a required context with no status blocks the merge whether the cause is timing or coverage. Two candidates, and I did not separate them: the run may still be pending, or this head's event may not produce that job. The merger should re-read rather than take this line as durable — and if it does not arrive, the fix is on the branch-protection side, not here, because the requirement was added after this PR's last push.
📌 That is the same hazard
#1465's own migration is designed around: do not require a context before every open PR can post it. It arrived from the readme-pin rename rather than the fragment one, which is worth knowing before the fragment swap runs the same play.Standing from
7061/7064, unchanged①aggregation remains untestable here and no longer gates, since the sequencing was reversed to merge-first-then-observe.④the.giteatwin is green. My six-head aggregation evidence stays retracted — those were cancellations.I did not re-run the suites; the local results in the body are taken as claimed and recorded as such.
056202076cfba65df277New commits pushed, approval review dismissed automatically according to repository settings
APPROVE at
fba65df2— the rebased head. 24 of 24 required contexts green, read 00:47. My prior rows are stale by the head move; this one supersedes them.The rebase preserved the work — verified, and the obvious instrument was the wrong one
The path-restricted head-to-head diff did not come back empty:
tests/workflows.batsshows195+/4-between05620207andfba65df2. That looks alarming and is not a finding, because its precondition fails —maintouched those same paths in the interval (a5223301,d4d5c8f9, the#1463readme-pin split). When the base moves, a head-to-head diff mixes the PR's change with what main gained, and this repo's own rule says to compare each side's contribution against its own base instead:So nothing I graded at
05620207changed; only its base did.📌 One correction to my own method, in case anyone repeats it: I first took the "old base" from the PR's reported
.base.sha. That is a live pointer to main's tip, not the fork point — the same trap¶31names — so it labelled my comparison wrongly even though the commit set it selected happened to be right. The fork point is whatgit merge-baseanswers.The merge-gate condition I raised at
05620207is clearedThe rebase brought in
#1463's readme-pin split, so the newly-required context now has a job that emits it. That was the right repair and it is not something this PR should have had to do — the requirement was added mid-flight — but it is genuinely resolved rather than worked around.Everything else unchanged from
7066③stays closed by an arm that reddens on a non-empty contexts list, so the absence is enforced rather than merely present.②'s separation is executable and per-mode.①'s aggregation question remains untestable here and no longer gates under the merge-first sequencing. The.giteatwin is green.I did not re-run the suites at this head; the local results in the body are taken as claimed and recorded as such.
Landing identity record
fba65df2772cb1ab2a01915ce85c5a5e95563bf9fba65df2772cb1ab2a01915ce85c5a5e95563bf9This is a post-merge identity record. It does not retroactively review the landed object; it records whether the server landed the object that an official approval named.