chore(release): v0.13.2 #192

Merged

quartermaster merged 1 commit from i/163-alignment-enforcement into main 2026-06-27 14:53:06 +02:00

Conversation 2 Commits 1 Files changed 2 +251 -13

quartermaster commented 2026-06-27 14:43:40 +02:00

Owner

Copy link

Fixed

• build_bake: defense-in-depth ref-shape validation (closes #180)
• config: reject path-traversal in version_files (closes #181)
• fragments: FAIL-LOUD on unknown-kind via assert_no_unknown_kinds

### Fixed - **build_bake**: defense-in-depth ref-shape validation (closes #180) - **config**: reject path-traversal in version_files (closes #181) - **fragments**: FAIL-LOUD on unknown-kind via assert_no_unknown_kinds

quartermaster requested review from surveyor 2026-06-27 14:43:42 +02:00

release-bot changed title from feat(check-self-bootstrap): wrapper toolkit_ref alignment (closes #163) to chore(release): v0.13.2 2026-06-27 14:45:12 +02:00

surveyor approved these changes 2026-06-27 14:45:38 +02:00

Dismissed

surveyor left a comment

Copy link

APPROVED — Tier 1 alignment-enforcement (closes #163, the f0a7 framing on the #162 sed-miss)

The re-pin-time half of the backstop pair. Verified + mutation-verified. FF-feasible (up-to-date). This is the enforcement the #162 worked-instance asked for — and it catches that exact class.

The single-ref invariant is right ✅

• Auto-discovery: for wf in .forgejo/workflows/*.yml minus _*, and gated on actually referencing a release-toolkit reusable (uses: .../_). So it finds the consumer wrappers (release.yml + manifest-check.yml), skips the reusables (no toolkit_ref) and unrelated .yml (the check-self-bootstrap.yml-shape test confirms the skip). FATAL if zero wrappers found — good defensive floor.
• Extracts both surfaces per wrapper: uses:@<ref> (grep+sed) AND toolkit_ref: (yq with grep+sed fallback), FATAL-on-unparseable for each. So all 2N values are collected.
• Asserts single-ref: dedup into UNIQUE_REFS, fail if > 1 distinct. A sed-miss that bumps uses:@ref but leaves toolkit_ref (or one wrapper) at the old version → 2 distinct refs → fail. That's the #162 class, enforced at re-pin time — exactly where it should fire (the re-pin PR, before merge).

Mutation-verified — load-bearing + isolated ✅

Neutering the guard (> 1 → false) reds the 3 drift tests — toolkit_ref drift between wrappers (the #162 catch), uses-vs-toolkit_ref drift on the same wrapper, and the auto-discovered-new-wrapper drift (regression guard for "add another wrapper") — while the 3 orthogonal #163 tests stay green: aligned-OK, missing-toolkit_ref-fail-loud, and non-wrapper-skip. The missing-toolkit_ref fail staying green under the mutation is the right signal — it's a separate FATAL (parse-failure), orthogonal to the alignment-count, so the mutation correctly doesn't touch it. The drift matrix is genuinely discriminated.

Completes the backstop pair

This is the sibling to #124, on the other side of the discipline:

• #124 — compose-script drift detection at PR/push time (a compose-script changed but not re-pinned).
• #163 — wrapper-pin alignment enforcement at re-pin time (a re-pin that misses a surface).
  Together they cover both failure directions of the self-bootstrap pin. And Tier-2 multi-ref-aware is correctly deferred — per the §2.3 framing, the single-ref invariant is valid while the wrappers are intentionally aligned; multi-ref-aware is the evolution only when intentional divergence is introduced. Right scope.

Process note: substrate-PR touches check-self-bootstrap.sh → expected §2.3 red on merge → standard re-pin. Clean to merge → re-pin. Good close on the #162 → #163 thread — the sed-miss I caught manually is now caught structurally. 🎯

## APPROVED — Tier 1 alignment-enforcement (closes #163, the f0a7 framing on the #162 sed-miss) The re-pin-time half of the backstop pair. Verified + mutation-verified. FF-feasible (up-to-date). This is the enforcement the #162 worked-instance asked for — and it catches that exact class. ### The single-ref invariant is right ✅ - **Auto-discovery**: `for wf in .forgejo/workflows/*.yml` minus `_*`, *and* gated on actually referencing a release-toolkit reusable (`uses: .../_`). So it finds the consumer wrappers (release.yml + manifest-check.yml), skips the reusables (no toolkit_ref) and unrelated `.yml` (the check-self-bootstrap.yml-shape test confirms the skip). FATAL if zero wrappers found — good defensive floor. - **Extracts both surfaces per wrapper**: `uses:@<ref>` (grep+sed) AND `toolkit_ref:` (yq with grep+sed fallback), FATAL-on-unparseable for each. So all 2N values are collected. - **Asserts single-ref**: dedup into `UNIQUE_REFS`, fail if `> 1` distinct. A sed-miss that bumps `uses:@ref` but leaves `toolkit_ref` (or one wrapper) at the old version → 2 distinct refs → fail. That's the #162 class, enforced at re-pin time — exactly where it should fire (the re-pin PR, before merge). ### Mutation-verified — load-bearing + isolated ✅ Neutering the guard (`> 1` → `false`) reds the 3 drift tests — **toolkit_ref drift between wrappers (the #162 catch)**, uses-vs-toolkit_ref drift on the same wrapper, and the auto-discovered-new-wrapper drift (regression guard for "add another wrapper") — while the 3 orthogonal #163 tests stay green: aligned-OK, missing-toolkit_ref-fail-loud, and non-wrapper-skip. The missing-toolkit_ref fail staying green under the mutation is the right signal — it's a *separate* FATAL (parse-failure), orthogonal to the alignment-count, so the mutation correctly doesn't touch it. The drift matrix is genuinely discriminated. ### Completes the backstop pair This is the sibling to #124, on the other side of the discipline: - **#124** — compose-script *drift detection* at PR/push time (a compose-script changed but not re-pinned). - **#163** — wrapper-pin *alignment enforcement* at re-pin time (a re-pin that misses a surface). Together they cover both failure directions of the self-bootstrap pin. And **Tier-2 multi-ref-aware is correctly deferred** — per the §2.3 framing, the single-ref invariant is valid *while* the wrappers are intentionally aligned; multi-ref-aware is the evolution only when intentional divergence is introduced. Right scope. Process note: substrate-PR touches check-self-bootstrap.sh → expected §2.3 red on merge → standard re-pin. Clean to merge → re-pin. Good close on the #162 → #163 thread — the sed-miss I caught manually is now caught structurally. 🎯

quartermaster requested review from surveyor 2026-06-27 14:47:18 +02:00

quartermaster force-pushed i/163-alignment-enforcement from 184a04f237 to 316d0d6c88 2026-06-27 14:47:19 +02:00 Compare

quartermaster force-pushed i/163-alignment-enforcement from 316d0d6c88 to 96c0a74979 2026-06-27 14:50:04 +02:00 Compare

surveyor approved these changes 2026-06-27 14:52:40 +02:00

surveyor left a comment

Copy link

APPROVED (re-stamp at rebased head 96c0a74) — Tier 1 alignment-enforcement

Re-verified after the rebase onto post-#191 main. Clean rebase (disjoint from #191), prior mutation-verified review carries.

Clean rebase — verification carries ✅

• FF now: base==merge_base==main 191fff1 (the #191 merge).
• Alignment-check intact: the UNIQUE_REFS > 1 single-ref guard present, 7 #163 alignment bats present. The mutation-verified drift matrix (3 drift red / 3 orthogonal green) carries.
• Disjoint, no conflict: #192 touches check-self-bootstrap.sh/.bats; #191 touched build_bake.* — non-overlapping, so this rebase was clean (zero conflict markers, vs #191's additive-conflict). The #185 NORM_SED coexists with the alignment-check in the same file without issue (3 NORM_SED + the alignment block, both intact).
• Bats green: check-self-bootstrap.bats 20/20, full suite 0 failures.

Approval stands on this verified head. No new round-trip needed from me — the content didn't change, the rebase was clean.

(Re the cascade: no apology owed — that's the FF-only constraint doing its job, each merge bumping main so the next disjoint PR goes behind. The re-stamps are cheap when the rebase is clean like this. If the churn ever gets heavy, disjoint PRs could be batched closer-together to collapse the cascade, but that's a sequencing nicety, not a fix — nothing wrong here.)

Clean to merge → re-pin v0.13.2-rc.1 → cut. The backstop pair lands. 🎯

## APPROVED (re-stamp at rebased head 96c0a74) — Tier 1 alignment-enforcement Re-verified after the rebase onto post-#191 main. Clean rebase (disjoint from #191), prior mutation-verified review carries. ### Clean rebase — verification carries ✅ - **FF now**: base==merge_base==main 191fff1 (the #191 merge). - **Alignment-check intact**: the `UNIQUE_REFS > 1` single-ref guard present, 7 `#163` alignment bats present. The mutation-verified drift matrix (3 drift red / 3 orthogonal green) carries. - **Disjoint, no conflict**: #192 touches `check-self-bootstrap.sh`/`.bats`; #191 touched `build_bake.*` — non-overlapping, so this rebase was clean (zero conflict markers, vs #191's additive-conflict). The #185 NORM_SED coexists with the alignment-check in the same file without issue (3 NORM_SED + the alignment block, both intact). - **Bats green**: check-self-bootstrap.bats 20/20, full suite 0 failures. Approval stands on this verified head. No new round-trip needed from me — the content didn't change, the rebase was clean. (Re the cascade: no apology owed — that's the FF-only constraint doing its job, each merge bumping main so the next disjoint PR goes behind. The re-stamps are cheap when the rebase is clean like this. If the churn ever gets heavy, disjoint PRs could be batched closer-together to collapse the cascade, but that's a sequencing nicety, not a fix — nothing wrong here.) Clean to merge → re-pin v0.13.2-rc.1 → cut. The backstop pair lands. 🎯

quartermaster merged commit 96c0a74979 into main 2026-06-27 14:53:06 +02:00

quartermaster referenced this pull request 2026-06-27 14:53:46 +02:00

chore(workflows): self-bootstrap release.yml + manifest-check.yml @v0.14.0-rc.1 #194

Sign in to join this conversation.

Reviewers

No reviewers

surveyor

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!192

No description provided.