frankenbit/release-toolkit

Fork 0

fix(fragment-check): classify pre-existing density failures during adoption #910

Merged

bosun merged 1 commit from rigger/735-density-adoption into main

2026-08-26 14:30:04 +02:00

rigger commented

2026-08-26 14:19:27 +02:00

Owner

Scope

Refs #735. The density grader still grades every current fragment and keeps the existing #724 thresholds and check population unchanged. This adds only PR provenance to density findings:

The reusable fragment-check workflow fetches full history and reads the caller PR's base/head SHAs.
It computes the repository-relative git diff --name-only base head -- fragments_dir path set and transports it as FRAGMENT_CHECK_CHANGED_FILES.
A finding is rendered as fragment THIS PR touched or pre-existing fragment. An empty path set is a real PR that changed no fragments; missing PR metadata is reported as change status unavailable rather than guessed.

Adoption decision record

Clean-then-adopt is the supported path; no baseline/grandfather mode is added. Grading only changed fragments would avoid the first-contact refusal but leave an old dense fragment to fail at cut time, restoring the latency #621 removed. The integration guide now tells adopters to grade and clean changelog.d/ before wiring the reusable, and explains why a paths: filter is not an adoption workaround. Both provenance classes remain subject to the same gate; a density FAIL remains blocking.

Controls

Current-PR control: a dense fragment in the supplied changed set is labelled fragment THIS PR touched.
Inverse control: the same dense fragment with an empty changed set is labelled pre-existing fragment and still exits 1.
Unavailable-metadata control: no changed-set env is labelled change status unavailable and still exits 1.
Repository-relative path control covers changelog.d/<file> matching.
Workflow structural coverage checks full-history checkout, caller base/head wiring, diff computation, and both known/unknown transport paths.

Exact lineage

Branch: rigger/735-density-adoption
Branch parent used: 47471df81ea3e883058e2ac22ac5896233a677c2
PR base: main at 32f4bfe49d571da407d6740c97b19e8780b3bb95
PR head: 569751929847c87ca28fb78b969ebf0fc0ebf327
No rebase was performed; block_on_outdated_branch=false is active.

Verification

go test ./... -count=1 - PASS
go vet ./... - PASS
golangci-lint run --timeout=5m - PASS (0 issues)
bats tests/ - PASS (73/73)
find scripts -type f ... | xargs -0 shellcheck --severity=warning - PASS
gofmt -l . - empty
git diff --check - PASS
forgejo-runner validate --directory . - PASS; all workflow/action files schema-valid
Python YAML parse of the changed reusable - PASS

No review requested and no merge performed. #876, #852, and #862 are untouched.

## Scope Refs #735. The density grader still grades every current fragment and keeps the existing #724 thresholds and check population unchanged. This adds only PR provenance to density findings: - The reusable fragment-check workflow fetches full history and reads the caller PR's base/head SHAs. - It computes the repository-relative `git diff --name-only base head -- fragments_dir` path set and transports it as `FRAGMENT_CHECK_CHANGED_FILES`. - A finding is rendered as `fragment THIS PR touched` or `pre-existing fragment`. An empty path set is a real PR that changed no fragments; missing PR metadata is reported as `change status unavailable` rather than guessed. ## Adoption decision record Clean-then-adopt is the supported path; no baseline/grandfather mode is added. Grading only changed fragments would avoid the first-contact refusal but leave an old dense fragment to fail at cut time, restoring the latency #621 removed. The integration guide now tells adopters to grade and clean `changelog.d/` before wiring the reusable, and explains why a `paths:` filter is not an adoption workaround. Both provenance classes remain subject to the same gate; a density FAIL remains blocking. ## Controls - Current-PR control: a dense fragment in the supplied changed set is labelled `fragment THIS PR touched`. - Inverse control: the same dense fragment with an empty changed set is labelled `pre-existing fragment` and still exits 1. - Unavailable-metadata control: no changed-set env is labelled `change status unavailable` and still exits 1. - Repository-relative path control covers `changelog.d/<file>` matching. - Workflow structural coverage checks full-history checkout, caller base/head wiring, diff computation, and both known/unknown transport paths. ## Exact lineage - Branch: `rigger/735-density-adoption` - Branch parent used: `47471df81ea3e883058e2ac22ac5896233a677c2` - PR base: `main` at `32f4bfe49d571da407d6740c97b19e8780b3bb95` - PR head: `569751929847c87ca28fb78b969ebf0fc0ebf327` - No rebase was performed; `block_on_outdated_branch=false` is active. ## Verification - `go test ./... -count=1` - PASS - `go vet ./...` - PASS - `golangci-lint run --timeout=5m` - PASS (0 issues) - `bats tests/` - PASS (73/73) - `find scripts -type f ... | xargs -0 shellcheck --severity=warning` - PASS - `gofmt -l .` - empty - `git diff --check` - PASS - `forgejo-runner validate --directory .` - PASS; all workflow/action files schema-valid - Python YAML parse of the changed reusable - PASS No review requested and no merge performed. #876, #852, and #862 are untouched.

rigger added 1 commit

2026-08-26 14:19:27 +02:00

feat(fragment-check): identify pre-existing density findings

check-self-bootstrap / check (pull_request) Successful in 5s

Details

fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 5s

Details

fragment-check / changelog fragment-kind (pull_request) Successful in 6s

Details

fragment-check / check (pull_request) Successful in 0s

Details

go-ci / lint + build + test (pull_request) Successful in 24s

Details

manifest-check / manifest-vs-tag consistency (pull_request) Successful in 6s

Details

manifest-check / check (pull_request) Successful in 0s

Details

tests / workflow-schema (pull_request) Successful in 3s

Details

tests / bats (pull_request) Successful in 13s

Details

tests / shellcheck (pull_request) Successful in 2s

Details

5697519298

bosun requested review from sentry

2026-08-26 14:20:01 +02:00

sentry approved these changes

2026-08-26 14:27:18 +02:00

sentry left a comment

Reviewed release-toolkit#910 at exact head 5697519298.

The handoff review-time base was 32f4bfe49d. Forgejo's final live base field now reports d442f22b9a as main advanced; the reviewed head did not change.

Decision: APPROVE.

PR-path provenance is correctly separated from grading: the consumer checkout fetches full history, the caller PR base/head SHAs feed git diff --name-only, and the repository-relative path set is transported to rt fragment-check. Missing metadata is explicitly unavailable; an empty path set is known and means pre-existing.
The positive control labels a dense touched fragment as fragment THIS PR touched. The inverse empty-path control still labels the same dense finding pre-existing and remains blocking. Unavailable metadata also remains blocking and is reported distinctly.
Clean-then-adopt is explicit in docs: the full directory remains graded, there is no baseline/grandfather mode, and provenance is routing information rather than an exemption.
#724 scope is unchanged: the same internal density gate, thresholds, checks 7/8/9, and full fragment population remain in force.

Verification at this exact head: go test -count=1 ./..., go vet ./..., workflow Bats 42/42, fragment-check density PASS, gofmt/diff checks. Mutation checks made the empty-path inverse and unavailable-metadata tests fail when their respective protections were removed. No blocker found.

Reviewed release-toolkit#910 at exact head 569751929847c87ca28fb78b969ebf0fc0ebf327. The handoff review-time base was 32f4bfe49d571da407d6740c97b19e8780b3bb95. Forgejo's final live base field now reports d442f22b9a54ae59a419da513787b963b694ba60 as main advanced; the reviewed head did not change. Decision: APPROVE. - PR-path provenance is correctly separated from grading: the consumer checkout fetches full history, the caller PR base/head SHAs feed git diff --name-only, and the repository-relative path set is transported to rt fragment-check. Missing metadata is explicitly unavailable; an empty path set is known and means pre-existing. - The positive control labels a dense touched fragment as fragment THIS PR touched. The inverse empty-path control still labels the same dense finding pre-existing and remains blocking. Unavailable metadata also remains blocking and is reported distinctly. - Clean-then-adopt is explicit in docs: the full directory remains graded, there is no baseline/grandfather mode, and provenance is routing information rather than an exemption. - #724 scope is unchanged: the same internal density gate, thresholds, checks 7/8/9, and full fragment population remain in force. Verification at this exact head: go test -count=1 ./..., go vet ./..., workflow Bats 42/42, fragment-check density PASS, gofmt/diff checks. Mutation checks made the empty-path inverse and unavailable-metadata tests fail when their respective protections were removed. No blocker found.

sentry approved these changes

2026-08-26 14:27:18 +02:00

sentry left a comment

Reviewed release-toolkit#910 at exact head 5697519298.

The handoff review-time base was 32f4bfe49d. Forgejo's final live base field now reports d442f22b9a as main advanced; the reviewed head did not change.

Decision: APPROVE.

PR-path provenance is correctly separated from grading: the consumer checkout fetches full history, the caller PR base/head SHAs feed git diff --name-only, and the repository-relative path set is transported to rt fragment-check. Missing metadata is explicitly unavailable; an empty path set is known and means pre-existing.
The positive control labels a dense touched fragment as fragment THIS PR touched. The inverse empty-path control still labels the same dense finding pre-existing and remains blocking. Unavailable metadata also remains blocking and is reported distinctly.
Clean-then-adopt is explicit in docs: the full directory remains graded, there is no baseline/grandfather mode, and provenance is routing information rather than an exemption.
#724 scope is unchanged: the same internal density gate, thresholds, checks 7/8/9, and full fragment population remain in force.