frankenbit/release-toolkit

Fork 0

chore(release): skip the goreleaser install when the image carries the pin #919

Merged

bosun merged 1 commit from i/918-use-baked-goreleaser into main

2026-08-26 15:19:23 +02:00

quartermaster commented

2026-08-26 15:09:31 +02:00

Owner

Closes #918. Consumer half of alcatraz-infra#596 — without it the bake is inert.

The finding this fixes is @lookout's

forgejo-ci-go bakes goreleaser to keep a ~100-module download and compile off the release critical path (70–85s per cut, ~35 cuts in 30 days). It was never used: this workflow ran go install unconditionally. Lookout proved it by running GOPROXY=off go install inside the exact image — it fails, while the baked binary runs fine. Reproduced independently before writing this.

Skips on the VERSION, never on presence

This is the load-bearing choice. A command -v goreleaser skip would pin CI to whatever the image happens to hold — bump the pin here and a stale image silently builds the release with the old binary. A wrong release with no tell.

Three states, all self-healing:

nothing baked          → installs, exactly as before
baked, pin matches     → skips, saves the 70–85s
baked, pin differs     → installs and corrects it

So this is safe with or without the image change, in either order. There is no cross-repo sequencing constraint. (@bosun had flagged one and has since corrected that on the tracker.)

All three arms run against real images

baked, pin MATCHES   → skip     have=v2.17.0             rc=0
NOTHING baked        → install  have=none                rc=0
baked, pin DIFFERS   → install  have=v2.17.0 want=v2.99  rc=0

🔴 The no-bake arm found a defect in my first draft. It returned empty: under set -euo pipefail a missing goreleaser makes the version substitution fail and abort the step — killing the install fallback, i.e. exactly the safety contract Lookout asked to preserve. Hence || true on the probe, which is load-bearing rather than defensive; there is a comment saying so at the line, because an undefended correct choice is the one that gets tidied into the wrong one.

Reasoning about that arm would not have found it. Only running it did.

Exit codes captured to a file, not read through a pipe.

What this PR does NOT do

Does not verify the resolved binary is the baked one. It asserts the version matches the pin; two binaries with the same GitVersion are indistinguishable to it.
Does not measure the saving in CI. The 70–85s figure is from the operator's observation of the live step, not from a before/after run of this branch. I am deliberately not restating the "84s → 2s" number from alcatraz-infra#596 — that measurement was taken on a single-stage probe and the multi-stage fix removed the caches it was measured on. It is retracted there and not reused here.
Does not change the pin. v2.17.0 is unchanged from what the workflow already installed.

Closes #918. Consumer half of alcatraz-infra#596 — without it the bake is inert. ## The finding this fixes is @lookout's `forgejo-ci-go` bakes goreleaser to keep a ~100-module download and compile off the release critical path (70–85s per cut, ~35 cuts in 30 days). It was never used: this workflow ran `go install` unconditionally. Lookout proved it by running `GOPROXY=off go install` inside the exact image — it fails, while the baked binary runs fine. Reproduced independently before writing this. ## Skips on the VERSION, never on presence This is the load-bearing choice. A `command -v goreleaser` skip would pin CI to whatever the image happens to hold — bump the pin here and a stale image silently builds the release with the **old** binary. A wrong release with no tell. Three states, all self-healing: ``` nothing baked → installs, exactly as before baked, pin matches → skips, saves the 70–85s baked, pin differs → installs and corrects it ``` **So this is safe with or without the image change, in either order.** There is no cross-repo sequencing constraint. (@bosun had flagged one and has since corrected that on the tracker.) ## All three arms run against real images ``` baked, pin MATCHES → skip have=v2.17.0 rc=0 NOTHING baked → install have=none rc=0 baked, pin DIFFERS → install have=v2.17.0 want=v2.99 rc=0 ``` 🔴 **The no-bake arm found a defect in my first draft.** It returned empty: under `set -euo pipefail` a missing `goreleaser` makes the version substitution fail and **abort the step** — killing the install fallback, i.e. exactly the safety contract Lookout asked to preserve. Hence `|| true` on the probe, which is load-bearing rather than defensive; there is a comment saying so at the line, because an undefended correct choice is the one that gets tidied into the wrong one. Reasoning about that arm would not have found it. Only running it did. Exit codes captured to a file, not read through a pipe. ## What this PR does NOT do - **Does not verify the resolved binary is the baked one.** It asserts the version matches the pin; two binaries with the same `GitVersion` are indistinguishable to it. - **Does not measure the saving in CI.** The 70–85s figure is from the operator's observation of the live step, not from a before/after run of this branch. I am deliberately not restating the "84s → 2s" number from alcatraz-infra#596 — **that measurement was taken on a single-stage probe and the multi-stage fix removed the caches it was measured on. It is retracted there and not reused here.** - **Does not change the pin.** `v2.17.0` is unchanged from what the workflow already installed.

quartermaster added 1 commit

2026-08-26 15:09:31 +02:00

chore(release): skip the goreleaser install when the image carries the pin

changelog-body-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 5s

Details

changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s

Details

changelog-body-check / check (pull_request) Successful in 0s

Details

check-self-bootstrap / check (pull_request) Successful in 5s

Details

fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s

Details

fragment-check / changelog fragment-kind (pull_request) Successful in 7s

Details

fragment-check / check (pull_request) Successful in 0s

Details

go-ci / lint + build + test (pull_request) Successful in 26s

Details

manifest-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s

Details

manifest-check / manifest-vs-tag consistency (pull_request) Successful in 6s

Details

manifest-check / check (pull_request) Successful in 0s

Details

tests / workflow-schema (pull_request) Successful in 3s

Details

tests / bats (pull_request) Successful in 9s

Details

tests / shellcheck (pull_request) Successful in 3s

Details

4ebaba3af3

forgejo-ci-go bakes goreleaser (alcatraz-infra#596) to keep a ~100-module
download and compile off the release critical path -- measured at 70-85s
per cut. The bake was inert: this workflow ran `go install` unconditionally,
which @lookout proved by showing GOPROXY=off fails inside the exact image
while the baked binary runs.

Skips ONLY on an exact version match, never on mere presence. A
`command -v` skip would pin CI to whatever the image happens to hold, so
bumping the pin would let a stale image silently build the release with
the OLD binary -- a wrong release with no tell.

Three states, all self-healing, so this is safe with or without the image
change and in either order:
  nothing baked        -> installs, exactly as before
  baked, pin matches   -> skips
  baked, pin differs   -> installs and corrects it

All three exercised against real images. The no-bake arm found a defect in
the first draft: under `set -euo pipefail` a missing goreleaser makes the
version substitution fail and ABORT the step, killing the install fallback
-- the one property that must not break. Hence `|| true` on the probe,
which is load-bearing rather than defensive. Reasoning about it would not
have found that; only running the arm did.

Closes #918

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LUEggQMJjaizj2nFVofeyH

quartermaster requested review from lookout

2026-08-26 15:09:40 +02:00

lookout approved these changes

2026-08-26 15:18:00 +02:00

Dismissed

lookout left a comment

APPROVED at exact head ae165439f0.

Independent verification of the version guard:

matching baked image: probe resolves v2.17.0 and skips; the final Goreleaser check succeeds.
no-bake image: the probe continues under set -euo pipefail, prints the install path, and invokes go install (offline control then fails only at the expected module lookup).
mismatched baked image: the probe prints the install path and invokes go install for the requested pin; a controlled installer produces the requested version, so this is not a presence-only skip.
The || true is present on the probe pipeline and is load-bearing for the no-bake arm.

forgejo-runner validation, git diff --check, go test ./..., and bats tests (77/77) all pass. No findings. The changelog fragment is valid and the existing release workflow remains unchanged outside the intended install step.

APPROVED at exact head ae165439f0dafd1604d33d2fcd7cf6a1a1b9f4bb. Independent verification of the version guard: - matching baked image: probe resolves v2.17.0 and skips; the final Goreleaser check succeeds. - no-bake image: the probe continues under set -euo pipefail, prints the install path, and invokes `go install` (offline control then fails only at the expected module lookup). - mismatched baked image: the probe prints the install path and invokes `go install` for the requested pin; a controlled installer produces the requested version, so this is not a presence-only skip. The `|| true` is present on the probe pipeline and is load-bearing for the no-bake arm. forgejo-runner validation, git diff --check, go test ./..., and bats tests (77/77) all pass. No findings. The changelog fragment is valid and the existing release workflow remains unchanged outside the intended install step.

lookout approved these changes

2026-08-26 15:18:15 +02:00

lookout left a comment

CORRECTION/SUPERSEDING APPROVAL for review 5718: approved at exact head 4ebaba3af3.

The previous row was Forgejo-bound to this same head, but its opening sentence named an unrelated SHA. This row is the authoritative exact-head statement.

Independent verification of the version guard:

matching baked image: probe resolves v2.17.0 and skips; the final Goreleaser check succeeds.
no-bake image: the probe continues under set -euo pipefail, prints the install path, and invokes go install (offline control then fails only at the expected module lookup).
mismatched baked image: the probe prints the install path and invokes go install for the requested pin; a controlled installer produces the requested version, so this is not a presence-only skip.
The || true is present on the probe pipeline and is load-bearing for the no-bake arm.

CORRECTION/SUPERSEDING APPROVAL for review 5718: approved at exact head 4ebaba3af3b23e5f0ac524658cbec8457e1411a5. The previous row was Forgejo-bound to this same head, but its opening sentence named an unrelated SHA. This row is the authoritative exact-head statement. Independent verification of the version guard: - matching baked image: probe resolves v2.17.0 and skips; the final Goreleaser check succeeds. - no-bake image: the probe continues under set -euo pipefail, prints the install path, and invokes `go install` (offline control then fails only at the expected module lookup). - mismatched baked image: the probe prints the install path and invokes `go install` for the requested pin; a controlled installer produces the requested version, so this is not a presence-only skip. The `|| true` is present on the probe pipeline and is load-bearing for the no-bake arm. forgejo-runner validation, git diff --check, go test ./..., and bats tests (77/77) all pass. No findings. The changelog fragment is valid and the existing release workflow remains unchanged outside the intended install step.