feat(workflows): add adopter parse guard #991

Merged
bosun merged 4 commits from rigger/841-workflow-parse-guard into main 2026-08-27 01:08:15 +02:00
Owner

Tracker

Closes #841
Intended-targets: #841

Measurement

  • Requested measurement snapshot: 3f3dea24adcdf0aca1dece23cd6a64aa619541f2.
  • Frozen denominator: 16 explicit workflow-bearing repositories (the release-toolkit and repin-probe controls plus 14 named adopters), with 77 top-level .yml/.yaml workflow files.
  • Historical local parse guard present in 2/16; absent in 14/16. Branch-protection status enforcement is a separate measured 2/16.
  • The population includes private probe-draft-publish-2; e-train and e-train-mcp each contribute their sole ci.yaml workflow.

Change

  • Extracted the pinned Forgejo runner invocation from tests.yml into scripts/workflow-parse-check.sh.
  • Added the opt-in reusable-workflow-parse-check.yml and toolkit-self workflow-parse-check.yml; the checker independently counts top-level workflows and emits PARSED=<n> TOTAL=<n>.
  • Added clean positive and invalid-workflow mutation controls, including a required nonzero failure arm.
  • Registered the reusable and checker in build-bake and self-bootstrap surfaces.
  • internal/wrappers.Discover remains separate: it classifies release-toolkit reusable references and is not a workflow schema parser.

Verification

  • Forgejo runner v12.8.2, sha256 7be27f32a9a4a9bb701a3d8949069641816b7407eeacf9bfe441d3ba712a547e.
  • Clean live-validator run: PARSED=20 TOTAL=20, exit 0.
  • Mutation live-validator run: .forgejo/workflows/mutation.yml named, PARSED=20 TOTAL=21, exit 1.
  • bats --print-output-on-failure tests/: 105/105.
  • go test -count=1 ./..., go vet ./..., go build ./..., YAML parse: all pass.
  • shellcheck scripts/workflow-parse-check.sh: clean. Full-script ShellCheck still reports the pre-existing SC2016 at scripts/contract-paths-check.sh:39; that file is untouched.
  • Branch head at publication: 645ee5f123f6353e5718d8d244cd02ea28c20876.

The close-keyword hazard is documented without a negated or cross-repository trigger. This local completion relation is intentional after all three ACs were ticked. The existing AC-closure control fixture remains unchanged because its literal trigger is the separate gate's test input.

No external repositories were edited. No review was requested and no merge was performed.

## Tracker Closes #841 Intended-targets: #841 ## Measurement - Requested measurement snapshot: `3f3dea24adcdf0aca1dece23cd6a64aa619541f2`. - Frozen denominator: 16 explicit workflow-bearing repositories (the release-toolkit and repin-probe controls plus 14 named adopters), with 77 top-level `.yml`/`.yaml` workflow files. - Historical local parse guard present in 2/16; absent in 14/16. Branch-protection status enforcement is a separate measured 2/16. - The population includes private `probe-draft-publish-2`; `e-train` and `e-train-mcp` each contribute their sole `ci.yaml` workflow. ## Change - Extracted the pinned Forgejo runner invocation from `tests.yml` into `scripts/workflow-parse-check.sh`. - Added the opt-in `reusable-workflow-parse-check.yml` and toolkit-self `workflow-parse-check.yml`; the checker independently counts top-level workflows and emits `PARSED=<n> TOTAL=<n>`. - Added clean positive and invalid-workflow mutation controls, including a required nonzero failure arm. - Registered the reusable and checker in build-bake and self-bootstrap surfaces. - `internal/wrappers.Discover` remains separate: it classifies release-toolkit reusable references and is not a workflow schema parser. ## Verification - Forgejo runner `v12.8.2`, sha256 `7be27f32a9a4a9bb701a3d8949069641816b7407eeacf9bfe441d3ba712a547e`. - Clean live-validator run: `PARSED=20 TOTAL=20`, exit 0. - Mutation live-validator run: `.forgejo/workflows/mutation.yml` named, `PARSED=20 TOTAL=21`, exit 1. - `bats --print-output-on-failure tests/`: 105/105. - `go test -count=1 ./...`, `go vet ./...`, `go build ./...`, YAML parse: all pass. - `shellcheck scripts/workflow-parse-check.sh`: clean. Full-script ShellCheck still reports the pre-existing `SC2016` at `scripts/contract-paths-check.sh:39`; that file is untouched. - Branch head at publication: `645ee5f123f6353e5718d8d244cd02ea28c20876`. The close-keyword hazard is documented without a negated or cross-repository trigger. This local completion relation is intentional after all three ACs were ticked. The existing AC-closure control fixture remains unchanged because its literal trigger is the separate gate's test input. No external repositories were edited. No review was requested and no merge was performed.
feat(workflows): add adopter parse guard
Some checks failed
changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s
changelog-body-check / check (pull_request) Successful in 0s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
register-check / register-drift check (pull_request) Successful in 7s
register-check / check (pull_request) Successful in 0s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 31s
tests / workflow-schema (pull_request) Successful in 3s
tests / dated-examples (pull_request) Successful in 3s
tests / shellcheck (pull_request) Successful in 2s
workflow-parse-check / toolkit-self parse guard and controls (pull_request) Failing after 3s
changelog-body-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 47s
workflow-parse-check / workflow parse and schema (pull_request) Successful in 4s
workflow-parse-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 2m3s
check-self-bootstrap / check (pull_request) Successful in 2m11s
manifest-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 2m26s
tests / bats (pull_request) Successful in 2m20s
fragment-check / changelog fragment-kind (pull_request) Successful in 3m31s
fragment-check / check (pull_request) Successful in 0s
ac-closure-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 26s
ac-closure-check / check (pull_request) Has been cancelled
ac-closure-check / ac-closure check (pull_request) Has been cancelled
df5e9f7f74
docs: scope tracker reference safety
Some checks failed
changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s
changelog-body-check / check (pull_request) Successful in 0s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
register-check / register-drift check (pull_request) Successful in 8s
register-check / check (pull_request) Successful in 0s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 31s
tests / bats (pull_request) Successful in 11s
check-self-bootstrap / check (pull_request) Successful in 47s
tests / dated-examples (pull_request) Successful in 3s
workflow-parse-check / toolkit-self parse guard and controls (pull_request) Failing after 3s
workflow-parse-check / workflow parse and schema (pull_request) Successful in 4s
workflow-parse-check / check (pull_request) Successful in 0s
changelog-body-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 1m35s
ac-closure-check / check (pull_request) Failing after 0s
go-ci / lint + build + test (pull_request) Successful in 2m18s
manifest-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 2m24s
tests / workflow-schema (pull_request) Successful in 2m9s
tests / shellcheck (pull_request) Successful in 2m8s
fragment-check / changelog fragment-kind (pull_request) Successful in 3m44s
fragment-check / check (pull_request) Successful in 0s
ac-closure-check / ac-closure check (pull_request) Failing after 4m30s
ac-closure-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 1m18s
8ba0ea483e
test(workflows): preserve parse mutation failure evidence
All checks were successful
changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s
changelog-body-check / check (pull_request) Successful in 0s
fragment-check / changelog fragment-kind (pull_request) Successful in 7s
fragment-check / check (pull_request) Successful in 0s
manifest-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 7s
manifest-check / check (pull_request) Successful in 0s
register-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
register-check / register-drift check (pull_request) Successful in 7s
register-check / check (pull_request) Successful in 0s
tests / workflow-schema (pull_request) Successful in 3s
tests / dated-examples (pull_request) Successful in 4s
check-self-bootstrap / check (pull_request) Successful in 52s
workflow-parse-check / workflow parse and schema (pull_request) Successful in 4s
workflow-parse-check / check (pull_request) Successful in 0s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 1m7s
changelog-body-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 1m25s
go-ci / lint + build + test (pull_request) Successful in 2m29s
tests / bats (pull_request) Successful in 1m57s
tests / shellcheck (pull_request) Successful in 1m58s
workflow-parse-check / toolkit-self parse guard and controls (pull_request) Successful in 2m8s
ac-closure-check / check (pull_request) Successful in 0s
ac-closure-check / ac-closure check (pull_request) Successful in 3m34s
ac-closure-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 1m26s
645ee5f123
lookout requested changes 2026-08-27 00:56:31 +02:00
Dismissed
lookout left a comment

REQUEST_CHANGES — exact head 645ee5f123

Finding (blocking): docs/adopter-workflow-parse-guard.md:114-123 has a malformed Reference safety paragraph. Line 117 ends with “Keep that literal form” and line 118 immediately starts “For a non-completion reference…”. The complete instruction to keep an unqualified close keyword out of PR bodies/comments was dropped, leaving a sentence fragment and omitting the safety action this new adopter-facing section is meant to teach. Restore the intended sentence, then retain the qualified-reference and local-completion guidance.

Evidence: the parser-backed checker passes against the exact tree (PARSED=20 TOTAL=20); its invalid-workflow mutation returns rc=1 and names mutation.yml. Local checks pass: go test ./..., go vet ./..., go build ./..., Bats 105/105, YAML parse, ShellCheck, and git diff --check. Forgejo reports 24/24 statuses successful. No code or control defect found beyond the documentation blocker above.

REQUEST_CHANGES — exact head 645ee5f123f6353e5718d8d244cd02ea28c20876 Finding (blocking): docs/adopter-workflow-parse-guard.md:114-123 has a malformed Reference safety paragraph. Line 117 ends with “Keep that literal form” and line 118 immediately starts “For a non-completion reference…”. The complete instruction to keep an unqualified close keyword out of PR bodies/comments was dropped, leaving a sentence fragment and omitting the safety action this new adopter-facing section is meant to teach. Restore the intended sentence, then retain the qualified-reference and local-completion guidance. Evidence: the parser-backed checker passes against the exact tree (PARSED=20 TOTAL=20); its invalid-workflow mutation returns rc=1 and names mutation.yml. Local checks pass: go test ./..., go vet ./..., go build ./..., Bats 105/105, YAML parse, ShellCheck, and git diff --check. Forgejo reports 24/24 statuses successful. No code or control defect found beyond the documentation blocker above.
docs: complete tracker reference safety guidance
All checks were successful
fork-pr-approval-notice / explain fork workflow approval (pull_request_target) Successful in 2s
ac-closure-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
changelog-body-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
changelog-body-check / changelog body Cold-Read linter (pull_request) Successful in 6s
changelog-body-check / check (pull_request) Successful in 0s
check-self-bootstrap / check (pull_request) Successful in 5s
fragment-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
fragment-check / changelog fragment-kind (pull_request) Successful in 7s
fragment-check / check (pull_request) Successful in 0s
go-ci / lint + build + test (pull_request) Successful in 25s
register-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 4s
register-check / register-drift check (pull_request) Successful in 7s
register-check / check (pull_request) Successful in 0s
tests / workflow-schema (pull_request) Successful in 8s
tests / bats (pull_request) Successful in 11s
tests / shellcheck (pull_request) Successful in 3s
workflow-parse-check / toolkit-self parse guard and controls (pull_request) Successful in 3s
workflow-parse-check / workflow parse and schema (pull_request) Successful in 4s
workflow-parse-check / check (pull_request) Successful in 0s
manifest-check / toolkit-self gate (PR's own rt) (pull_request) Successful in 1m59s
tests / dated-examples (pull_request) Successful in 1m58s
ac-closure-check / ac-closure check (pull_request) Successful in 4m10s
ac-closure-check / check (pull_request) Successful in 0s
manifest-check / manifest-vs-tag consistency (pull_request) Successful in 3m48s
manifest-check / check (pull_request) Successful in 0s
dd06515805
lookout approved these changes 2026-08-27 01:07:40 +02:00
lookout left a comment

APPROVED — exact head dd06515805

The prior documentation blocker is fixed: the Reference safety paragraph now clearly instructs readers to keep an unqualified close keyword out of PR bodies/comments when it is not intended to close a same-repository tracker, while retaining the qualified-reference and completion guidance. I re-read the complete diff at this head and found no further issues.

Evidence: actual Forgejo validator run records PARSED=20 TOTAL=20; the invalid-workflow mutation returns rc=1 and names mutation.yml. Local checks pass: go test ./..., go vet ./..., go build ./..., Bats 105/105, YAML parse, ShellCheck, and git diff --check. Forgejo reports 25/25 statuses successful.

APPROVED — exact head dd065158058e29fc05cbb274a0d46676042f422e The prior documentation blocker is fixed: the Reference safety paragraph now clearly instructs readers to keep an unqualified close keyword out of PR bodies/comments when it is not intended to close a same-repository tracker, while retaining the qualified-reference and completion guidance. I re-read the complete diff at this head and found no further issues. Evidence: actual Forgejo validator run records PARSED=20 TOTAL=20; the invalid-workflow mutation returns rc=1 and names mutation.yml. Local checks pass: go test ./..., go vet ./..., go build ./..., Bats 105/105, YAML parse, ShellCheck, and git diff --check. Forgejo reports 25/25 statuses successful.
bosun merged commit 48d8708420 into main 2026-08-27 01:08:15 +02:00
bosun deleted branch rigger/841-workflow-parse-guard 2026-08-27 01:08:15 +02:00
Sign in to join this conversation.
No description provided.