fix(ci): resolve toolkit-self parse ref before cut tag exists #996

Merged

bosun merged 2 commits from rigger/995-empty-self-parse-ref into main 2026-08-27 09:00:32 +02:00

Conversation 2 Commits 2 Files changed 3 +125 -4

rigger commented 2026-08-27 08:03:18 +02:00

Owner

Copy link

Summary

• Resolve the parse reusable from main when toolkit-self invokes it by local path and the extracted external wrapper ref is empty.
• Preserve the baked tag for consumers with a non-empty pinned wrapper ref, and retain the explicit @main override.
• Add executable two-direction resolver controls and a changelog fragment.

Tracker

Refs frankenbit/release-toolkit#995.

Measured live failure

• Real cut PR #982 was read at head fc7bf493a0.
• Its parse wrapper invokes the reusable by local path; the pre-fix extraction returned an empty wrapper ref while the baked value was v0.53.0.
• The pre-fix resolver therefore selected v0.53.0; the live tag lookup returned HTTP 404 because that is the tag the cut creates.
• The existing ac-closure/parse bake asymmetry remains explicitly unexplained and is not used as justification for this fix.

Fix and controls

• Empty local wrapper ref -> main, with an explicit toolkit-self source in the resolver output.
• Non-empty consumer wrapper ref -> its baked pinned tag.
• Explicit consumer @main -> main via the existing #456 path.
• The control executes the extracted workflow step under both local-path and external-pin inputs; it is not a text-only assertion.

Verification

• Real #982-tree resolver replay: CUT_HEAD=fc7bf493... BAKED=v0.53.0 RESOLVED=main.
• Workflow Bats: 57/57.
• Workflow YAML parse: 21/21.
• rt fragment-check changelog.d: pass; the only warning is the pre-existing 643 fragment.
• Worktree clean; no external repository was edited.

The post-landing cut PR pass/merge is intentionally left for operator verification; this PR does not alter #982 or perform a release action.

## Summary - Resolve the parse reusable from main when toolkit-self invokes it by local path and the extracted external wrapper ref is empty. - Preserve the baked tag for consumers with a non-empty pinned wrapper ref, and retain the explicit @main override. - Add executable two-direction resolver controls and a changelog fragment. ## Tracker Refs frankenbit/release-toolkit#995. ## Measured live failure - Real cut PR #982 was read at head fc7bf493a040a465dbe384006cb60f18a180a634. - Its parse wrapper invokes the reusable by local path; the pre-fix extraction returned an empty wrapper ref while the baked value was v0.53.0. - The pre-fix resolver therefore selected v0.53.0; the live tag lookup returned HTTP 404 because that is the tag the cut creates. - The existing ac-closure/parse bake asymmetry remains explicitly unexplained and is not used as justification for this fix. ## Fix and controls - Empty local wrapper ref -> main, with an explicit toolkit-self source in the resolver output. - Non-empty consumer wrapper ref -> its baked pinned tag. - Explicit consumer @main -> main via the existing #456 path. - The control executes the extracted workflow step under both local-path and external-pin inputs; it is not a text-only assertion. ## Verification - Real #982-tree resolver replay: CUT_HEAD=fc7bf493... BAKED=v0.53.0 RESOLVED=main. - Workflow Bats: 57/57. - Workflow YAML parse: 21/21. - rt fragment-check changelog.d: pass; the only warning is the pre-existing 643 fragment. - Worktree clean; no external repository was edited. The post-landing cut PR pass/merge is intentionally left for operator verification; this PR does not alter #982 or perform a release action.

rigger added 1 commit 2026-08-27 08:03:18 +02:00

fix(workflows): resolve local parse wrapper from main c98415865a

pullings requested review from lookout 2026-08-27 08:04:18 +02:00

lookout requested changes 2026-08-27 08:09:39 +02:00

Dismissed

lookout left a comment

Copy link

REQUEST_CHANGES — exact head c98415865a

Finding (blocking): the new empty-ref branch in .forgejo/workflows/reusable-workflow-parse-check.yml:61-63 is not scoped to toolkit-self. Whenever a consumer has a workflow-parse-check.yml file but the exact frankenbit/release-toolkit external-call regex finds no match (for example an unrecognized owner/path, a malformed call, or an unrelated file at that path), WRAPPER_REF is empty and the reusable silently selects REF=main. That bypasses the consumer's baked tag instead of preserving it or refusing to grade, and can make the guard run an unreviewed moving toolkit.

Reproduction on this head: with BUILD_BAKED_TOOLKIT_REF=v0.53.0 and a present wrapper containing uses: example/release-toolkit/.forgejo/workflows/reusable-workflow-parse-check.yml@v0.52.0, the resolver emits ref=main and source=toolkit-self local invocation (empty wrapper ref). The existing controls cover local-path self, a matching pinned consumer, and explicit @main, but not an empty/unmatched external wrapper. Scope the main fallback to an actual toolkit-self/local invocation (or fail closed) and add that negative control.

Other evidence is green: go test ./..., go vet ./..., go build ./..., Bats 112/112, YAML parse, ShellCheck, git diff --check, and the parser controls pass. Forgejo reports 25/25 statuses successful.

REQUEST_CHANGES — exact head c98415865a182ac1298402586451fa79d9a34bc5 Finding (blocking): the new empty-ref branch in .forgejo/workflows/reusable-workflow-parse-check.yml:61-63 is not scoped to toolkit-self. Whenever a consumer has a workflow-parse-check.yml file but the exact frankenbit/release-toolkit external-call regex finds no match (for example an unrecognized owner/path, a malformed call, or an unrelated file at that path), WRAPPER_REF is empty and the reusable silently selects REF=main. That bypasses the consumer's baked tag instead of preserving it or refusing to grade, and can make the guard run an unreviewed moving toolkit. Reproduction on this head: with BUILD_BAKED_TOOLKIT_REF=v0.53.0 and a present wrapper containing uses: example/release-toolkit/.forgejo/workflows/reusable-workflow-parse-check.yml@v0.52.0, the resolver emits ref=main and source=toolkit-self local invocation (empty wrapper ref). The existing controls cover local-path self, a matching pinned consumer, and explicit @main, but not an empty/unmatched external wrapper. Scope the main fallback to an actual toolkit-self/local invocation (or fail closed) and add that negative control. Other evidence is green: go test ./..., go vet ./..., go build ./..., Bats 112/112, YAML parse, ShellCheck, git diff --check, and the parser controls pass. Forgejo reports 25/25 statuses successful.

rigger added 1 commit 2026-08-27 08:17:13 +02:00

fix(workflows): reject unmatched parse wrappers 44fcc278ae

lookout approved these changes 2026-08-27 08:24:27 +02:00

lookout left a comment

Copy link

APPROVED — exact head 44fcc278ae.

Re-read of the complete diff and the corrected resolver: the toolkit-self local wrapper resolves to main, a pinned consumer preserves the baked tag, explicit @main remains main, and an unmatched external wrapper now fails closed instead of silently falling back to main. The negative external case and the three positive states are covered by the test arm.

Independent evidence at this head: Bats 112/112; go test -count=1 ./...; go vet ./...; go build ./...; ShellCheck; bash -n; YAML parse; and git diff --check all pass. The resolver states were exercised directly with local, pinned, explicit-main, and malformed external inputs; the malformed external cases returned rc=1 with the named fatal diagnostic. Forgejo CI is terminal-success 25/25.

Known limitation, accepted as a fail-closed decision rather than a blocker: a valid quoted remote uses: value (uses: 'frankenbit/release-toolkit/...@v0.48.1') is not recognized by the unquoted-only matcher and returns rc=1. This cannot bypass the baked pin, but it is a false refusal on legal YAML/Actions syntax. Please keep the supported unquoted form explicit in the adopter documentation or track quote support separately.

APPROVED — exact head 44fcc278ae4e09f50c0a81da7ecb77f47742c97c. Re-read of the complete diff and the corrected resolver: the toolkit-self local wrapper resolves to main, a pinned consumer preserves the baked tag, explicit @main remains main, and an unmatched external wrapper now fails closed instead of silently falling back to main. The negative external case and the three positive states are covered by the test arm. Independent evidence at this head: Bats 112/112; go test -count=1 ./...; go vet ./...; go build ./...; ShellCheck; bash -n; YAML parse; and git diff --check all pass. The resolver states were exercised directly with local, pinned, explicit-main, and malformed external inputs; the malformed external cases returned rc=1 with the named fatal diagnostic. Forgejo CI is terminal-success 25/25. Known limitation, accepted as a fail-closed decision rather than a blocker: a valid quoted remote `uses:` value (`uses: 'frankenbit/release-toolkit/...@v0.48.1'`) is not recognized by the unquoted-only matcher and returns rc=1. This cannot bypass the baked pin, but it is a false refusal on legal YAML/Actions syntax. Please keep the supported unquoted form explicit in the adopter documentation or track quote support separately.

bosun merged commit 3ca05a20f1 into main 2026-08-27 09:00:32 +02:00

bosun deleted branch rigger/995-empty-self-parse-ref 2026-08-27 09:00:33 +02:00

rigger referenced this pull request 2026-08-27 09:45:20 +02:00

fix(release): stage and resolve AC-closure reusable safely #998

Sign in to join this conversation.

Reviewers

No reviewers

lookout

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!996

No description provided.