fix(release): stage and resolve AC-closure reusable safely #998

Merged

bosun merged 2 commits from rigger/997-ac-closure-ref into main 2026-08-27 09:52:02 +02:00

Conversation 1 Commits 2 Files changed 4 +241 -4

rigger commented 2026-08-27 09:45:20 +02:00

Owner

Copy link

Scope

Refs frankenbit/release-toolkit#997.

This PR keeps the repair in the tracker-specified order:

1. Port the fail-closed empty-ref discrimination from #996 to reusable-ac-closure-check.yml.
2. Repair the rt prep staging population after the resolver/control is present.

The local toolkit-self invocation resolves main; a matching pinned adopter retains its baked tag; explicit @main remains main; an unmatched external wrapper refuses instead of silently bypassing its baked ref.

Measured finding and disposition

The historical #982 cut exposed the latent interaction. At review-bound cut tree a1c383ea6f713aa73f12a708b4afa62d3baabf2d, the AC-closure reusable carried baked v0.53.0, its toolkit-self wrapper invoked it by local path, the pre-fix resolver selected v0.53.0, and the tag lookup returned 404. The cut later shipped and the tag now exists; this is historical evidence, not a current release-state claim.

The skip had a concrete source-level cause. internal/bake/marker.go enumerated seven canonical marker files, while cmd/rt/prep.go staged only six after RewriteToolkitRefFiles; its bakeRefFiles mirror omitted reusable-ac-closure-check.yml. The omission explains the observed 6-of-7 result. The final lists are now identical and ordered. The resolver/control commit precedes the staging-list repair commit.

Controls

• Pre-fix mutation: removing only the new local-path branch makes an unpublished baked ref remain selected; an empty scratch repository has no matching tag ref, so the checkout probe refuses it.
• Fixed local toolkit-self control: baked v0.53.0 resolves to main and reports the local source.
• Matching pinned consumer control: baked v0.52.0 remains v0.52.0.
• Explicit @main control: resolves to main.
• Unmatched external wrapper control: exits 1 and never resolves to main.
• The five adopter-invoked reusables are audited independently: release, manifest, changelog-fragment, changelog-body, and register each retain external-pin extraction plus the #456 @main override. The existing parse control remains in place from #996.

The external recognizer remains intentionally exact and unquoted. A valid quoted external uses line is unsupported and fails closed; broadening that syntax is a separate decision, not a reason to default to main.

Verification

• bats tests/workflows.bats tests/workflow-parse-check.bats: 60/60 passed.
• go test ./...: passed.
• go vet ./...: passed.
• go build ./...: passed.
• go run ./cmd/rt fragment-check changelog.d: passed.
• git diff --check: passed.
• All workflow YAML files parsed successfully as part of the Bats run.

No external repositories were edited. No review request or merge was made.

## Scope Refs frankenbit/release-toolkit#997. This PR keeps the repair in the tracker-specified order: 1. Port the fail-closed empty-ref discrimination from #996 to `reusable-ac-closure-check.yml`. 2. Repair the `rt prep` staging population after the resolver/control is present. The local toolkit-self invocation resolves `main`; a matching pinned adopter retains its baked tag; explicit `@main` remains `main`; an unmatched external wrapper refuses instead of silently bypassing its baked ref. ## Measured finding and disposition The historical #982 cut exposed the latent interaction. At review-bound cut tree `a1c383ea6f713aa73f12a708b4afa62d3baabf2d`, the AC-closure reusable carried baked `v0.53.0`, its toolkit-self wrapper invoked it by local path, the pre-fix resolver selected `v0.53.0`, and the tag lookup returned 404. The cut later shipped and the tag now exists; this is historical evidence, not a current release-state claim. The skip had a concrete source-level cause. `internal/bake/marker.go` enumerated seven canonical marker files, while `cmd/rt/prep.go` staged only six after `RewriteToolkitRefFiles`; its `bakeRefFiles` mirror omitted `reusable-ac-closure-check.yml`. The omission explains the observed 6-of-7 result. The final lists are now identical and ordered. The resolver/control commit precedes the staging-list repair commit. ## Controls - Pre-fix mutation: removing only the new local-path branch makes an unpublished baked ref remain selected; an empty scratch repository has no matching tag ref, so the checkout probe refuses it. - Fixed local toolkit-self control: baked `v0.53.0` resolves to `main` and reports the local source. - Matching pinned consumer control: baked `v0.52.0` remains `v0.52.0`. - Explicit `@main` control: resolves to `main`. - Unmatched external wrapper control: exits 1 and never resolves to `main`. - The five adopter-invoked reusables are audited independently: release, manifest, changelog-fragment, changelog-body, and register each retain external-pin extraction plus the #456 `@main` override. The existing parse control remains in place from #996. The external recognizer remains intentionally exact and unquoted. A valid quoted external `uses` line is unsupported and fails closed; broadening that syntax is a separate decision, not a reason to default to `main`. ## Verification - `bats tests/workflows.bats tests/workflow-parse-check.bats`: 60/60 passed. - `go test ./...`: passed. - `go vet ./...`: passed. - `go build ./...`: passed. - `go run ./cmd/rt fragment-check changelog.d`: passed. - `git diff --check`: passed. - All workflow YAML files parsed successfully as part of the Bats run. No external repositories were edited. No review request or merge was made.

rigger added 2 commits 2026-08-27 09:45:20 +02:00

fix(workflows): guard local AC closure ref resolution ... 51185f8156

Refs frankenbit/release-toolkit#997

fix(prep): stage the AC closure baked ref ... 442ff5a56a

Refs frankenbit/release-toolkit#997

pullings requested review from lookout 2026-08-27 09:46:31 +02:00

lookout approved these changes 2026-08-27 09:50:28 +02:00

lookout left a comment

Copy link

APPROVED — exact head 442ff5a56a.

Re-read of the complete diff: AC-closure toolkit-self local invocation resolves to main before a cut tag exists; a pinned adopter retains its baked ref; explicit @main remains main; and an unmatched external wrapper fails closed rather than falling back to main. The resolver/control commit precedes the prep staging-list repair, and the seven-entry staging list now matches bake.canonicalFiles in content and order.

I ran the focused #997 controls: all three pass, including the pre-fix unpublished-tag checkout refusal, the local/pinned/@main/unmatched resolver states, and independent audits of all five adopter reusables. Full Bats (117/117), go test -count=1 ./..., go vet ./..., go build ./..., fragment-check, YAML parsing, ShellCheck for the changed checker, and git diff --check pass. Forgejo CI is terminal-success 25/25.

The exact unquoted external recognizer remains a documented fail-closed limitation: a valid quoted external uses value is refused rather than silently bypassing the baked pin. That is disclosed in the PR and is not a blocker for this change.

APPROVED — exact head 442ff5a56aea510816e82a50748b5d2f8cbf483c. Re-read of the complete diff: AC-closure toolkit-self local invocation resolves to main before a cut tag exists; a pinned adopter retains its baked ref; explicit @main remains main; and an unmatched external wrapper fails closed rather than falling back to main. The resolver/control commit precedes the prep staging-list repair, and the seven-entry staging list now matches bake.canonicalFiles in content and order. I ran the focused #997 controls: all three pass, including the pre-fix unpublished-tag checkout refusal, the local/pinned/@main/unmatched resolver states, and independent audits of all five adopter reusables. Full Bats (117/117), go test -count=1 ./..., go vet ./..., go build ./..., fragment-check, YAML parsing, ShellCheck for the changed checker, and git diff --check pass. Forgejo CI is terminal-success 25/25. The exact unquoted external recognizer remains a documented fail-closed limitation: a valid quoted external uses value is refused rather than silently bypassing the baked pin. That is disclosed in the PR and is not a blocker for this change.

bosun merged commit 442ff5a56a into main 2026-08-27 09:52:02 +02:00

bosun deleted branch rigger/997-ac-closure-ref 2026-08-27 09:52:02 +02:00

pullings referenced this pull request 2026-08-27 09:52:46 +02:00

bug(release): reusable-ac-closure-check.yml is correct only because rt prep SKIPS it — two defects cancelling, and fixing the skip breaks the cut #997

Sign in to join this conversation.

Reviewers

No reviewers

lookout

Labels

Clear labels   

bump

major

Override the cut bump to MAJOR (release-toolkit#107)

  

bump

minor

Override the cut bump to MINOR (release-toolkit#107)

  

bump

patch

Override the cut bump to PATCH (release-toolkit#107)

  

kind/bug

Something is broken

  

kind/chore

Maintenance, tooling, refactor

  

kind/docs

Documentation work

  

kind/feature

New feature or capability

  

priority/critical

Critical: must be addressed immediately

  

priority/high

Important, should be addressed soon

  

priority/low

Low priority, address when convenient

  

priority/medium

Normal priority

  

size/L

Large: significant feature, ~6-16h

  

size/M

Medium: moderate feature, ~2-6h

  

size/S

Small: simple change, ~1-2h

  

size/XL

Extra large: major feature or refactor, 16h+

No labels

bump

major

bump

minor

bump

patch

kind/bug

kind/chore

kind/docs

kind/feature

priority/critical

priority/high

priority/low

priority/medium

size/L

size/M

size/S

size/XL

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

frankenbit/release-toolkit!998

No description provided.