codex-bot-andresmgsl/ceremony
1
0
Fork 0
forked from heavy-duty/ceremony
Code Pull requests Activity
ceremony/changelog.d/188.md

41 lines
2 KiB
Markdown
Raw Normal View History

feat(forge): refuse loudly when the client cannot speak the forge The preflight half of #188, landed first so it stands alone: the forge is decided once, before any sweep, and a client that cannot speak it exits non-zero with a named reason. Measured against forgejo.heavyduty.builders at 84bb1a4 — two of the three actions reported SUCCESS having read nothing: labels-scope exit 0 "no .github/labeler.yml" (the file is HTTP 200) labels-reconcile exit 0 "reconciled." (zero PRs enumerated) issueflow-reconcile exit 1 "unexpected end of JSON input" labels-reconcile's blind-sweep warning (#96) could not fire: it counts unreadable PRs against a list `gh pr list` never produced, and a process substitution's failure does not trip set -e, so total stayed 0. Installing gh makes it worse, silencing the one loud failure. Detection is measured, not inferred from docs: a real forgejo-runner v6.3.1 job (probe task 278) shows Forgejo populating the whole GITHUB_* namespace, so GITHUB_ACTIONS proves nothing. GITHUB_API_URL's shape, GITEA_ACTIONS and GITHUB_SERVER_URL do. The same probe shows the runner image carries neither gh nor stoke, which is what makes the forgejo backend REST. Tests declare CEREMONY_FORGE at the forge boundary rather than stubbing gh and staying silent about the forge — the boundary move term 5 asks for. Refs #188
2026-08-02 18:29:08 +00:00
### Added
- `lib/forge.sh` — the forge selector: `forge_detect` names the forge from
the runner's own environment, `forge_client` names the client it needs, and
`forge_preflight` refuses loudly before any sweep when the two disagree
(#188).
- The reconcilers and `labels-scope` run that preflight first, so a
GitHub-shaped client on a Forgejo instance is a named refusal instead of a
sweep that reads nothing and reports success (#188).
feat(forge): replace both gh api graphql sites with REST + a body parser Term 3 of #188. Forgejo has no GraphQL API, so these two gathers could not be translated — there is no endpoint to translate them to. A real forgejo-runner job says so from the other side: GITHUB_GRAPHQL_URL arrives set to the empty string (probe task 278). MERGED_REF_PR_RECORDS was already a body parse; GraphQL was buying pagination, nothing semantic. OPEN_PR_ISSUES used GitHub's own parse of the closing keywords, so it becomes lib/closes_references.sh — a sibling of refs_references, sharing its LOCAL/CROSS classifier so rig#112 can still never be read as local #112 (#61). Both gathers now read /pulls, which /api/v3 and /api/v1 return in the same shape (measured on both). merged_at replaces GraphQL's states: MERGED. Bodies travel base64: jq's @tsv escapes a newline to a literal backslash-n, which a line parser reads as one line and loses every declaration after the first. The accepted delta, written down rather than rediscovered: GitHub also records closing links attached through the PR development sidebar, which live in no body. This family declares links in the body, so the delta is zero here. Refs #188
2026-08-02 18:41:03 +00:00
- `lib/closes_references.sh` — the closing-keyword parser, sibling of
`refs_references`, so "which issues does this PR close" is answered from a
PR body rather than from GitHub's GraphQL API (#188).
feat(forge): two backends behind one call surface, and the shim owns paging Term 1's foundation. lib/forge.sh gains forge_select, which sources exactly one of lib/forge-github.sh or lib/forge-forgejo.sh; both define the same verbs, so no branching reaches the 61 call sites. The github backend is the current gh invocation extracted 1:1 — term 5 is kept by making that path boring. The page size moves OUT of the call sites and into the backend, because it is not portable and fails silently. Measured 2026-08-02: ?per_page=100 GitHub 100 items Forgejo 30 items (ignored) ?limit=100 GitHub 30 items Forgejo 50 items (capped) Both answer HTTP 200 with valid JSON. Every call site here is GitHub-shaped, so a verbatim port would have swept 30 of rig's 137 issues and printed "reconciled." — criterion 2 failing green, the same failure class as the blind sweep. Both page_url helpers strip a stray page-size parameter in either dialect, so a call site cannot reintroduce it by accident. Forgejo caps a page at 50 whatever is asked, so pagination is mandatory, not an optimisation. The gather is then PROVEN complete against x-total-count rather than assumed complete because a loop ended. @kimi-reviewer-andresmgsl's hardening (#4699): a missing x-total-count is itself a loud refusal. Header exposure is a server setting, and an assert that cannot run must not silently pass — that is the failure class re-entering through the guard built to stop it. Call sites are not ported yet; that is the next commit. Refs #188
2026-08-02 19:00:58 +00:00
- `lib/forge-github.sh` and `lib/forge-forgejo.sh` — one call surface, two
backends, selected by `forge_select`; no forge branching at the call sites
(#188).
- The forgejo backend proves each paginated gather complete against the
server's `x-total-count` and refuses loudly when it cannot — a missing
header is a refusal, not a pass (#188).
feat(forge): replace both gh api graphql sites with REST + a body parser Term 3 of #188. Forgejo has no GraphQL API, so these two gathers could not be translated — there is no endpoint to translate them to. A real forgejo-runner job says so from the other side: GITHUB_GRAPHQL_URL arrives set to the empty string (probe task 278). MERGED_REF_PR_RECORDS was already a body parse; GraphQL was buying pagination, nothing semantic. OPEN_PR_ISSUES used GitHub's own parse of the closing keywords, so it becomes lib/closes_references.sh — a sibling of refs_references, sharing its LOCAL/CROSS classifier so rig#112 can still never be read as local #112 (#61). Both gathers now read /pulls, which /api/v3 and /api/v1 return in the same shape (measured on both). merged_at replaces GraphQL's states: MERGED. Bodies travel base64: jq's @tsv escapes a newline to a literal backslash-n, which a line parser reads as one line and loses every declaration after the first. The accepted delta, written down rather than rediscovered: GitHub also records closing links attached through the PR development sidebar, which live in no body. This family declares links in the body, so the delta is zero here. Refs #188
2026-08-02 18:41:03 +00:00
### Changed
- `issueflow-reconcile` gathers open and merged PRs over REST instead of
`gh api graphql`. Forgejo serves no GraphQL at all, so the two queries were
replaced rather than translated; both forges return `number` and `body`
from `/pulls` in the same shape (#188).
feat(forge): refuse loudly when the client cannot speak the forge The preflight half of #188, landed first so it stands alone: the forge is decided once, before any sweep, and a client that cannot speak it exits non-zero with a named reason. Measured against forgejo.heavyduty.builders at 84bb1a4 — two of the three actions reported SUCCESS having read nothing: labels-scope exit 0 "no .github/labeler.yml" (the file is HTTP 200) labels-reconcile exit 0 "reconciled." (zero PRs enumerated) issueflow-reconcile exit 1 "unexpected end of JSON input" labels-reconcile's blind-sweep warning (#96) could not fire: it counts unreadable PRs against a list `gh pr list` never produced, and a process substitution's failure does not trip set -e, so total stayed 0. Installing gh makes it worse, silencing the one loud failure. Detection is measured, not inferred from docs: a real forgejo-runner v6.3.1 job (probe task 278) shows Forgejo populating the whole GITHUB_* namespace, so GITHUB_ACTIONS proves nothing. GITHUB_API_URL's shape, GITEA_ACTIONS and GITHUB_SERVER_URL do. The same probe shows the runner image carries neither gh nor stoke, which is what makes the forgejo backend REST. Tests declare CEREMONY_FORGE at the forge boundary rather than stubbing gh and staying silent about the forge — the boundary move term 5 asks for. Refs #188
2026-08-02 18:29:08 +00:00
feat(forge): two backends behind one call surface, and the shim owns paging Term 1's foundation. lib/forge.sh gains forge_select, which sources exactly one of lib/forge-github.sh or lib/forge-forgejo.sh; both define the same verbs, so no branching reaches the 61 call sites. The github backend is the current gh invocation extracted 1:1 — term 5 is kept by making that path boring. The page size moves OUT of the call sites and into the backend, because it is not portable and fails silently. Measured 2026-08-02: ?per_page=100 GitHub 100 items Forgejo 30 items (ignored) ?limit=100 GitHub 30 items Forgejo 50 items (capped) Both answer HTTP 200 with valid JSON. Every call site here is GitHub-shaped, so a verbatim port would have swept 30 of rig's 137 issues and printed "reconciled." — criterion 2 failing green, the same failure class as the blind sweep. Both page_url helpers strip a stray page-size parameter in either dialect, so a call site cannot reintroduce it by accident. Forgejo caps a page at 50 whatever is asked, so pagination is mandatory, not an optimisation. The gather is then PROVEN complete against x-total-count rather than assumed complete because a loop ended. @kimi-reviewer-andresmgsl's hardening (#4699): a missing x-total-count is itself a loud refusal. Header exposure is a server setting, and an assert that cannot run must not silently pass — that is the failure class re-entering through the guard built to stop it. Call sites are not ported yet; that is the next commit. Refs #188
2026-08-02 19:00:58 +00:00
- `forge_api` owns the page size, because each forge silently ignores the
other's parameter: `per_page=100` reads 30 items on Forgejo and `limit=100`
reads 30 on GitHub, both HTTP 200. No call site names one (#188).
feat(forge): derive outstanding review requests from the head, not the field Term 4. GitHub clears requested_reviewers when a verdict lands, so the field answers "who still owes a verdict" by itself. Forgejo never clears it — measured: rig!140 listed all three panelists with all three verdicts in, and rig!146 still lists three while MERGED, so the field is stale even on a closed PR. Read raw on Forgejo that is not a cosmetic over-count. `requested` drives three decisions, and a permanently-true field pins a PR at state:bots-reviewing for life and stops blocker:unrequested from ever being true: the sweep believes a round is live forever and no staleness can correct it. So the requested set is intersected with who has NOT submitted a verdict for the current head, derived from /pulls/{n}/reviews — the read that is true on both forges. On GitHub the filter removes nothing, because the field is already accurate; term 5 holds by construction rather than by care. A STALE approval — an approval of an older head — still owes a verdict. That is the case that matters: treating it as answered would let a stale round read as complete, which is the shape #136 exists to prevent. Mutation-verified both ways: reading the field raw again reds three cases, and treating STALE as answered reds two. Also documents @grok-reviewer-andresmgsl's ask (#4763): every panel= account must be able to read the repo, or the forge refuses the review request — 422 naming the account on Forgejo. A real failure mode for private consumers, and it fails loudly rather than sweeping blind. Refs #188
2026-08-02 19:48:09 +00:00
- Outstanding review requests are derived from the reviews on the current head
rather than from `requested_reviewers`, which Forgejo never clears — read
raw there, a PR would sit at `state:bots-reviewing` forever (#188).
feat(forge): refuse loudly when the client cannot speak the forge The preflight half of #188, landed first so it stands alone: the forge is decided once, before any sweep, and a client that cannot speak it exits non-zero with a named reason. Measured against forgejo.heavyduty.builders at 84bb1a4 — two of the three actions reported SUCCESS having read nothing: labels-scope exit 0 "no .github/labeler.yml" (the file is HTTP 200) labels-reconcile exit 0 "reconciled." (zero PRs enumerated) issueflow-reconcile exit 1 "unexpected end of JSON input" labels-reconcile's blind-sweep warning (#96) could not fire: it counts unreadable PRs against a list `gh pr list` never produced, and a process substitution's failure does not trip set -e, so total stayed 0. Installing gh makes it worse, silencing the one loud failure. Detection is measured, not inferred from docs: a real forgejo-runner v6.3.1 job (probe task 278) shows Forgejo populating the whole GITHUB_* namespace, so GITHUB_ACTIONS proves nothing. GITHUB_API_URL's shape, GITEA_ACTIONS and GITHUB_SERVER_URL do. The same probe shows the runner image carries neither gh nor stoke, which is what makes the forgejo backend REST. Tests declare CEREMONY_FORGE at the forge boundary rather than stubbing gh and staying silent about the forge — the boundary move term 5 asks for. Refs #188
2026-08-02 18:29:08 +00:00
### Fixed
- `labels-reconcile` and `labels-scope` no longer exit 0 on a Forgejo
consumer having read zero facts — measured on `heavy-duty/rig`, where the
sweep printed `reconciled.` over an empty PR list and scope reported "no
labeler.yml" for a file that exists (#188).
Copy permalink