forked from heavy-duty/ceremony
cluade-reviewer-andresmgsl
957f72739d
The 0.4.1 drill measured both doors dead on Forgejo. lib/facts.sh gathered
`released` with `gh release view` and `labeled` with `gh api .../pulls`, and
release.yml tagged and published with `gh` — none of which exist on the
runner image. The merge door therefore read labeled=no for a correctly
labeled, correctly merged ceremony PR and refused it as "a bare push";
the tag door cleared every gate and died at `gh release create`.
Both are ported onto lib/forge.sh. Two asymmetries were measured against
the live instance and its swagger rather than assumed:
* GitHub serves an ARRAY of PRs at /commits/{sha}/pulls; Forgejo serves a
single OBJECT at /commits/{sha}/pull and 404s on the plural. Both verbs
emit the array shape, so facts.sh carries one jq expression.
* GitHub creates a tag by POSTing to /git/refs; Forgejo serves that path
GET-only and creates tags at /tags. A 1:1 port of the gh call would
have 404'd forever.
The behaviour change is the second half of the bug. Any failure used to
become a definite `no`, which is safe for row 4 and catastrophic for row 5:
it is how a missing binary became "this was not a release ceremony". Now a
completed read that finds nothing is still `no` and still fail-closed, and a
read that did not complete refuses and emits no fact at all.
Four new cases in test/facts.test.sh cover exactly that, and a mutation back
to the old fail-closed-on-error behaviour kills all four and nothing else.
1014 assertions, 22 suites, shellcheck and actionlint clean.
Refs #191
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
144 lines
6.2 KiB
Bash
144 lines
6.2 KiB
Bash
#!/usr/bin/env bash
|
||
# lib/facts.sh — the merge door's fact gathering (issue #9).
|
||
#
|
||
# lib/decide.sh (issue #8) is pure: it consumes four facts and renders the
|
||
# 5-state verdict. This script is the impure half that establishes those
|
||
# facts. It runs inside the consumer's checkout (the working directory),
|
||
# talks to git and the forge shim, and prints the facts in $GITHUB_OUTPUT form:
|
||
#
|
||
# ver=… base_ver=… released=(yes|no|empty) labeled=(yes|no|empty)
|
||
#
|
||
# stdout carries exclusively those lines — the release workflow appends the
|
||
# whole stream to $GITHUB_OUTPUT — so every diagnostic goes to stderr.
|
||
#
|
||
# Env in:
|
||
# VERSION_SOURCE file | package-json (the workflow's one input)
|
||
# MERGE_SHA the pushed head (github.sha)
|
||
# EVENT_BEFORE github.event.before — may be empty or all-zeros
|
||
# GITHUB_REPOSITORY for the two API facts
|
||
# GH_TOKEN for the forge client (unused when no API state is
|
||
# consulted)
|
||
#
|
||
# The API calls run only in the states that consult them (decide tolerates
|
||
# empty facts — issue #8): RELEASED only for a bare unchanged version,
|
||
# LABELED only for a bare transition. A -dev tree — every ordinary merge —
|
||
# decides on the two versions alone and never touches the API.
|
||
set -euo pipefail
|
||
|
||
_facts_lib="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||
# shellcheck source=lib/version.sh
|
||
. "$_facts_lib/version.sh"
|
||
# shellcheck source=lib/forge.sh
|
||
. "$_facts_lib/forge.sh"
|
||
|
||
: "${VERSION_SOURCE:?facts: VERSION_SOURCE is required}"
|
||
: "${MERGE_SHA:?facts: MERGE_SHA is required}"
|
||
|
||
case "$VERSION_SOURCE" in
|
||
file) src=VERSION ;;
|
||
package-json) src=package.json ;;
|
||
*)
|
||
echo "facts: unknown VERSION_SOURCE '$VERSION_SOURCE' — expected file or package-json" >&2
|
||
exit 1
|
||
;;
|
||
esac
|
||
|
||
ver="$(version_read "$VERSION_SOURCE")"
|
||
|
||
# event.before is all-zeros on a branch-create push, and absent outside push
|
||
# events; the pushed head's first parent is main the instant before, either
|
||
# way (#1 constraint 10; cast's `*[!0]*` test — "contains a non-zero char").
|
||
# One branch-create has no instant before: the repository's FIRST push to
|
||
# main, whose head is a root commit — both 0.2.0 drills died here at exit
|
||
# 128, the first release-flow event either scratch consumer ever saw (#134).
|
||
# The parent count is read as a fact (`rev-list --parents` prints the head
|
||
# alone for a root commit) rather than inferred from a failed rev-parse, so
|
||
# an unresolvable MERGE_SHA still dies loudly instead of masquerading as
|
||
# "(none)".
|
||
base_sha="${EVENT_BEFORE:-}"
|
||
case "$base_sha" in
|
||
*[!0]*) ;;
|
||
*)
|
||
parents="$(git rev-list --parents -n 1 "$MERGE_SHA")"
|
||
case "$parents" in
|
||
*" "*) base_sha="$(git rev-parse "$MERGE_SHA^1")" ;;
|
||
*) base_sha="" ;; # a root commit: no base tree exists at all
|
||
esac
|
||
;;
|
||
esac
|
||
|
||
# Belt-and-braces (cast's precedent): the workflow's fetch-depth: 2 resolves
|
||
# the first parent, but event.before can predate it when pushes raced. If
|
||
# the fetch still cannot produce it, the git show below is the loud failure.
|
||
# Skipped entirely when there is no base: with an empty rev the fetch is
|
||
# meaningless and `git show ":$src"` would read the INDEX — reporting the
|
||
# head's own version as the base, a wrong fact worse than any crash (#134).
|
||
if [ -n "$base_sha" ]; then
|
||
git cat-file -e "$base_sha" 2>/dev/null \
|
||
|| git fetch --depth=1 origin "$base_sha" >&2 \
|
||
|| true
|
||
fi
|
||
|
||
base_dir="$(mktemp -d)"
|
||
trap 'rm -rf "$base_dir"' EXIT
|
||
|
||
if [ -n "$base_sha" ] && git show "$base_sha:$src" >"$base_dir/$src" 2>/dev/null; then
|
||
base_ver="$(version_read "$VERSION_SOURCE" "$base_dir")"
|
||
else
|
||
# No base tree (a root commit — the repository's first push, the 0.2.0
|
||
# drills' wall, #134), or a base tree with no version source in it: the
|
||
# merge that ADDS the version machinery (a consumer's adoption PR, a
|
||
# greenfield repo's first caller). "(none)" is not a version, so decide
|
||
# sees a changed version and the table still governs: a -dev head is work
|
||
# (row 2, the guided bootstrap path), a bare head still demands the
|
||
# merged release label (rows 5–6). Nothing releases silently either way.
|
||
base_ver="(none)"
|
||
fi
|
||
|
||
released=""
|
||
labeled=""
|
||
if ! version_is_dev "$ver"; then
|
||
# The forge is selected only in the states that consult the API — a -dev
|
||
# tree, every ordinary merge, still decides on the two versions alone and
|
||
# touches no forge at all (#8's tolerance for empty facts).
|
||
# "" means decide from the environment; forge_select takes an explicit
|
||
# forge only in tests.
|
||
forge_select "" || exit 1
|
||
|
||
if [ "$base_ver" = "$ver" ]; then
|
||
# Row 4's input. Before #191 any failure here read as "not released",
|
||
# which is safe only because row 4 refuses either way. It is still a
|
||
# lie about what was observed, so an unreadable answer refuses.
|
||
if ! released="$(forge_release_exists "$ver")"; then
|
||
echo "facts: could not read whether '$ver' is already released — refusing rather than reporting 'no' (#191)" >&2
|
||
exit 1
|
||
fi
|
||
else
|
||
# Row 5's input, and the one that cost a release: a push event carries
|
||
# no PR payload, so the label is read from the API. The old code turned
|
||
# ANY failure into labeled=no, and on a Forgejo runner — no `gh` — that
|
||
# demoted a correctly labeled, correctly merged ceremony PR into "a bare
|
||
# push", refusing the release and creating nothing. Measured in the
|
||
# 0.4.1 drill, twice (drills/0.4.1.md).
|
||
#
|
||
# Now: a completed read that finds no merged release-labeled PR is still
|
||
# `no` and still fail-closed. A read that did not complete refuses.
|
||
if ! pulls="$(forge_commit_pulls "$MERGE_SHA")"; then
|
||
echo "facts: could not read the pull requests behind '$MERGE_SHA' — refusing rather than reporting 'no label' (#191)" >&2
|
||
exit 1
|
||
fi
|
||
# One jq expression for both forges: the backends agree on the shape.
|
||
if printf '%s' "$pulls" \
|
||
| jq -e '[.[] | select(.merged_at != null) | .labels[].name] | index("release") != null' >/dev/null 2>&1; then
|
||
labeled=yes
|
||
else
|
||
labeled=no
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
echo "facts: ver='$ver' base_ver='$base_ver' released='$released' labeled='$labeled'" >&2
|
||
printf 'ver=%s\n' "$ver"
|
||
printf 'base_ver=%s\n' "$base_ver"
|
||
printf 'released=%s\n' "$released"
|
||
printf 'labeled=%s\n' "$labeled"
|