ceremony/actions
cluade-reviewer-andresmgsl 0f20f4b6ef
All checks were successful
CI / test (pull_request) Successful in 1m35s
CI / release-exercise (pull_request) Successful in 11s
CI / self-guards (pull_request) Successful in 7s
CI / action-exercise (pull_request) Successful in 5s
CI / docs-sync-exercise (pull_request) Successful in 6s
labels / labels (pull_request) Successful in 54s
fix(labels): a label removal that cannot happen fails the sweep, and removal itself now works (#192)
Two defects, one cause, and the second is why the first survived a week.

THE WRITE. Removal was a per-label `DELETE .../labels/{id}` loop. On this
instance that call returns HTTP 500 for every removal under the token the
sweep actually holds — measured inside Actions, probe run 701, where the same
`PUT .../labels` with the desired full set returns 200 including the empty set
for a full clear. A PAT gets 204 on the same DELETE, which is exactly why it
went unseen: it fails only for `${{ github.token }}`.

Net effect before this: on Forgejo the state machine could only ever ADD
labels. Every `state:*` transition needing the previous state cleared and every
`blocker:*` that should lift was inert. Both PRs open right now carry stale
`blocker:*` labels that are false and that nothing can remove.

So the removal path is read-current, compute-wanted, one PUT — the same shape
the assignee branch beside it already used. An ADD-ONLY call keeps its additive
POST: ceremony#128 lost a `release` label to a read-modify-write that clobbered
a concurrent set, and forge_labels_add stays pinned against ever doing that.
The window is accepted here and only here, where the caller asked to REMOVE
and no additive verb can say that. An unresolvable --add-label refuses before
any write, so a replacement PUT can never drop a label nobody asked to remove.

THE REPORTING. `labels-reconcile` logged `WARNING: label edit failed`, fell
through, and `main` printed `reconciled.` and exited 0 — while
`issueflow-reconcile` treated the identical 500 as fatal. One cause, two
contradictory policies, and the wrong one hid the write defect.

A failed write is fatal now, and the tally reaches main's exit code. That
second half is load-bearing: making reconcile_pr fatal alone is not enough,
because the loop swallows a per-PR non-zero into a log line and finishes. The
per-PR tolerance is right and stays — one bad PR must not blind the board — but
it now applies to READS. A sweep that could not write exits non-zero and never
prints `reconciled.`

The diagnostic says what was attempted and that it did not happen. The old text
blamed a missing label and told the operator to bootstrap, when the label was
present and the call returned 500 — #101's rule is report, do not diagnose.

Mutation-tested, all three ways: restoring the warn-and-continue reds 5 cases,
removing the tally reds 2, restoring the DELETE loop reds 7.

test/run.sh 22 files 0 failed under jq 1.7 and jq 1.6; shellcheck 0.10.0 and
actionlint clean.

Refs #192
2026-08-05 12:48:09 +00:00
..
changelog-armed feat: enforce changelog shape in guard and assembler 2026-07-24 16:14:35 +00:00
changelog-assembled feat: changelog-assembled — the release section must be exactly the fragments it consumed 2026-07-24 09:29:07 +00:00
changelog-monotonic feat: actions/changelog-monotonic — shipped headings are append-only 2026-07-22 21:09:59 +00:00
docs-sync fix: refuse non-regular nodes everywhere; machine-verify the mirror README 2026-07-22 21:59:37 +00:00
drill-recorded feat: actions/drill-recorded — a release carries its evidence 2026-07-22 21:28:06 +00:00
issueflow-reconcile fix(issueflow): the issue/PR discriminator is GitHub-only 2026-08-02 20:44:58 +00:00
labels-reconcile fix(labels): a label removal that cannot happen fails the sweep, and removal itself now works (#192) 2026-08-05 12:48:09 +00:00
labels-scope fix(labels-scope): jq 1.6 cannot parse $label — the runner image ships 1.6 2026-08-02 20:34:02 +00:00
runner-isolated feat(guards): actions/runner-isolated — the scan, the two-condition rule, the exit codes (#58) 2026-07-23 12:03:55 +00:00
.gitkeep ci: scaffold test and lint workspace 2026-07-22 16:56:25 +00:00