test: drive the retired-default label recogniser (#144)

Extract labels_are_a_retired_default and assert the four cases a grep pin
cannot: pre-#144 matches, current default does not, custom --labels does
not, near-miss does not. Addresses the remaining REQUEST_CHANGES on !146.

Refs #144

commands/forgejo-runner-install.sh

@@ -43,6 +43,21 @@ die()  { printf 'rig-forgejo-runner: ERROR: %s\n' "$1" >&2; exit "${2:-1}"; }
 # inert until matched, so boxes that never ask pay nothing.
 DEFAULT_LABELS='ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-latest-full:docker://ghcr.io/catthehacker/ubuntu:full-22.04,docker:docker://node:22-bookworm'
 
+# labels_are_a_retired_default <recorded>
+#
+# True when <recorded> is a past DEFAULT_LABELS value rig has shipped — the
+# only plain-converge case that should warn about re-registration (#144).
+# Custom operator maps (drill's Leg 3, any --labels) must return false so a
+# bare re-run stays quiet. One pattern per past default; add when the string
+# changes. Extracted and driven by test/cli.sh — a grep pin alone cannot prove
+# the match is exact.
+labels_are_a_retired_default() {
+  case "${1:-}" in
+    'ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,docker:docker://node:22-bookworm') return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
 # fetch_and_verify_sha256 <asset-url> <file> <sumfile> <label>
 #
 # The whole checksum POLICY, in one place: fetch the published .sha256 beside
@@ -441,13 +456,8 @@ if [ -e "$RUNNER_DIR/.runner" ]; then
     RECORDED="$(cat "$RUNNER_DIR/.rig-labels")"
     if [ "$LABELS_EXPLICIT" -eq 1 ] && [ "$RECORDED" != "$LABELS" ]; then
       warn "--labels was not applied: this runner is already registered, and Forgejo owns its labels from registration time. It still has: ${RECORDED}. Labels are what 'runs-on' matches, so changing them means re-registering: 'rig forgejo-runner remove' then install again with the labels you want."
-    elif [ "$LABELS_EXPLICIT" -eq 0 ]; then
+    elif [ "$LABELS_EXPLICIT" -eq 0 ] && labels_are_a_retired_default "$RECORDED"; then
-      # One pattern per past DEFAULT_LABELS value. Add a pattern when the
+      warn "this runner was registered with an older rig default label set. The current default adds ubuntu-latest-full (the GitHub-parity image). Labels are fixed at registration, so picking it up means re-registering: 'rig forgejo-runner remove' then install again. Nothing you run today is affected — re-register only if you want the new label."
-      # default string changes so plain converges of older installs notice.
-      case "$RECORDED" in
-        'ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,docker:docker://node:22-bookworm')
-          warn "this runner was registered with an older rig default label set. The current default adds ubuntu-latest-full (the GitHub-parity image). Labels are fixed at registration, so picking it up means re-registering: 'rig forgejo-runner remove' then install again. Nothing you run today is affected — re-register only if you want the new label." ;;
-      esac
     fi
   fi
 else

test/cli.sh

@@ -3716,14 +3716,29 @@ check "forgejo-runner: that warning is gated on --labels being EXPLICIT" 0 "LABE
   grep -o "LABELS_EXPLICIT" "$FR"
 # #144 option B: plain converge warns only for known *retired* defaults — not
 # for every RECORDED != current default (that would noise custom --labels
-# forever, including drill's Leg 3). Pins match the case arm + message.
+# forever, including drill's Leg 3). Drive the recogniser against fixtures
+# (test/drill.sh extraction pattern) so a dead matcher cannot greppen green.
 check "forgejo-runner: plain converge warns on a known retired default label set" 0 "registered with an older rig default label set" \
   grep -o "registered with an older rig default label set" "$FR"
 check "forgejo-runner: that warn says re-register only if you want the new label" 0 "re-register only if you want the new label" \
   grep -o "re-register only if you want the new label" "$FR"
-check "forgejo-runner: the pre-#144 default string is the retired-default case arm" 0 \
+PRE_144_LABELS='ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,docker:docker://node:22-bookworm'
-  "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,docker:docker://node:22-bookworm" \
+CURRENT_LABELS="$(sed -n "s/^DEFAULT_LABELS='\\(.*\\)'$/\\1/p" "$FR")"
-  grep -F "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04,docker:docker://node:22-bookworm" "$FR"
+RETIRED_FNS="$(mktemp)"
+awk '/^labels_are_a_retired_default\(\) \{/,/^\}/' "$FR" > "$RETIRED_FNS"
+check "extraction guards the awk: labels_are_a_retired_default() landed" 0 "labels_are_a_retired_default() {" \
+  grep -F 'labels_are_a_retired_default() {' "$RETIRED_FNS"
+# shellcheck source=/dev/null
+. "$RETIRED_FNS"
+check "retired-default: the pre-#144 default is recognised" 0 "" \
+  labels_are_a_retired_default "$PRE_144_LABELS"
+check "retired-default: the CURRENT default is not drift" 1 "" \
+  labels_are_a_retired_default "$CURRENT_LABELS"
+check "retired-default: an operator's own --labels map is never drift" 1 "" \
+  labels_are_a_retired_default 'drill:docker://node:22-bookworm'
+check "retired-default: a near-miss of a past default is not a match" 1 "" \
+  labels_are_a_retired_default "${PRE_144_LABELS} "
+rm -f "$RETIRED_FNS"
 # Default map: slim ubuntu-latest (act), opt-in full, docker — pin the three
 # so a silent drop of the full rider or a flip back to full-as-default fails.
 check "forgejo-runner: DEFAULT_LABELS maps ubuntu-latest to act-22.04 (slim)" 0 "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04" \