heavy-duty/rig
7
0
Fork 1
Code Issues 10 Pull requests Projects Releases 3 Packages Wiki Activity Actions

ceremony pin 0.3.0 → 0.6.1 — adopt the Forgejo-capable callers so the reconcilers finally run here #149

New issue
Open
opened 2026-08-17 23:20:17 +00:00 by claude-bot-andresmgsl · 0 comments
claude-bot-andresmgsl commented 2026-08-17 23:20:17 +00:00
Member
Copy link

Context

#145 established that ceremony's reconcilers were gh-only and could not run on this instance; @andres ruled for porting ceremony to Forgejo (option 1, #145 comment, 2026-08-01). That port is delivered: ceremony#188 closed, and ceremony 0.6.1 — released on this instance 2026-08-09 — ships lib/forge.sh + lib/forge-forgejo.sh, whose header names rig's own red run 979 as the motivating failure.

rig still pins 0.3.0 — the last gh-only release — in all three surfaces:

Consequence, measured today (2026-08-17): labels.yml fails on every 15-minute cron tick — runs 2461–2468 are all failure — and the board stays hand-reconciled. This is the noise #145 flagged, still running twelve days after the fix shipped upstream.

Spec

Adopt ceremony 0.6.1 per its own conversion runbook, docs/CONSUMERS.md § Convert an existing repo. Decisions made:

  • Pin 0.6.1, the newest tag on this instance. If a newer ceremony tag exists at build time, still ship 0.6.1 — a further bump is its own PR.
  • labels.yml is replaced from the 0.6.1 caller stub (§ Labels automation). Ceremony #209 split the reconcile sweep out of the event run: the caller keeps scope + trigger, and a new labels-sweep.yml caller lands beside it. Take both stubs verbatim, including the stub's default sweep cadence — the 15-minute advisory cron goes; its failure noise is what this issue exists to stop.
  • release.yml is replaced from the § Release workflow stub (triggers and permissions stay in the caller, as today), pinned 0.6.1.
  • refs-guard.yml is added from the bootstrap list, same pin — 0.6.1's body-aware guard is its own caller.
  • The six ci.yml guard refs move to @0.6.1, keeping the absolute-URL grammar #112 established (a bare uses: resolves through code.forgejo.org here).
  • .ceremony/ is re-vendored byte-identical from ceremony 0.6.1 in the same PR — docs-sync reads the pin from release.yml, so a pin bump without the mirror is a red PR by construction. This also brings the current doctrine (e.g. the post-merge issue state this board already uses) into rig's vendored role files.
  • .github/labeler.yml and .github/labels.conf stay as they are (CONSUMERS.md: the consumer keeps its path map and taxonomy).
  • One PR, with its changelog.d/<this issue>.md fragment.

Tasks

  • Replace .github/workflows/labels.yml with the 0.6.1 caller stub; add .github/workflows/labels-sweep.yml beside it
  • Add .github/workflows/refs-guard.yml at the same pin
  • Replace .github/workflows/release.yml with the 0.6.1 caller stub
  • Bump the six guard refs in .github/workflows/ci.yml to @0.6.1
  • Re-vendor .ceremony/ from ceremony 0.6.1, byte-identical
  • Reconcile CONTRIBUTING.md's workflow references with the new caller set (it names labels.yml and the guard list)
  • changelog.d/<this issue>.md

Acceptance criteria

  • Every uses: in .github/workflows/ and every ceremony action ref in ci.yml names @0.6.1; grep -rn '@0.3.0' .github/workflows/ is empty
  • docs-sync is green on the PR — the .ceremony/ mirror matches the pin the PR itself sets
  • All CI guard steps reach terminal green on the PR head
  • shellcheck step, bash test/cli.sh, bash test/release.sh pass
  • Post-merge, with its own mechanism: a scheduled or dispatched labels.yml run on main reaches success on this instance — not merely stops failing — and the dispatched sweep reconciles without error. This can only be checked after the merge, so the PR references this issue with Refs #149, never Closes, and triage owns the close after observing that run.

Test plan

  • The PR's own CI is the harness: docs-sync must go red if the .ceremony/ mirror is not re-vendored (delete one mirror file locally and the guard's check must fail — that failure is the guard proving it reads the new pin).
  • bash test/cli.sh and bash test/release.sh locally, plus the shellcheck step — same as every rig PR.
  • Must fail: any workflow ref left at 0.3.0 fails the grep criterion above; reviewers hold the line on it.
  • Post-merge: watch the first cron/dispatched labels.yml + sweep runs on the Actions tab; paste run URLs and outcomes on this issue. Success closes it; a red run reopens the investigation here, not in a new issue.

Dependencies

None blocking — ceremony 0.6.1 is released on this instance. Origin: #145 (ruling), ceremony#188 (the port), #112 (absolute uses: grammar), ceremony#209 (sweep split). Refs #145.

## Context #145 established that ceremony's reconcilers were `gh`-only and could not run on this instance; @andres ruled for porting ceremony to Forgejo (option 1, [#145 comment](https://forgejo.heavyduty.builders/heavy-duty/rig/issues/145#issuecomment-4350), 2026-08-01). That port is **delivered**: [ceremony#188](https://forgejo.heavyduty.builders/heavy-duty/ceremony/issues/188) closed, and ceremony `0.6.1` — released on this instance 2026-08-09 — ships [`lib/forge.sh` + `lib/forge-forgejo.sh`](https://forgejo.heavyduty.builders/heavy-duty/ceremony/src/tag/0.6.1/lib/forge.sh), whose header names rig's own red run 979 as the motivating failure. rig still pins `0.3.0` — the last `gh`-only release — in all three surfaces: - [`.github/workflows/labels.yml:22`](https://forgejo.heavyduty.builders/heavy-duty/rig/src/commit/cb4de44bf4c5c98f3459c2321846d434283c69d9/.github/workflows/labels.yml#L22) - [`.github/workflows/release.yml:20`](https://forgejo.heavyduty.builders/heavy-duty/rig/src/commit/cb4de44bf4c5c98f3459c2321846d434283c69d9/.github/workflows/release.yml#L20) - [`.github/workflows/ci.yml:81-98`](https://forgejo.heavyduty.builders/heavy-duty/rig/src/commit/cb4de44bf4c5c98f3459c2321846d434283c69d9/.github/workflows/ci.yml#L81-L98) — the six absolute `uses:` guard refs (#112's grammar) Consequence, measured today (2026-08-17): `labels.yml` fails on every 15-minute cron tick — runs 2461–2468 are all `failure` — and the board stays hand-reconciled. This is the noise #145 flagged, still running twelve days after the fix shipped upstream. ## Spec Adopt ceremony `0.6.1` per its own conversion runbook, [`docs/CONSUMERS.md` § Convert an existing repo](https://forgejo.heavyduty.builders/heavy-duty/ceremony/src/tag/0.6.1/docs/CONSUMERS.md). Decisions made: - **Pin `0.6.1`**, the newest tag on this instance. If a newer ceremony tag exists at build time, still ship `0.6.1` — a further bump is its own PR. - **`labels.yml` is replaced from the 0.6.1 caller stub** (§ Labels automation). Ceremony #209 split the reconcile sweep out of the event run: the caller keeps scope + trigger, and a new **`labels-sweep.yml`** caller lands beside it. Take both stubs verbatim, including the stub's default sweep cadence — the 15-minute advisory cron goes; its failure noise is what this issue exists to stop. - **`release.yml` is replaced from the § Release workflow stub** (triggers and permissions stay in the caller, as today), pinned `0.6.1`. - **`refs-guard.yml` is added** from the bootstrap list, same pin — 0.6.1's body-aware guard is its own caller. - **The six `ci.yml` guard refs move to `@0.6.1`**, keeping the absolute-URL grammar #112 established (a bare `uses:` resolves through code.forgejo.org here). - **`.ceremony/` is re-vendored byte-identical from ceremony `0.6.1`** in the same PR — `docs-sync` reads the pin from `release.yml`, so a pin bump without the mirror is a red PR by construction. This also brings the current doctrine (e.g. the `post-merge` issue state this board already uses) into rig's vendored role files. - `.github/labeler.yml` and `.github/labels.conf` stay as they are (CONSUMERS.md: the consumer keeps its path map and taxonomy). - One PR, with its `changelog.d/<this issue>.md` fragment. ## Tasks - [ ] Replace `.github/workflows/labels.yml` with the 0.6.1 caller stub; add `.github/workflows/labels-sweep.yml` beside it - [ ] Add `.github/workflows/refs-guard.yml` at the same pin - [ ] Replace `.github/workflows/release.yml` with the 0.6.1 caller stub - [ ] Bump the six guard refs in `.github/workflows/ci.yml` to `@0.6.1` - [ ] Re-vendor `.ceremony/` from ceremony `0.6.1`, byte-identical - [ ] Reconcile CONTRIBUTING.md's workflow references with the new caller set (it names `labels.yml` and the guard list) - [ ] `changelog.d/<this issue>.md` ## Acceptance criteria - [ ] Every `uses:` in `.github/workflows/` and every ceremony action ref in `ci.yml` names `@0.6.1`; `grep -rn '@0.3.0' .github/workflows/` is empty - [ ] `docs-sync` is green on the PR — the `.ceremony/` mirror matches the pin the PR itself sets - [ ] All CI guard steps reach terminal green on the PR head - [ ] `shellcheck` step, `bash test/cli.sh`, `bash test/release.sh` pass - [ ] **Post-merge, with its own mechanism:** a scheduled or dispatched `labels.yml` run on `main` reaches **success** on this instance — not merely stops failing — and the dispatched sweep reconciles without error. This can only be checked after the merge, so the PR references this issue with `Refs #149`, never `Closes`, and triage owns the close after observing that run. ## Test plan - The PR's own CI is the harness: `docs-sync` must go **red** if the `.ceremony/` mirror is not re-vendored (delete one mirror file locally and the guard's check must fail — that failure is the guard proving it reads the new pin). - `bash test/cli.sh` and `bash test/release.sh` locally, plus the shellcheck step — same as every rig PR. - Must fail: any workflow ref left at `0.3.0` fails the grep criterion above; reviewers hold the line on it. - Post-merge: watch the first cron/dispatched `labels.yml` + sweep runs on the Actions tab; paste run URLs and outcomes on this issue. Success closes it; a red run reopens the investigation here, not in a new issue. ## Dependencies None blocking — ceremony `0.6.1` is released on this instance. Origin: #145 (ruling), ceremony#188 (the port), #112 (absolute `uses:` grammar), ceremony#209 (sweep split). `Refs #145`.
claude-bot-andresmgsl added the
bug
release
scope:labels
ready
 labels 2026-08-17 23:20:17 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
build/139-sbin-path-preflight
build/144-default-labels-option-b
build/144-ubuntu-latest-tooling
build/136-cli-hermetic
build/133-status-active-is-not-health
build/129-forgejo-runner-drill-leg
build/135-runner-cache-dir
build/131-readme-forgejo-install
build/111-install-channel-forge-agnostic
build/112-ceremony-uses-absolute
build/109-forgejo-ci-box
0.3.1
0.3.0
0.2.0
0.1.0
Labels
Clear labels   
attention

A demand is parked here for the assignee: pick up the thread, ack by removing this label

  
blocked

Waiting on another PR or issue to land first

  
blocker:ci-red

A check is failing — the agent owes a fix (not a rebase)

  
blocker:conflict

Does not merge — the branch conflicts and the agent owes a rebase

  
blocker:drill-pending

Release ceremony is correct but has no drill record yet

  
blocker:unrequested

Somebody still owes a verdict and nobody was asked for one

  
bug

Something isn't working

  
claimed

A builder owns it: assignee set, draft PR expected shortly

  
documentation

Improvements or additions to documentation

  
enhancement

New feature or request

  
epic

Organizes other issues via a dependency-ordered task list — builders never pick it

  
merge-next

Head of the merge queue — merge this one next (set by hand/agent, cleared here)

  
needs-ruling

A human decision is pending — question, options and a recommendation are in the comment

  
needs-triage

Did not come through triage — owes normalization or conversion to a discussion

  
offsite

Issue deliverable is a PR in another repository — claim clock paused

  
post-merge

Refs-linked PR merged; post-merge criteria remain and triage owns completion

  
ready

Triaged, spec complete, unblocked — a builder can start now and succeed

  
release

Release flow and version/packaging work

  
scope:bootstrap

bootstrap — hardening a pristine server into a node

  
scope:coolify

coolify-* — Coolify and backup install

  
scope:db

db.sh — dump/restore

  
scope:docs

README, CONTRIBUTING, docs/ — the prose contract

  
scope:drill

drill/ and drills/ — the harness, its legs and its records

  
scope:installer

install.sh — how rig lands on a machine

  
scope:labels

the labels workflow, the reconciler, labels.conf and labeler.yml

  
scope:platform

rig platform — machine facts and identity, converged or not

  
scope:runner

runner-* — GitHub runner lifecycle

  
scope:users

users-* — class model, apply/status, close-root

  
stale

No activity for 48h — needs a poke (sweep-managed)

  
state:addressing

All bots reviewed — coding agent owes the single reply + fixes

  
state:bots-reviewing

Waiting on the bot reviewers to finish the round

  
state:building

PR is a draft — the coding agent is still building

  
state:needs-human

No blockers, all bots approve — waiting on the human reviewer

No labels
attention
blocked
blocker:ci-red
blocker:conflict
blocker:drill-pending
blocker:unrequested
bug
claimed
documentation
enhancement
epic
merge-next
needs-ruling
needs-triage
offsite
post-merge
ready
release
scope:bootstrap
scope:coolify
scope:db
scope:docs
scope:drill
scope:installer
scope:labels
scope:platform
scope:runner
scope:users
stale
state:addressing
state:bots-reviewing
state:building
state:needs-human
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: heavy-duty/rig#149
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?