From ee6cb9e62a81285943d87d080b13179ec1586860 Mon Sep 17 00:00:00 2001 From: Joakim Persson Date: Mon, 21 Sep 2026 23:23:29 +0200 Subject: [PATCH] ci(release): a tag must not publish a component no CHANGELOG entry names lint-gate already existed to enforce "do not RELEASE a tree whose lint failed", because lint.yml does not run on tag pushes. scripts/check-doc-drift.sh had the same gap and it was never extended to cover it: check 9 ran only in lint.yml, so no tag build has ever evaluated it. Add it to lint-gate, which resolve-versions already needs, so it fails in ~8 s ahead of the 46-minute base build. For this check the gap is strictly worse than it is for shellcheck. Shellcheck judges the tree, so green on main is still green at the tag -- the bytes did not move. Check 9 judges the tree against upstream NOW, and the floating refs it watches move with no commit here at all, so a green reading on main carries no information about tag time. v1.9.3 is the worked example: pi-observational-memory moved cba0334 -> e7d77dc the day AFTER the tag, nothing went red, and it surfaced only because someone ran the gate by hand. Measured, not assumed: - Same file lint.yml calls (one reference in each workflow), not a second copy. - Works on a CI-shaped checkout: cloned --depth 1 --no-tags (0 tags, 1 commit), rc=0. It needs no local tags because `last` comes from the Hub tags API, not `git tag`, so the plain actions/checkout@v4 above is sufficient. - Has teeth: deleting the Unreleased section from that clone gives rc=1 and names the component; restoring it gives rc=0. - ~8 s (7.8-8.3 s measured), vs ~1 s for lint-shell.sh. Residual, accepted: the gate resolves the refs seconds before resolve-versions resolves them again, so an upstream push inside that window still slips past. Check 9 on the next release names it then. --- .gitea/workflows/docker-publish.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.gitea/workflows/docker-publish.yml b/.gitea/workflows/docker-publish.yml index 02101ab..9a96d6a 100644 --- a/.gitea/workflows/docker-publish.yml +++ b/.gitea/workflows/docker-publish.yml @@ -174,6 +174,29 @@ jobs: # # ~40 s, ahead of everything expensive, and it runs scripts/lint-shell.sh -- # the same file lint.yml calls, not a second copy that drifts. + # + # scripts/check-doc-drift.sh is here for the same reason and closes the same + # gap -- and for it the gap is strictly worse. Shellcheck judges the TREE: + # green on main is still green at the tag, because the bytes did not move. + # Check 9 judges the tree against UPSTREAM NOW, and the floating refs it + # watches (PI_OBSMEM_REF=master and friends, which resolve-versions below turns + # into SHAs) move with no commit in this repo at all -- so a green reading on + # main carries no information about tag time, and that window is exactly where + # releases live. Worked example: pi-observational-memory moved cba0334 -> + # e7d77dc the day AFTER v1.9.3 was tagged. Nothing went red; it surfaced only + # because someone ran the gate by hand. Without this step a tag can publish a + # component that no CHANGELOG entry names, and the floating ref means no other + # file in the repo would record it either. + # + # Adds ~8 s. No token and no built image: it takes the last published vX.Y.Z + # from the Hub tags API, that release's baked labels from the anonymous + # registry API, and `git ls-remote`s each upstream -- so a plain checkout is + # enough, with no tags or history to fetch. Offline it SKIPs loudly and + # counted rather than passing, so an outage degrades it to a visible skip + # instead of a false green. Residual, accepted: it resolves the refs seconds + # before resolve-versions resolves them again, so an upstream push landing + # inside that window still slips through -- and check 9 on the NEXT release + # would then name it. lint-gate: runs-on: ubuntu-latest container: @@ -189,6 +212,9 @@ jobs: - name: "Shellcheck + syntax-check repository scripts (severity: error)" run: bash scripts/lint-shell.sh + - name: Components the next build would bake differently are named in the CHANGELOG + run: bash scripts/check-doc-drift.sh + resolve-versions: # Gated: a defective tree must not reach a 46-minute base build. needs: [lint-gate]