🐛 fix(ci): run the orphaned release-verify-test gate (D-159) - #89
Merged
Conversation
`Taskfile.yml` defined `release-verify-test` — the ONLY test of `hack/release/verify-artifacts.sh` — and nothing invoked it: not `check:`, not `CHECK_STAGES`, not any workflow, not the push-only `release-exitgate`. That script is what `SECURITY.md:61` publishes to release consumers, so its test going dead is D-124's "a gate invoked by nothing is not a gate" on a path D-153/AUD2-F01 just proved rots silently. Measured before fixing: the gate was green, so this is a wiring defect only. Wired in its three OFFLINE modes, not the `all` default. `all` adds test_snapshot_pass -> `task release-snapshot`: a networked `go install goreleaser`, a `go mod tidy` before-hook that rewrites go.mod/go.sum in the middle of `task check`, `--clean` on the developer's dist/, and a five-target cross-compile. `negative` + `cosign-skip-when-absent` + `readme` are REQ-E9-S12-02/03/04, offline, well under a second. REQ-E9-S12-01 stays the L1 release-time step the spec already names — stated as a residual in D-159 and the backlog, not hidden. CHECK_STAGES 20 -> 21 in this commit (the AUD-S18/RELSE-08 lockstep), and STAGE_BODY_PINS pins the body PER MODE: a bare `bash …/verify_test.sh` pin would stay green both if two modes were dropped and if the stage were reverted to the unrunnable default. Three controls, each red for its stated reason — the `check:` line deleted (by stage NAME, not the count message), one of three modes gutted while the other two still run, and the same deletion applied to the real tree (rc=1). Also: verify_test.sh captured stdout/stderr to fixed /tmp paths and grepped them. Harmless while nothing ran it; now that concurrent lane worktrees each run `task check`, one run truncating /tmp/verify-nosig.err at open would fail another's `skip.*cosign` grep. Scratch now lives in each case's own mktemp -d, which verify-artifacts.sh cannot see — it reaches dist/ only via a `find -maxdepth 1` for `*.tar.gz`/`*.zip` and via find_sigstore_bundle's four archive-name-derived candidates.
Independent review, both P1s docs-truth: my closure was MORE complete than D-159 and the backlog row claimed, and in an append-only record that still costs. ORPH-01/02. D-159 asserted, bolded, that "REQ-E9-S12-01 ... remains covered by NO automatic gate", and the backlog row repeated it. False, and verified false at source: openspec/specs/p5-e9-distribution/spec.md:441-442 gives the requirement the Verify: string `task release-snapshot && task release-verify`; hack/release/exitgate_test.sh:33-34 runs exactly those two, in that order; .github/workflows/verify.yaml:196 runs that script as the "E9 release exit gate (RELSE-03 — REQ-E9-S13)" step. So it IS automated — push-only, under `if: github.event_name != 'pull_request'`, which is the RELSE-08 blind spot, not an absence. Both places now say that. D-159 additionally directed a future lane to "a release-workflow job" if the coverage were not good enough: that would have duplicated exitgate_test.sh:33-34. Backlog rows drive lane selection here, so a DONE row carrying a fabricated residual spends a future session building a gate that exists — the same defect class D-124, D-153 and AUD2-F01 exist to prosecute, all three of which D-159 invokes. ORPH-03. I entered the AUD2 paragraph specifically to fix a stale count and fixed only the first of two. `CHECK_STAGES stays 19 there too` was a LIVE claim; the array is 21. ORPH-04. The check: comment justified the stage's position "BEFORE docs-gates because its readme mode reads hack/release/README.md, which docs-gates does not cover" — if docs-gates does not read that file, ordering against it is not a reason. Position is in fact not load-bearing here; what is worth recording is that this stage is that file's only pin. No mechanical change: the check: wiring, CHECK_STAGES (21) and the three mutation controls are untouched. origin/main c094f15 merged down first (clean, no conflicts).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
release-verify-testwas the only test ofhack/release/verify-artifacts.sh— the verification procedureSECURITY.md:61publishes to release consumers — and was invoked by nothing (D-124). Now wired intotask checkas stage 14 of 21, in its three offline modes (REQ-E9-S12-02/03/04, sub-second). The defaultallmode was deliberately not wired: it runs a networkedgo install goreleaser, ago mod tidybefore-hook that would rewritego.mod/go.summid-gate, and--cleans the developer'sdist/. REQ-E9-S12-01 (the snapshot→verify round trip) is already automated push-only viahack/release/exitgate_test.sh— not a coverage gap, a PR-visibility one (RELSE-08). Three mutation controls prove the wiring can fail.