fix(release): bump BOTH gated skill manifests; give every full-suite job the differential baseline - #238
Merged
Conversation
…ite job the differential baseline Two separate things blocking #237, both larger than they first looked. 1. THE VERSION GATE NAMED ONE FILE BECAUSE IT EXITS AT THE FIRST. validate-versions loops over TWO manifests and `exit 1`s on the first mismatch, so it reported only node/resources/rafter-security-skill.md. python/rafter_cli/resources/rafter-security-skill.md was equally stale at 0.10.0 and would have failed the very next run. Both bumped to 0.10.1; gate simulated over both files, OK on each. Four more manifests carry a version and are NOT in the loop (rafter/SKILL.md and rafter-code-review at 0.7.0, rafter-secure-design and rafter-skill-review at 0.1.0, each duplicated node/python). Left alone deliberately — they are not release-versioned — but a gate that checks two of six is a gate with a blind spot, and prod history already contains "fix(release): bump ClawHub skill resource versions to 0.8.9". Recurrence is the finding; bead to follow. 2. FIVE OTHER CHECKS WERE FAILING, ALL OF THEM MINE. test-build and all four cross-platform legs failed on tests/rf6pqx-differential.test.ts: Command failed: git show origin/main:node/src/core/risk-rules.ts fatal: invalid object name 'origin/main'. The differential FAILS rather than skips when the baseline is missing, which is right — but that makes the baseline a precondition of every job that runs the suite, and I had added the fetch to exactly the two jobs whose failure I happened to be looking at. So I swept all four workflows for jobs running a FULL suite instead of patching the instances again: test-comprehensive test-node already had it test-comprehensive test-python already had it test-comprehensive cross-platform ADDED validate-release test-build ADDED publish test-node ADDED publish test-python ADDED The last two are the ones that matter most: publish.yaml runs the full node and python suites, and publish-node/publish-python are gated on them. Without this the release would have passed every check on #237 and then FAILED AT THE MOMENT ROME MERGED — the worst place to find it. e2e-node, secret-detection-accuracy and backend-api run single targeted files, so they never collect the differential and need nothing. Checked rather than assumed. Local: the differential and battery suites pass in both runtimes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Unblocks #237. Larger than the one-line bump it looked like — please read the second half before merging.
1. The version gate named one file because it exits at the first
validate-versionsloops over two manifests andexit 1s on the first mismatch, so it only reported the node one.python/rafter_cli/resources/rafter-security-skill.mdwas equally stale at0.10.0and would have failed the very next run. Both are now0.10.1; I simulated the gate over both files.Four other manifests carry a
version:and are not in the loop —rafter/SKILL.mdandrafter-code-reviewat 0.7.0,rafter-secure-designandrafter-skill-reviewat 0.1.0, each duplicated node/python. Left alone deliberately (they aren't release-versioned), but noted: prod history already containsfix(release): bump ClawHub skill resource versions to 0.8.9, so this desync recurs. Bead to follow.2. Five other checks were failing, all of them mine
test-buildand all fourcross-platformlegs failed ontests/rf6pqx-differential.test.ts:The differential fails rather than skips when the baseline is missing, which is correct — but that makes the baseline a precondition of every job running the suite, and I'd added the fetch to only the two jobs whose failure I happened to be looking at.
So I swept all four workflows rather than patching instances again:
The last two are why this matters.
publish.yamlruns the full node and python suites, andpublish-node/publish-pythonare gated on them — so without this, the release would have passed every check on #237 and then failed at the moment Rome merged it.e2e-node,secret-detection-accuracyandbackend-apirun single targeted files, never collect the differential, and need nothing. Checked rather than assumed.Verification
Gate simulated over both manifests; differential and battery suites pass in both runtimes locally; full-suite sweep re-run and clean.