ci: adopt the fleet release-PR healer - #65
Draft
forkwright wants to merge 1 commit into
Draft
Conversation
Release PRs here arrive with their required contexts absent rather than red: release-please creates them with GITHUB_TOKEN and GitHub raises no workflow-triggering events for that token, so branch protection holds a PR with a missing context forever. The healer lives in forkwright/.github; this file only asks for it. The permissions block is load-bearing rather than boilerplate: for a called workflow the caller's permissions are a CAP, never a default it may exceed, so the customary `contents: read` alone would leave the healer unable to approve a single run -- and the only symptom would be a release that stayed stuck.
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - replace Dioptron's trailer-only workflow with the first-party hybrid gate, including pull-request and push-to-main verification and the terminal `gate / gate` context - run every honest public docs-phase mechanism on untrailed changes: Python syntax, numbered-reference resolution, manifest completeness, and structural negative fixtures - keep `kanon lint --workflow`, README writing lint, and manifest-derived writing lint explicitly forge-only instead of claiming hosted GitHub ran a private binary - add the canonical Dependabot auto-merge caller and update contributor guidance to describe the hybrid contract ## Verification contract The PR itself is the first exact-head execution of the new hosted path. No local build, test, or gate command ran on Metis. The only local mechanical check was `git diff --check`. Dioptron has no Cargo workspace. The reusable's required command slots therefore carry real Python/document checks rather than vacuous `true` commands; the optional doctest slot is empty because it is structurally inapplicable. ## Collision inventory - PR #65 owns only `.github/workflows/release-pr-checks.yml`; this branch does not add or edit that file. - PR #67 changes one checkout-version comment inside the legacy gate implementation. This branch removes that checkout step with the legacy implementation, so #67's one-line path change becomes obsolete rather than being copied into dead machinery. - PRs #68 and #69 are path-disjoint. PR #69's worktree was not touched. ## Honest residual The shared Dependabot reusable currently requires Cargo security-check groups (`cargo deny`, `cargo audit`, and OSV) in addition to the terminal gate. A docs-only non-Cargo repository cannot emit those honestly. The new caller therefore fails closed for Dependabot until the reusable accepts a repository-specific verification contract; this PR does not manufacture vacuous Cargo jobs to make auto-merge appear functional. The shared hybrid workflow also installs Rust/nextest runner substrate unconditionally. That is harmless but unnecessary overhead for Dioptron's present non-Cargo phase and belongs in the reusable, not a local fork. Refs #67. Co-authored-by: forkwright <cody@forkwright.com>
forkwright
marked this pull request as draft
August 26, 2026 21:38
forkwright
added a commit
that referenced
this pull request
Aug 26, 2026
## Summary - remove the Dependabot caller that cannot function in a non-Cargo repository under the shared Cargo-only verification contract - make GitHub the authoritative repository, pull-request, review, CI, and merge surface in contributor guidance - describe `.kanon-ci.toml` as a supplementary local Kanon recipe, not a live forge pipeline or independent merge verifier ## Verification No local build, test suite, or Kanon gate ran on Metis. `git diff --check` passed on `acb496e15591e1e6899a04b8cf44e543b4268ad9`. This draft's public GitHub run is the first exact-head execution of the active verifier. ## Tracker and authority - Refs #70, whose merged caller and docs created the corrected surface. - Refs #72 for the operator-owned eventual `gate / gate` branch-protection requirement. This PR does not mutate repository authority. - Refs forkwright/.github#64 for a typed non-Cargo Dependabot verification profile. - Refs forkwright/.github#65 for a command-only hybrid-gate runner profile. ## Collision inventory - The branch is rooted at merged #70 commit `8b3fbe8b7c34355498a26f6870b6ac5235a29738` and does not reuse #70's deleted head branch. - PR #67's sole legacy-workflow comment change was re-verified as present in #70's replacement workflow, then #67 was closed with the exact supersession evidence. - Open PRs #65, #68, #69, and release PR #71 do not change these three paths. ## Honest residual `main` currently has zero required status contexts. Issue #72 deliberately sequences the operator-owned protection change after every surviving stale PR emits the genuine `gate / gate` context on its current head. Dependabot auto-merge remains absent in Dioptron until the shared reusable has a real non-Cargo contract. No vacuous Cargo jobs substitute for that missing mechanism. --------- Co-authored-by: forkwright <cody@forkwright.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Finding
Release PRs in this repo arrive with their required contexts absent rather than red.
release-pleasecreates its PR withGITHUB_TOKEN, and GitHub raises no workflow-triggeringevents for that token, so branch protection holds a PR with a missing context forever — nothing to
re-run, nothing to approve.
Evidence
Measured across the fleet 2026-08-26: four release PRs (akroasis#465, epistole#127, harmonia#733,
gnomon#68) sat 8 days at
mergeStateStatus: BLOCKEDwith an emptystatusCheckRollupwhile their workflow runs waited at
action_required.aletheia has carried the only healer for months. A file-existence check found
release-pr-checks.yml404 in all 17 other release-please repos, and nothing visible frominside any of them revealed the gap.
Why this matters
A missing check is worse than a failing one. A red check advertises itself; an absent one looks
exactly like a PR that has not finished. Releases stop, and the only symptom is a PR that appears
to be waiting on CI.
Desired correction
Adopt the reusable healer (
forkwright/.github#56). This file asks for it and declares nothingabout how it works, so it cannot drift from the other adopters.
Done when: a subsequent release PR here reaches a non-empty
statusCheckRollupwithout a humanapproving runs by hand.
The permissions block is load-bearing
Not the usual boilerplate. For
workflow_callthe caller'spermissionsis a cap — a calledworkflow can only downgrade the token, never upgrade it. A caller declaring the customary
contents: readalone would leave the healer unable to approve a single run, and the only symptomwould be a release that stayed stuck.
Proven, not assumed
The whole path was exercised on akroasis before this rollout:
Actions: writeconfirmed present in the reusable's job token, so the caller's grant does reachit (run 32982564877).
GITHUB_REPOSITORYresolves to the caller — the healer reported#465 at b75af1a6f,akroasis's own release PR, while running from
forkwright/.github.workflow_runtrigger fired automatically on release-please completion and superseded amanual dispatch via
cancel-in-progress, exactly as designed.GITHUB_TOKEN+actions: writeapproving a genuinely held run:201, and the run movedaction_required→in_progress(probed on zetesis run 31286567826). No PAT and no reposecret are required — an assertion to the contrary lived unexamined in aletheia's copy for
months and is false.