Starters CI does not see a MinVersion bump, and ADR-0016 does not mention the published artifact

[viniciusdc]

Follow-up to @dcmcand's review on #617 (approved, merged as 35ac7bd7). Both
points were non-gating there and belong in their own change.

1. A MinVersion bump can change published starters without CI seeing it

#617 made the generated pixi.toml derive its opentofu constraint from
pkg/tofu.MinVersion and MaxVersionExclusive. That removed the stale-literal
drift, but it created a dependency .github/workflows/starters.yml does not
watch. Its paths lists (both the pull_request and push ones) are:

starters/**
cmd/starters/**
examples/local-config.yaml
examples/aws-config.yaml
.github/workflows/starters.yml

So the PR that raises the floor changes what gets published to quay.io while
validate-starters never runs.

Adding pkg/tofu/** to both lists is only half the fix. validate-starters
checks token substitution, TOML parseability and nic validate behaviour - none
of which look at a version constraint. The only step that would catch a floor
conda-forge cannot satisfy is pixi lock, and that runs solely in
publish-starters at starters.yml:219, behind
if: startsWith(github.ref, 'refs/tags/v') at :139.

Net effect: the bump PR goes green, and the tag build fails inside the
credentialed publish job. That is still better than the silent download-fallback
#617 removed, which is why it was not gating - but the failure lands in the worst
place to debug it.

The workflow already half-acknowledges this at :68-70:

"a malformed pixi.toml would not surface until the publish job runs pixi lock"

Proposed:

• Add pkg/tofu/** to both paths lists in .github/workflows/starters.yml
• Add a pixi lock against dist/starters/aws to validate-starters, so an
  unsatisfiable constraint fails in the PR that causes it

This is also the test that earns its place for #617 in a way an assertion on the
Sprintf would not: it exercises whether the constraint is satisfiable, not
whether the string was formatted.

2. ADR-0016's maintenance policy does not mention the published artifact

docs/adr/0016-opentofu-runtime-version-policy.md is where someone raising the
floor will look. Its maintenance policy covers the MinVersion <= Version
invariant and the CI lockfile workflow's independence, but predates the starters
deriving their constraint from these constants.

Nothing in the ADR is false - this is a gap, not drift.

• Add a bullet recording that raising the floor now also changes the starter
  workspaces published to quay.io, and that pixi lock must be able to
  satisfy the new floor from conda-forge

Note on the prerelease caveat

@dcmcand confirmed the caveat #617 added to MaxVersionExclusive's doc comment
is accurate and currently unreachable: compatibleVersion("2.0.0-rc1") rejects
because it compares Core(), while conda's <2.0.0 would accept 0.14.0-style
2.0.0rc1 - but conda-forge has published 39 opentofu versions and zero
prereleases. No action; recorded so the next reader does not re-derive it.

Related

• Bump the tested OpenTofu version to what conda-forge ships #618 bump the tested OpenTofu version - the first change that would hit item 1
• Single-source the starters' toolchain pins from nic's external-binary requirements #619 single-source the starters' toolchain pins from nic's external-binary
  requirements - the general version of what fix(starters): derive the OpenTofu pin from the range nic enforces #617 fixed for one tool

[viniciusdc]

Reopening: this was closed by accident. #624 said "Closes #621 partially", GitHub read the Closes #621 keyword and closed it on merge, one second later, against that same PR body's statement that "#621 stays open for it".

Only item 1 shipped, in #624: pkg/tofu/** is now in both paths lists in starters.yml.

Still open:

• A pixi lock against dist/starters/aws in validate-starters. Deferred because nothing carries nic on a channel yet, so the step would fail every starters PR: Cannot solve the environment / No candidates were found for nebari-infrastructure-core ==0.14.0. ci(conda): publish release archives to the prefix.dev channel #616 has since merged and ci: publish starters after the package they lock against #638 makes the first publish reachable, so this becomes landable once a release has actually published.
• The ADR-0016 bullet recording that raising the floor now edits an artifact published to quay.io.

Lesson for the next PR body: "Closes #N partially" is not a thing GitHub understands. Use "Part of #N" or "Refs #N" when only some items ship.