fix(release): the installer stops deleting installs it did not create, and the gates stop trusting their own premises - #596
Merged
Conversation
…, and the gates stop trusting their own premises Closes #529 #530 #531 #532 #552 #554 #555 #556 #558 #559 #560 #583 #584 #585 #586 #587 #588, and the second half of #553. THE ONE THAT DESTROYED DATA. A failed re-run of install.sh over a healthy docker install ran `compose down` and `rm -rf $INSTALL_DIR`, taking docker-compose.yml, uninstall.sh and every backup-*.tar.gz update.sh had written there -- announced as `[info] removed /opt/polyemesis`, the quietest possible line for the most damaging action in the file. `mkdir -p` succeeds on a directory that already exists, so DIRS_CREATED=true recorded "I made this" for one it had merely opened. The fix already existed in the same file: the CONFIG_DIR path guards with `[ -d ... ] ||` and carries a comment explaining this exact failure. It had been applied to one of the paths. Now every mkdir site is guarded, the rm -rf is gated on it, and the else branch SAYS it left the directory alone rather than staying silent. Sweeping for the same shape found it a third time, unreported: rollback deleted the binary and systemd unit of a working install it had only replaced. THE GATE THAT TRUSTED ITS OWN PREMISE. changelog-gate exits 0 on any non-tag ref, and its comment explains why that is safe: "Nothing here would be published either way". That premise is false -- workflow_dispatch takes a dry_run boolean, and with it false the images job overwrites :latest, :cuda and :vaapi on Docker Hub and GHCR, which install.sh pins every docker operator to. The gate now refuses when PUBLISH is true and the ref is not a tag. Control, not warning. And the date it checks is now compared to today rather than merely being present, so a heading dated last week cannot publish. NOT REAL -- #553. Get-PublishingFfmpeg already returns an explicit object on main. The reviewer read the function's comment block, which NARRATES two historical pipeline failures, as a description of current behaviour -- and a stale KNOWN GAP warning in ci.yml agreed with them. That warning is now a real assertion, so the next reader is told the truth by a test rather than by prose. The issue's other half was real: ending a broadcast and skipping the confirmation were the same keystroke. One of the new tests initially passed under its own mutation: it asserted a non-zero exit that install.sh's non-root check produced anyway. It now asserts the message. New: scripts/test-release-gates.sh, 29 cases, reading the step bodies out of release.yml so the gates are tested rather than described. acceptance-install 63 -> 89. Claude-Session: https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #529 #530 #531 #532 #552 #554 #555 #556 #558 #559 #560 #583 #584 #585 #586 #587 #588, and the second half of #553.
The one that destroyed data — #532
A failed re-run of
install.shover a healthy docker install rancompose downandrm -rf $INSTALL_DIR, takingdocker-compose.yml,uninstall.sh, and everybackup-*.tar.gz— announced as[info] removed /opt/polyemesis, the quietest possible line for the most damaging action in the file.mkdir -psucceeds on a directory that already exists, soDIRS_CREATED=truerecorded "I made this" for one it had merely opened.The fix already existed in the same file. The
CONFIG_DIRpath guards with[ -d ... ] ||and carries a comment explaining this exact failure — it had simply been applied to one path and not the other. Everymkdirsite is now guarded, therm -rfis gated on it, and the else branch says it left the directory alone rather than staying silent.Sweeping for the same shape found it a third time, unreported: rollback deleted the binary and systemd unit of a working install it had only replaced.
The gate that trusted its own premise — #529
changelog-gateexits 0 on any non-tag ref, and its comment explains why that's safe: "Nothing here would be published either way." That premise is false.workflow_dispatchtakes adry_runboolean; with it false,imagesoverwrites:latest,:cudaand:vaapion Docker Hub and GHCR — whichinstall.shpins every docker operator to.The gate now refuses when
PUBLISH=trueand the ref is not a tag. Control, not warning. And #530: the date is compared to today rather than merely being present, so a heading dated last week cannot publish.Not real — #553
Get-PublishingFfmpegalready returns an explicit object on main. The reviewer read the function's comment block — which narrates two historical pipeline failures — as current behaviour, and a staleKNOWN GAPwarning inci.ymlagreed with them. That warning is now a real assertion, so the next reader is told the truth by a test rather than by prose. The issue's other half was real and is fixed: ending a broadcast and skipping the confirmation were the same keystroke.Honesty note
One new test initially passed under its own mutation — it asserted a non-zero exit that
install.sh's non-root check produced anyway. It now asserts the message.Verification
scripts/test-release-gates.sh— 29 new cases, reading the step bodies out ofrelease.ymlso the gates are tested rather than described.acceptance-install.sh63 → 89 passed. All workflow YAML parses;install.shparses.Out of assignment: #580, #581, #582 (
internal/db/**) and #584's docs half. #582 is worth doing while v0.6.0 is still the previous release.https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL