Bump swarf in dev to sha256:8599e69 - #41
Merged
Merged
Conversation
bajtos
added a commit
that referenced
this pull request
Aug 24, 2026
* Space the image pins apart so bumps stop conflicting Each bump rewrites one line of image_digests, and git conflicts on changes to adjacent lines. With six pins on six consecutive lines, any two bump pull requests open at once left the second one unmergeable: #41 bumps swarf and cannot merge because #42 took the delegator line directly below it. A blank line between pins is enough. Measured on that exact pair, the current layout conflicts and the spaced one merges clean. `tofu fmt` aligns runs of consecutive lines, so the blank lines also drop the padding around each `=`. That is the formatted shape now. Assisted-by: Claude:claude-opus-5 * Move the dev pin rewrite into a script The refresh workflow added next needs the same edit the bump workflow makes, and a person unsticking a deploy by hand needs it too. Three copies of one sed pattern would drift, so it moves to scripts/set-dev-pin.sh alongside the other operator scripts. The script keeps every check the workflow step made: it re-reads the file rather than trusting sed, and refuses an edit that touched more than one line. It adds the service-key and digest-shape checks the workflow does before the checkout, so a local run gets them too. The workflow keeps its own copies, which guard untrusted client_payload before any value reaches an output or a commit message. stdout carries `changed=true|false` and nothing else, so the workflow appends it straight to $GITHUB_OUTPUT. Assisted-by: Claude:claude-opus-5 * Rebuild open bump pull requests when main moves The ruleset requires a branch to be up to date before it merges, so one bump landing leaves every other open bump behind main. Nothing moved them: bump-deployed-image.yml rebuilds a branch only when that service publishes again, so a deploy could sit waiting for an unrelated one. Rebuilding is safe because of what a bump pull request is. It asks for one thing, that dev run one digest, and its branch is main plus that one line, so it can be regenerated from current main rather than merged. Reusing the original commit message keeps the link to the pull request that published the image, which re-running the bump would lose. Three paths besides the rebuild: a branch already on current main is left alone, a branch whose digest main already pins is closed, and a push that loses its lease is left to the newer publish that took it. Assisted-by: Claude:claude-opus-5 * Document how bump pull requests stay mergeable Records the two mechanisms a reader cannot infer from the workflows: the blank lines between the pins, and refresh-bump-prs.yml rebuilding open bump branches when main moves. Adds scripts/set-dev-pin.sh to the layout listing and to the deploy section, next to the manual dispatch. Retires "Deploy the remaining services from their own repositories" from Planned work: all six now dispatch their own bumps, the last of them in #39 through #43. What that section documented about the receiver's payload is reference material, so it moves to the deploy section. Assisted-by: Claude:claude-opus-5 * fix: narrow and harden the refresh Four holes in the first version, from review: Refreshing only pull requests the app opened from this repository. A fork can name its branch bot/bump-<service>-image-dev, and matching on the name alone would pick one up, whose head is no ref here and whose rev-parse would abort every remaining refresh. Fetching the bump branches after listing them, so one pushed while the job was starting is present when the loop reaches it, and skipping a branch that still is not. Retrying once after a lost lease. A publish that replaced the branch built on the main this run is refreshing past, so what it left needs the same rebuild, and nothing else would do it until the next push to main. Leaving a branch alone when main moved that service to some other digest meanwhile. Rebuilding would answer which digest dev should run by rolling main back to the branch, and the auto-merge would deploy it. Assisted-by: Claude:claude-opus-5 * fix: close with a lease and refresh on bump pushes Closing a superseded bump deleted its branch with no check that the branch still is what this run read. A publish force-pushing a newer digest in that window lost the branch, and with it the pull request the new image needed. The deletion now carries the same lease as the rebuild push, and a lost lease falls into the existing re-read and retry. A bump push itself could also go stale: the commit is built from the main its run checked out, and when main moves between that checkout and the push, nothing rebuilt the branch until the next push to main. Bump-branch pushes now trigger the refresh too. The run a rebuild push starts finds every branch current and stops, so the trigger converges. A first publish can still slip through when the triggered run lists pull requests before the bump run opens one; that branch waits for the next push to main, as before. Assisted-by: Claude:claude-fable-5 Signed-off-by: Miroslav Bajtoš <oss@bajtos.net> * fix: fail the refresh when listing fails `gh pr list ... | grep ... || true` reads an API outage, an expired app token, or a missing permission as an empty list, and the run then reports "no open bump pull requests" and exits zero, leaving every stale bump untouched until the next push to main. Split the listing off the grep so `|| true` covers only grep finding no bump branch, and a failed `gh` fails the job. Assisted-by: Claude:claude-opus-5 * fix: refresh when a bump pull request opens A service's first bump pushes its branch before it opens the pull request, so the run that push starts can list open pull requests before this one exists and find nothing to rebuild. That branch then waited for the next push to main, which is the delay this workflow exists to remove. Opening the pull request now starts a run of its own. The concurrency group holds it until the push-triggered run finishes, so it always lists after creation. The app opens these, and a pull request opened by an app triggers workflows, so no dispatch step is needed. The job skips before the checkout on anything that is not a bump branch in this repository. Assisted-by: Claude:claude-opus-5 * refactor: extract the refresh into a script The rebuild was 130 lines inlined in a workflow `run:` block, where shellcheck cannot read it and a person cannot run it. It now lives in scripts/refresh-bump-prs.sh, beside the set-dev-pin.sh it calls, and the workflow step passes GH_TOKEN and APP_SLUG and nothing else. The code is the same, with one change shellcheck asked for: the branch list iterates with `while read` on fd 3 rather than by word-splitting an unquoted variable, so a git or gh call inside the loop cannot eat the rest of the list. Assisted-by: Claude:claude-opus-5[1m] Signed-off-by: Miroslav Bajtoš <oss@bajtos.net> --------- Signed-off-by: Miroslav Bajtoš <oss@bajtos.net>
Published from fil-forge/swarf#6 - Digest: `sha256:8599e69bdff335617f473eca6100d901cb1c6c2aa0adf9e4d072e90e357a2071` - Commit: fil-forge/swarf@d5d1a0a - Publish run: https://github.com/fil-forge/swarf/actions/runs/32491694738 Merging applies [`terraform/envs/dev/apps`](https://github.com/fil-forge/infra-central/tree/main/terraform/envs/dev/apps) with no further confirmation.
fil-forge-bot
Bot
force-pushed
the
bot/bump-swarf-image-dev
branch
from
August 24, 2026 10:09
8eba684 to
20f4599
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Published from fil-forge/swarf#6
sha256:8599e69bdff335617f473eca6100d901cb1c6c2aa0adf9e4d072e90e357a2071Merging applies
terraform/envs/dev/appswith no further confirmation.