seed-release workflow has never succeeded — releases are being hand-made #263

New issue

Closed

opened 2026-09-02 05:13:47 +00:00 by plat · 2 comments

plat commented

2026-09-02 05:13:47 +00:00

Owner

Evidence: before 2026-09-01 this repo had ZERO releases and ZERO tags, though seed packages r405…r829 exist — so seed-release.yml (create the seed-r<N> tag + Release + attach the tarball, link the package) has failed on every firing since it shipped. It failed again on the r829 and r873 merges (runs on runs-on: isolated; Forgejo has no run-log API so the step-level cause needs the web UI’s log view). Hand-made so far: seed-r829, seed-r873 (tag + release + attachments + package link — every API call succeeds when run by hand as plat, so the break is environmental to the isolated pool: suspects are github.token scope on the raw fetch, or the pool’s egress netpol vs the public host used for the API base). Suggested next steps: add workflow_dispatch to seed-release.yml (ride it with the next mitosis change — every solo merge costs a reseed cycle), read the failing step in the Actions web UI, and if it’s the raw fetch, use the in-cluster REGISTRY host with PLAT_PAT instead of github.token. The package lane is unaffected (r873 published under open-platform/seed by reseed-run + publish_seed).

Evidence: before 2026-09-01 this repo had ZERO releases and ZERO tags, though seed packages r405…r829 exist — so `seed-release.yml` (create the `seed-r<N>` tag + Release + attach the tarball, link the package) has failed on every firing since it shipped. It failed again on the r829 and r873 merges (runs on `runs-on: isolated`; Forgejo has no run-log API so the step-level cause needs the web UI’s log view). Hand-made so far: `seed-r829`, `seed-r873` (tag + release + attachments + package link — every API call succeeds when run by hand as plat, so the break is environmental to the isolated pool: suspects are `github.token` scope on the raw fetch, or the pool’s egress netpol vs the public host used for the API base). Suggested next steps: add `workflow_dispatch` to seed-release.yml (ride it with the next mitosis change — every solo merge costs a reseed cycle), read the failing step in the Actions web UI, and if it’s the raw fetch, use the in-cluster REGISTRY host with `PLAT_PAT` instead of `github.token`. The package lane is unaffected (r873 published under `open-platform/seed` by reseed-run + publish_seed).

plat referenced this issue

2026-09-02 06:33:01 +00:00

sweep the escaped domain spelling; seed-release in-cluster API (#258, #263) #264

plat referenced this issue from a commit

2026-09-02 06:33:02 +00:00

sweep the escaped spelling too; seed-release calls the forge in-cluster

plat referenced this issue from a commit

2026-09-02 08:56:20 +00:00

sweep the escaped domain spelling; seed-release in-cluster API (#258, #263) (#264)

plat commented

2026-09-02 11:12:49 +00:00

Author

Owner

Root cause found (task log read from the pod: /data/actions_log/.../28177.log.zst): jq: command not found on the isolated runner image. Step 1 completes fully — the github.token raw fetch and the in-cluster BASE derivation both work — the job dies at step 2's first jq -n. Every firing since birth died here (run 18368 fix/seed-release-jq was an earlier skirmish). Second defect: the tag fallback mints seed-r20260902045124 — manifest seedVersion is a timestamp stamp, not the reseed number; the deterministic source is genesis/upstream.json .release. Fix incoming: jq-free workflow + tag keyed to upstream.json.

Root cause found (task log read from the pod: `/data/actions_log/.../28177.log.zst`): **`jq: command not found` on the isolated runner image.** Step 1 completes fully — the `github.token` raw fetch and the in-cluster BASE derivation both work — the job dies at step 2's first `jq -n`. Every firing since birth died here (run 18368 `fix/seed-release-jq` was an earlier skirmish). Second defect: the tag fallback mints `seed-r20260902045124` — manifest `seedVersion` is a timestamp stamp, not the reseed number; the deterministic source is `genesis/upstream.json` `.release`. Fix incoming: jq-free workflow + tag keyed to upstream.json.

plat referenced this issue

2026-09-02 11:13:54 +00:00

seed-release: jq-free, tag keyed to upstream.json (#263) #266

plat referenced this issue from a commit

2026-09-02 11:13:55 +00:00

seed-release: no jq, tag from upstream.json

plat referenced this issue from a commit

2026-09-02 15:03:47 +00:00

seed-release: jq-free, tag keyed to upstream.json (#263) (#266)

plat commented

2026-09-02 15:04:33 +00:00

Author

Owner

Fixed and proven. #266 (jq-free, tag from upstream.json .release, in-cluster API) merged; workflow_dispatch run 28190 → success, release seed-r886 created through the 201 path — the first successful firing in this workflow's life. The push path gets its proof on the next reseed merge. Residual (non-blocking): the isolated runner image ships no jq — worth adding in ci-runner someday, but seed-release no longer cares.

Fixed and proven. #266 (jq-free, tag from upstream.json `.release`, in-cluster API) merged; `workflow_dispatch` run **28190 → success**, release **seed-r886** created through the 201 path — the first successful firing in this workflow's life. The push path gets its proof on the next reseed merge. Residual (non-blocking): the isolated runner image ships no jq — worth adding in ci-runner someday, but seed-release no longer cares.

plat closed this issue

2026-09-02 15:04:34 +00:00

plat referenced this issue

2026-09-02 15:30:50 +00:00

seed-release: jq → node; reseed no-op guard ignores mitosis self-ref #131