germinate: chart-tag extraction takes the gitops pin verbatim — pre-release tags no longer kill germination #68

Merged
plat merged 1 commit from fix/germinate-prerelease-tags into main 2026-07-02 04:32:32 +00:00
Owner

Release-blocking bug found by the 0.7.6-rc.1 train validation (fresh germination on the vxrail, isolated val076 cluster, prod untouched): bin/germinate extracted MCPTAG/AGENTSTAG with a numeric-only regex, so a gitops pinning a pre-release chart tag (0.7.6-rc.1) made grep exit 1 → set -euo pipefail aborted the whole germination at wire post-Forgejo secrets, stderr discarded. Any RC-tagged train was structurally unable to germinate. Reproduced in isolation on the host (exact pipeline: pre-release input → exit 1, numeric input → works).

Fix: sed -n capture of the pin verbatim (the daughter CI must build exactly the version the HelmRelease/OCIRepository pin or Flux never resolves the chart), empty on no-match, || true absorbs a missing file — feeding the existing WARN+skip fallbacks instead of a silent abort. Proven under set -euo pipefail for pre-release / numeric / missing-file inputs.

Follow-ups noted: the CI-1 harness (#21) should germinate an rc-pinned gitops as a standing assertion; the 0.7.6-rc.1 validation re-run on the vxrail resumes from this branch.

🤖 Generated with Claude Code

Release-blocking bug found by the 0.7.6-rc.1 train validation (fresh germination on the vxrail, isolated `val076` cluster, prod untouched): `bin/germinate` extracted MCPTAG/AGENTSTAG with a numeric-only regex, so a gitops pinning a pre-release chart tag (`0.7.6-rc.1`) made `grep` exit 1 → `set -euo pipefail` aborted the whole germination at *wire post-Forgejo secrets*, stderr discarded. **Any RC-tagged train was structurally unable to germinate.** Reproduced in isolation on the host (exact pipeline: pre-release input → exit 1, numeric input → works). Fix: `sed -n` capture of the pin **verbatim** (the daughter CI must build exactly the version the HelmRelease/OCIRepository pin or Flux never resolves the chart), empty on no-match, `|| true` absorbs a missing file — feeding the existing WARN+skip fallbacks instead of a silent abort. Proven under `set -euo pipefail` for pre-release / numeric / missing-file inputs. Follow-ups noted: the CI-1 harness (#21) should germinate an rc-pinned gitops as a standing assertion; the 0.7.6-rc.1 validation re-run on the vxrail resumes from this branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
The MCPTAG/AGENTSTAG extraction used a numeric-only regex
(grep -oE 'tag: *"[0-9][0-9.]*"'), so a gitops that pins a PRE-RELEASE
chart tag (0.7.6-rc.1) made grep exit 1 — and under set -euo pipefail that
silently aborted the WHOLE germination at 'wire post-Forgejo secrets'
(stderr was /dev/null'd). Found by the 0.7.6-rc.1 train validation on a
fresh vxrail germination: any RC-tagged release train was structurally
unable to germinate.

sed -n 's/.*tag: *"\([^"]*\)".*/\1/p' captures the pin verbatim
(the daughter's CI must build EXACTLY the version the HelmRelease pins or
Flux never resolves the chart), prints nothing on no-match, and '|| true'
absorbs a missing file — the build steps below already WARN+skip on an
empty tag, which the hard abort was defeating.

Proven under set -euo pipefail: 0.7.6-rc.1 -> verbatim, 0.26.0 -> verbatim,
missing file -> empty + alive.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
plat merged commit dabe4f1ae9 into main 2026-07-02 04:32:32 +00:00
Sign in to join this conversation.
No description provided.