.gitea/workflows/check.yml line 8, at v1.0.0-rc1: the checkout step has no fetch-depth: 0. The checkout action clones one commit and fetches no tags, so on the CI runner git describe --tags --always --dirty in script/cibuild gives the short commit, and the image CI builds from a tagged commit stamps 2861be1 rather than v1.0.0-rc1 in its health check and startup log. The Dockerfile version check does not catch it, because a short commit is a valid version.
How to see it: a CI run of script/cibuild on the tag's commit; its builder step prints version="2861be1", where a build from a full clone prints version="v1.0.0-rc1" (as make docker does on a clone).
What is right: REPO_POLICIES.md line 454 to 456: "One consequence for CI: the standard checkout action clones shallow and fetches no tags, so a repo that embeds a tag-derived version must set fetch-depth: 0 on its checkout step." prompts/EXISTING_REPO_CHECKLIST.md lines 61 to 65 say the same. netwatch embeds a tag-derived version since this tag. The workflow file is the canonical one byte for byte, and the canonical copy lacks the line too; sneak/prompts#78 says a newer canonical workflow adds fetch-depth: 0, so the fix may be a re-vendor from there.
Severity: low. Nothing deploys the CI-built image; upaas builds its own from a full clone.
Definition of done
The checkout step sets fetch-depth: 0 (taken from the canonical workflow if it has it, otherwise added and reported on sneak/prompts#78 so the canonical copy gets it).
A CI run on a tagged commit shows the tag in the builder step's version (the run log is the check; the repo has no test of the workflow).
TODO.md updated in the same commit; commit title ends (closes #N) with this issue's number.
Model: fable-5-1
`.gitea/workflows/check.yml` line 8, at `v1.0.0-rc1`: the checkout step has no `fetch-depth: 0`. The checkout action clones one commit and fetches no tags, so on the CI runner `git describe --tags --always --dirty` in `script/cibuild` gives the short commit, and the image CI builds from a tagged commit stamps `2861be1` rather than `v1.0.0-rc1` in its health check and startup log. The `Dockerfile` version check does not catch it, because a short commit is a valid version.
**How to see it**: a CI run of `script/cibuild` on the tag's commit; its `builder` step prints `version="2861be1"`, where a build from a full clone prints `version="v1.0.0-rc1"` (as `make docker` does on a clone).
**What is right**: `REPO_POLICIES.md` line 454 to 456: "One consequence for CI: the standard checkout action clones shallow and fetches no tags, so a repo that embeds a tag-derived version must set `fetch-depth: 0` on its checkout step." `prompts/EXISTING_REPO_CHECKLIST.md` lines 61 to 65 say the same. netwatch embeds a tag-derived version since this tag. The workflow file is the canonical one byte for byte, and the canonical copy lacks the line too; https://git.eeqj.de/sneak/prompts/issues/78 says a newer canonical workflow adds `fetch-depth: 0`, so the fix may be a re-vendor from there.
**Severity**: low. Nothing deploys the CI-built image; upaas builds its own from a full clone.
## Definition of done
- [ ] The checkout step sets `fetch-depth: 0` (taken from the canonical workflow if it has it, otherwise added and reported on https://git.eeqj.de/sneak/prompts/issues/78 so the canonical copy gets it).
- [ ] A CI run on a tagged commit shows the tag in the `builder` step's version (the run log is the check; the repo has no test of the workflow).
- [ ] `TODO.md` updated in the same commit; commit title ends ` (closes #N)` with this issue's number.
Model: fable-5-1
clawbot
self-assigned this 2026-10-14 16:08:48 +02:00
Plan: .gitea/workflows/check.yml is re-vendored byte for byte from the canonical copy in sneak/prompts at 0653579 on its next (065357920a), which already sets fetch-depth: 0 on the checkout step, along with cancelling a branch's older run, a 20-minute time limit and persist-credentials: false. The canonical copy has the line, so nothing goes to sneak/prompts#78. A CI run on a tagged commit is not available to the worker; the PR says that part is checked by reading the workflow, and the next tag on next shows it.
Model: opus-5-5
Plan: `.gitea/workflows/check.yml` is re-vendored byte for byte from the canonical copy in sneak/prompts at `0653579` on its `next` (https://git.eeqj.de/sneak/prompts/commit/065357920a0a09bd736bf33d4cb5ce935fdc2328), which already sets `fetch-depth: 0` on the checkout step, along with cancelling a branch's older run, a 20-minute time limit and `persist-credentials: false`. The canonical copy has the line, so nothing goes to https://git.eeqj.de/sneak/prompts/issues/78. A CI run on a tagged commit is not available to the worker; the PR says that part is checked by reading the workflow, and the next tag on `next` shows it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
.gitea/workflows/check.ymlline 8, atv1.0.0-rc1: the checkout step has nofetch-depth: 0. The checkout action clones one commit and fetches no tags, so on the CI runnergit describe --tags --always --dirtyinscript/cibuildgives the short commit, and the image CI builds from a tagged commit stamps2861be1rather thanv1.0.0-rc1in its health check and startup log. TheDockerfileversion check does not catch it, because a short commit is a valid version.How to see it: a CI run of
script/cibuildon the tag's commit; itsbuilderstep printsversion="2861be1", where a build from a full clone printsversion="v1.0.0-rc1"(asmake dockerdoes on a clone).What is right:
REPO_POLICIES.mdline 454 to 456: "One consequence for CI: the standard checkout action clones shallow and fetches no tags, so a repo that embeds a tag-derived version must setfetch-depth: 0on its checkout step."prompts/EXISTING_REPO_CHECKLIST.mdlines 61 to 65 say the same. netwatch embeds a tag-derived version since this tag. The workflow file is the canonical one byte for byte, and the canonical copy lacks the line too; sneak/prompts#78 says a newer canonical workflow addsfetch-depth: 0, so the fix may be a re-vendor from there.Severity: low. Nothing deploys the CI-built image; upaas builds its own from a full clone.
Definition of done
fetch-depth: 0(taken from the canonical workflow if it has it, otherwise added and reported on sneak/prompts#78 so the canonical copy gets it).builderstep's version (the run log is the check; the repo has no test of the workflow).TODO.mdupdated in the same commit; commit title ends(closes #N)with this issue's number.Model: fable-5-1
Plan:
.gitea/workflows/check.ymlis re-vendored byte for byte from the canonical copy in sneak/prompts at0653579on itsnext(065357920a), which already setsfetch-depth: 0on the checkout step, along with cancelling a branch's older run, a 20-minute time limit andpersist-credentials: false. The canonical copy has the line, so nothing goes to sneak/prompts#78. A CI run on a tagged commit is not available to the worker; the PR says that part is checked by reading the workflow, and the next tag onnextshows it.Model: opus-5-5