CI gate follow-ups: script/cibuild has drifted from the model script, and the status-rewrite context string is hardcoded #147

New Issue

clawbot · 2026-08-12T13:00:16+02:00

clawbot commented

2026-08-12 13:00:16 +02:00

Two non-blocking findings from the independent review of #138. Not milestoned 1.0.0 — neither affects whether the gate works today.

1. `script/cibuild` is not byte-identical to the model script

REPO_POLICIES.md requires the script/ entrypoints stay byte-identical across repos, sourced from https://git.eeqj.de/sneak/prompts/raw/branch/main/script/cibuild. This repo's copy has a different header comment:

# script/cibuild: run the CI build. The Dockerfile runs the checks
# (make fmt-check, lint, test), so a successful build implies a green
# repo. Generic: needs no adaptation. The Gitea workflow runs this on
# push.

against the model's:

# script/cibuild: run the CI build. The Dockerfile runs script/check, so
# a successful build implies all checks pass.

The executable body is identical, so behaviour is unaffected. The drift is pre-existing on next and #138 did not introduce it — but it is what made that PR's own compliance claim inaccurate, and it is exactly the kind of divergence that gets silently overwritten on the next re-sync from prompts.

Worth deciding which direction to reconcile: the local comment is arguably more informative, in which case the MODEL should be updated in sneak/prompts and every repo re-synced, rather than this repo being reverted.

Done when diff between this repo's script/cibuild and the model is empty — whichever side moved.

2. The status-rewrite step hardcodes its context string

.gitea/workflows/check.yml:32 hardcodes ctx='check / check (push)'. Renaming the workflow or the job silently stops the match, restoring the false-red bug from #119 with no signal that it has broken.

Done when the context is derived (e.g. from ${GITHUB_WORKFLOW}, ${GITHUB_JOB} and ${GITHUB_EVENT_NAME}) so a rename cannot silently disable it, or the step fails loudly when it matches nothing.

Implementation requirements

Branch from next, PR based on next, single commit, title ending (closes #N).
Item 1 may need a PR against sneak/prompts instead of, or as well as, one here — say which in the PR body.
Do not modify TODO.md.
Gate on make check plus the Docker lint path with the cache defeated.

Two non-blocking findings from the independent review of https://git.eeqj.de/sneak/webhooker/pulls/138. Not milestoned 1.0.0 — neither affects whether the gate works today. ## 1. `script/cibuild` is not byte-identical to the model script `REPO_POLICIES.md` requires the `script/` entrypoints stay byte-identical across repos, sourced from `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/cibuild`. This repo's copy has a different header comment: ``` # script/cibuild: run the CI build. The Dockerfile runs the checks # (make fmt-check, lint, test), so a successful build implies a green # repo. Generic: needs no adaptation. The Gitea workflow runs this on # push. ``` against the model's: ``` # script/cibuild: run the CI build. The Dockerfile runs script/check, so # a successful build implies all checks pass. ``` The executable body is identical, so behaviour is unaffected. The drift is pre-existing on `next` and https://git.eeqj.de/sneak/webhooker/pulls/138 did not introduce it — but it is what made that PR's own compliance claim inaccurate, and it is exactly the kind of divergence that gets silently overwritten on the next re-sync from `prompts`. Worth deciding which direction to reconcile: the local comment is arguably more informative, in which case the MODEL should be updated in `sneak/prompts` and every repo re-synced, rather than this repo being reverted. **Done when** `diff` between this repo's `script/cibuild` and the model is empty — whichever side moved. ## 2. The status-rewrite step hardcodes its context string `.gitea/workflows/check.yml:32` hardcodes `ctx='check / check (push)'`. Renaming the workflow or the job silently stops the match, restoring the false-red bug from https://git.eeqj.de/sneak/webhooker/issues/119 with no signal that it has broken. **Done when** the context is derived (e.g. from `${GITHUB_WORKFLOW}`, `${GITHUB_JOB}` and `${GITHUB_EVENT_NAME}`) so a rename cannot silently disable it, or the step fails loudly when it matches nothing. ## Implementation requirements - Branch from `next`, PR based on `next`, single commit, title ending ` (closes #N)`. - Item 1 may need a PR against `sneak/prompts` instead of, or as well as, one here — say which in the PR body. - Do not modify `TODO.md`. - Gate on `make check` plus the Docker lint path with the cache defeated.

clawbot self-assigned this 2026-08-12 13:00:16 +02:00

clawbot referenced this issue

2026-08-12 13:00:44 +02:00

Make the CI gate execute the checks it reports on (closes #119) #138

clawbot referenced this issue

2026-08-12 13:30:47 +02:00

WIP: Milestone: delivery lifecycle, retention, config and session hardening #111

clawbot referenced this issue

2026-08-12 13:33:05 +02:00

Superseded-run status laundering: a never-tested commit reads green in the combined status #152

Sign in to join this conversation.