admin/felhom-agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: CHANGELOG + REPORT for the CI workflow (no version bump)
gates / gates (push) Successful in 6s
Details

Browse Source
This commit is contained in:
authentik Default Admin
2026-08-02 16:35:44 +02:00
parent eb99144509
commit 587dbb43fe
2 changed files with 57 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+29
View File
@@ -1,3 +1,32 @@
## CI — the gate entry point runs on every push (2026-08-02, R-168) — NO VERSION BUMP
**No version bump, no build, no deploy** — this adds a workflow file only. Stated explicitly so the
omission reads as a decision rather than a miss.
**`.gitea/workflows/gates.yml` (new).** Triggers on `push`, `runs-on: felhom-gates`, obtains the
source with a shallow `git fetch` of the **exact pushed SHA** from the in-cluster Gitea Service, and
runs this repo's entry point with `--fast` — nothing else. **No `uses:` step anywhere**: JavaScript
actions need a node runtime the host-mode runner does not have, and probe P3 measured a plain
`git fetch` as sufficient. No `|| true`; the entry point's exit code IS the job's result.
**It REPORTS, it cannot REFUSE**, and the workflow header says so: this repo pushes straight to
`main` with no pull request, so there is no merge for a status check to stand at. The refusing half
is `.githooks/pre-push`, which is per-clone and `--no-verify`-able; this half notices when that was
skipped. Making CI blocking needs branch protection plus a PR workflow → felhom.eu `OPEN-ITEMS.md`
R-169, an operator decision.
**A failed run emails the operator** via Resend and prints the provider's accepted id, because probe
P5 measured that Gitea itself sends nothing at all on a failed run. Demonstrated end to end on a real
red run (`RESEND-ACCEPTED id=…`), not assumed. Full detail:
`felhom.eu/documentation/audits/SPIKE-ci-runner-2026-08-02.md`.
**CI reproduces the workspace's SIBLING LAYOUT on purpose.** This repo's entry point invokes the
shared `reuse_refs_check.py` that lives in the `felhom.eu` clone next door and is deliberately never
copied here, and this repo's `REUSE.md` cites `hub/internal/store/dr_recipe.go`, which lives in the hub. The workflow
therefore clones `felhom.eu` as a sibling; without it the gate fails **closed** with
`gate is MISSING` — correctly, but for the wrong reason. Verified that CI and the local hook then
agree exactly: 90 cited paths, 88 exact / 1 suffix / 1 cross-repo, 0 failures.
## Gate enforcement — this repo gets a place to put a gate (2026-08-02) — NO VERSION BUMP
**Deliberately no version bump, and no build or deploy.** Nothing compiled changed: this touches
REPORT.md
+28 -52
View File
@@ -1,65 +1,41 @@
# REPORT — this repo gets a place to put a gate (2026-08-02)
# REPORT — CI runs the gate entry point on every push (R-168, 2026-08-02)
**Overwritten** per the standing rule. The prior contents (the host report carries the box's
addresses, agent v0.119.0, 2026-07-31) have their durable record in `CHANGELOG.md` and
`felhom.eu/documentation/audits/host-addresses-visible-2026-07-31.md`; nothing was lost.
**Overwritten** per the standing rule. The prior contents (session 1's gate entry point, same day) have their durable record in `CHANGELOG.md`.
**No version bump, no build, no deploy.** Nothing compiled changed — this touches `scripts/` and
`.githooks/` only. Stated explicitly so the omission reads as a decision rather than a miss. The
agent stays **v0.119.0** and no binary was copied to any host.
**No version bump, no build, no deploy.** This adds `.gitea/workflows/gates.yml` and a CHANGELOG
entry. Nothing compiled changed.
## What changed
| Commit | What |
|---|---|
| `054e85a` | `scripts/agent_gates.py` + `scripts/test_agent_gates.py` + `.githooks/pre-push` + `CLAUDE.md` |
| `75245a4` | `CHANGELOG.md` |
`.gitea/workflows/gates.yml` — on every push, a Gitea Actions runner obtains this repo at the
**exact pushed SHA** (shallow `git fetch`, no `uses:` step anywhere) and runs
`python3 scripts/agent_gates.py --fast` and nothing else. The exit code is the job's result: no `|| true`, no
pipe that could swallow it.
Baseline on arrival: `4663df7ff3cc`, clean, `HEAD == origin/main` — matched the spec's anchor.
**It REPORTS, it cannot REFUSE**, and the workflow header says so in the pre-push hook's voice: this
repo pushes straight to `main` with no pull request, so there is no merge for a status check to stand
at. The refusing half is `.githooks/pre-push` (per-clone, `--no-verify`-able); this half notices when
that was skipped. Making CI blocking needs branch protection plus a PR workflow — an operator
decision, tracked as `felhom.eu` `OPEN-ITEMS.md` **R-169**.
## Why this repo got an entry point with exactly one gate
**A failed run emails the operator.** Probe P5 measured that Gitea itself sends **nothing** on a
failed run — no mail, no notification row, no log line — so the workflow sends its own via Resend and
prints the provider's accepted id, making "a message left the machine" an observable. Demonstrated on
a real red run in `felhom.eu`: `RESEND-ACCEPTED id=5ff34766-c5f8-4588-8104-08296aeb45ab`.
A census of all thirteen gate scripts across the four felhom repos on 2026-08-02 found one clean
correlation: **every check a `CLAUDE.md` tells a person to run was passing, and two of the four
nobody is told to run were failing** — one since 14 July. **This repo was the extreme case: nothing
at all ran against it, and its `REUSE.md` — 90 cited paths — was checked by no one.**
`scripts/agent_gates.py` runs `reuse_refs_check` over this repo's `REUSE.md`, streams its output and
exits worst-wins non-zero. One gate is the honest size of it today; the file exists so the agent is
not the one repo with nowhere to put a check, and so the pre-push hook has the same entry point in
all four repos. It grows when the agent grows a second gate.
**The shared checker is never copied here.** `reuse_refs_check.py` stays in `felhom.eu/scripts/` and
is invoked at `<repo-root>/../felhom.eu/scripts/`; a copy would recreate exactly the drift it detects.
**A missing sibling clone is a FAILURE with the path printed, never a skip** — fail-closed, because a
runner that quietly drops a gate is the inert-seam failure this project has shipped four times.
`test_agent_gates.py` pins that by copying the entry point into a lone directory with no sibling and
asserting it convicts.
The 90 citations now resolve as **88 exact, 1 by suffix** (`localapi/debuglogs_test.go` →
`internal/localapi/debuglogs_test.go`) and **1 cross-repo** (`hub/internal/store/dr_recipe.go`, which
lives in the hub), 0 failures. None of them was genuine drift — the checker was what needed fixing,
not the REUSE map.
## `.githooks/pre-push`
Runs `agent_gates.py --fast` and refuses the push, printing a line before and after because an absent
log line is not evidence a hook ran. Limits, written into the hook itself: **per-clone**
(`core.hooksPath` is local config; this clone is armed — `git config --get core.hooksPath` →
`.githooks`) and **`git push --no-verify` bypasses it on purpose**, which must be stated in a session
report when used. It was **not** used against this repo; both real pushes ran the hook and passed.
The half that is neither per-clone nor skippable is CI — `felhom.eu` `OPEN-ITEMS.md` **R-168**.
**CI reproduces the workspace's SIBLING LAYOUT on purpose.** This repo's entry point invokes the
shared `reuse_refs_check.py` that lives in the `felhom.eu` clone next door and is deliberately never
copied here, and this repo's `REUSE.md` cites `hub/internal/store/dr_recipe.go`, which lives in the hub. The workflow clones
`felhom.eu` as a sibling; without it the gate fails **closed** with `gate is MISSING` — correctly,
but for the wrong reason.
## Verification
```
reuse-refs OK (exit 0)
First run: run #1, id=9, conclusion **success**, sha `eb991445`.
all agent gates OK
```
**CI and the local pre-push hook AGREE**, which is the check that mattered: `90 cited paths — exact 88, suffix 1, ambiguous 0, cross-repo 1, FAILED 0 (siblings searched: felhom.eu)` — identical to the local run.
`python3 scripts/test_agent_gates.py` → **4 tests, OK** (0 before). No Go file was touched, so no Go
test count changed.
Full cross-repo detail, every red-proof, the `core.hooksPath` probe measurements and the hub
deployment: `felhom.eu/REPORT.md`.
The runner is unprivileged host-mode, shared with the other three repos on a single owner-scoped
registration (measured: all four repos' tasks claimed by `felhom-gates-runner`). Full probe detail,
the security posture and the teardown: `felhom.eu/documentation/audits/SPIKE-ci-runner-2026-08-02.md`
and `felhom.eu/REPORT.md`.