Uh oh!
There was an error while loading. Please reload this page.
feat: bundle rollout PR-β.2 — GC + release-lockfile invariant - #34
Merged
Conversation
Closes Tβ-7 and Tβ-8 of the bundle-schema-and-rollout spec. Reliability foundation for the rollout design: orphan bundles from declined PRs reap themselves on a bounded schedule; releases never silently lose their reproducibility guarantee. - cmd/gc-bundles: new Go tool that unions bundles.lock digest references across every remote branch + every published release tag, lists GHCR versions for php-core and php-ext-* via gh api, and filters by age + unreferenced-ness. Dry-run default; real delete behind a workflow_dispatch confirm input. Tested against a bare-repo fixture (refs enumeration) and an injectable Runner (GHCR operations). - .github/workflows/gc-bundles.yml: replaces the stub with a real invocation; uploads the dry-run report as an artifact (90-day retention) for review before flipping confirm on the next dispatch. - test/invariants/release_lockfile_test.go: //go:build invariants test that HEADs every released lockfile's digest on GHCR with the correct OCI manifest Accept header and anonymous pull-token flow (lesson from PR-β.1 debugging). Proves product-vision §16 reproducibility. - release-please.yml + nightly.yml: new invariant-check that runs the test after every release (gated on release_created) and nightly as a drift guard (if: always()). - .golangci.yml: extends the gosec G204 exclude-rule to cover cmd/gc-bundles/ — internal subprocess invocation, same pattern as cmd/lockfile-update/. - Makefile: gc-bundles-dry-run convenience target for local verification. No runtime changes — this PR is pure reliability-side hardening.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes Tβ-7 and Tβ-8 of
docs/superpowers/specs/2026-04-20-bundle-schema-and-rollout-design.md. Reliability foundation for the rollout design.cmd/gc-bundles— new Go tool that enumerates referenced digests across every remote branch + every published release tag, lists GHCR versions forphp-core+php-ext-*packages, and emits candidates for prune (old + unreferenced). Dry-run default; real delete guarded behindworkflow_dispatchconfirm: true. Unit-tested against a bare-repo fixture (ref enumeration) and an injectableRunner(GHCR operations).gc-bundles.yml— replaces the stub with a real invocation. Quarterly schedule. Uploads agc-bundles-reportartifact (90-day retention) every run so maintainers can review candidates before the next real-delete cycle.test/invariants/release_lockfile_test.go—//go:build invariantstest that HEADs every digest in every published release'sbundles.lockagainst GHCR. Uses the correct OCI manifestAcceptheader and anonymous pull-token flow (lesson from PR-β.1's Accept-header debugging). Proves product-vision §16 reproducibility: pinned@vX.Y.Zreferences must remain resolvable.release-please.yml+nightly.yml— newinvariant-checkwiring. On release-please, gated onrelease_created. On nightly,if: always()as a drift guard..golangci.yml— extends thegosec G204exclude-rule tocmd/gc-bundles/(same justification ascmd/lockfile-update/: internal subprocess invocation with internally-constructed args).Makefile—gc-bundles-dry-runconvenience target.Test plan
go test -race ./cmd/gc-bundles/— 3 unit tests green (refs enumeration, GHCR list, filter)go test -tags invariants ./test/invariants/...— passes locally against existing releasesmake check— cleangc-bundles.ymlschedule emits a sensible report — inspect the artifact; don't flipconfirm: trueuntil reviewedinvariant-checkgreenOperational notes
The first
gc-bundlesdispatch should run WITHOUTconfirm: trueso we can review what it plans to delete. Only after that review should we run withconfirm: truemanually. The quarterly cron stays dry-run-only — real deletes require explicit manual dispatch. Report artifact has 90-day retention for audit.No runtime changes in this PR.