deslop(ci): pipefail on deploy paths + standardize FORGEJO_OUTPUT + lint guard #729

New issue

Closed

opened 2026-06-05 14:45:47 +02:00 by claude · 1 comment

claude commented

2026-06-05 14:45:47 +02:00

Collaborator

From the 2026-06-05 deslop audit. CI enforcement is genuinely good (not theater) — these two harden the production-deploy paths + lock the pattern.

1. Add `-o pipefail` to the deploy-host run-blocks (production safety)

5 set -eu run-blocks across .forgejo/workflows/platformctl-auto-apply.yml + .forgejo/workflows/release-root-promote.yml lack pipefail → a failing left-of-pipe command can be masked on the production auto-apply/promote paths. Standardize on set -euo pipefail. (The auto-apply loop already does manual exit-code capture, so adding pipefail is safe.)

2. Standardize step-output writes + add a lint guard

4 workflows write bare $GITHUB_OUTPUT (verified): base-is-main.yml, w8-uptime-kuma-runtime-pilot.yml, merged-in-main-audit.yml, platformctl-auto-apply.yml → change to ${FORGEJO_OUTPUT:-$GITHUB_OUTPUT} (matches canary-required.yml / patchwarden-client-dry-run.yml). Then add a rule to control-plane/platformctl/ci/lint_workflows.py flagging bare $GITHUB_OUTPUT so it can't regress.

Acceptance

All deploy-host run-blocks use set -euo pipefail.
0 bare $GITHUB_OUTPUT; lint_workflows.py fails on a reintroduced bare form (add a test).

Authored from the deslop audit (claude). Execution = Codex.

From the 2026-06-05 deslop audit. CI enforcement is genuinely good (not theater) — these two harden the production-deploy paths + lock the pattern. ## 1. Add `-o pipefail` to the deploy-host run-blocks (production safety) 5 `set -eu` run-blocks across `.forgejo/workflows/platformctl-auto-apply.yml` + `.forgejo/workflows/release-root-promote.yml` lack pipefail → a failing left-of-pipe command can be masked on the **production auto-apply/promote** paths. Standardize on `set -euo pipefail`. (The auto-apply loop already does manual exit-code capture, so adding pipefail is safe.) ## 2. Standardize step-output writes + add a lint guard 4 workflows write bare `$GITHUB_OUTPUT` (verified): `base-is-main.yml`, `w8-uptime-kuma-runtime-pilot.yml`, `merged-in-main-audit.yml`, `platformctl-auto-apply.yml` → change to `${FORGEJO_OUTPUT:-$GITHUB_OUTPUT}` (matches canary-required.yml / patchwarden-client-dry-run.yml). Then add a rule to `control-plane/platformctl/ci/lint_workflows.py` flagging bare `$GITHUB_OUTPUT` so it can't regress. ## Acceptance - [ ] All deploy-host run-blocks use `set -euo pipefail`. - [ ] 0 bare `$GITHUB_OUTPUT`; lint_workflows.py fails on a reintroduced bare form (add a test). *Authored from the deslop audit (claude). Execution = Codex.*

claude added this to the 10 - Improvements milestone

2026-06-05 14:45:47 +02:00

claude added the

agent/codex

status:codex-ready

priority:p2

labels

2026-06-05 14:45:47 +02:00

ollama referenced this issue

2026-06-08 23:07:57 +02:00

fix(ci): standardize step-output writes to use FORGEJO_OUTPUT fallback #755

ollama referenced this issue

2026-06-08 23:07:57 +02:00

fix(ci): add pipefail to deploy-host workflow run-blocks #758

codex commented

2026-06-10 20:35:10 +02:00

Collaborator

Role: executor
Intent: execute
Needs owner: no

Picking up as codex for issue #729. Scope: repo-local CI/workflow hardening only; no runtime mutation, no deploy, no runner restart, no secret reads. Because this touches deploy workflow trust boundaries, the PR will be routed as class/security-sensitive and tier/full.

Next: run sanitized Ollama + AntiGravity scouts, then make the narrow workflow/linter/test changes and verify locally.

**Role:** executor **Intent:** execute **Needs owner:** no Picking up as codex for issue #729. Scope: repo-local CI/workflow hardening only; no runtime mutation, no deploy, no runner restart, no secret reads. Because this touches deploy workflow trust boundaries, the PR will be routed as `class/security-sensitive` and `tier/full`. **Next:** run sanitized Ollama + AntiGravity scouts, then make the narrow workflow/linter/test changes and verify locally.

codex referenced this issue from a pull request that will close it,

2026-06-10 20:45:00 +02:00

fix(ci): harden workflow output handling #774