fix(ci): add pipefail to deploy-host workflow run-blocks #758

New issue

Closed

opened 2026-06-08 23:07:57 +02:00 by ollama · 1 comment

ollama commented

2026-06-08 23:07:57 +02:00

Collaborator

Spec sources (whitelist)

.forgejo/workflows/platformctl-auto-apply.yml — identify all set -eu run-blocks (not set -euo pipefail)
.forgejo/workflows/release-root-promote.yml — same
.forgejo/workflows/canary-required.yml — reference: already uses set -euo pipefail (correct)
control-plane/platformctl/ci/lint_workflows.py — lint guard to add

Extracted context

5 set -eu run-blocks across 2 workflow files lack -o pipefail. A failing left-of-pipe command can be masked — the pipe succeeds even if the left command fails.

The auto-apply loop already does manual exit-code capture, so adding pipefail is safe.

Reference: canary-required.yml already uses the correct set -euo pipefail pattern.

Scope

In .forgejo/workflows/platformctl-auto-apply.yml: find all set -eu run-blocks and change to set -euo pipefail
In .forgejo/workflows/release-root-promote.yml: same change
Optionally add lint rule to lint_workflows.py that flags bare set -eu without -o pipefail

Acceptance criteria

All deploy-host run-blocks use set -euo pipefail
0 bare set -eu in deploy paths
lint_workflows.py detects missing pipefail (optional bonus)

Do NOT read

Full repo — only the 3-4 files listed above

Agent notes

Recommended executor: Gemini 3.5 Flash
Size: Trivial (~10 LOC)
Review tier: tier/trivial (if only workflows changed) or tier/lite (if lint rule added)
Audit ref: state/audit/deepseek-2026-06-08-multiperspective.md §D2
This is a subset of #729 item 1 (claude's deslop issue)

## Spec sources (whitelist) - `.forgejo/workflows/platformctl-auto-apply.yml` — identify all `set -eu` run-blocks (not `set -euo pipefail`) - `.forgejo/workflows/release-root-promote.yml` — same - `.forgejo/workflows/canary-required.yml` — reference: already uses `set -euo pipefail` (correct) - `control-plane/platformctl/ci/lint_workflows.py` — lint guard to add ## Extracted context 5 `set -eu` run-blocks across 2 workflow files lack `-o pipefail`. A failing left-of-pipe command can be masked — the pipe succeeds even if the left command fails. The auto-apply loop already does manual exit-code capture, so adding pipefail is safe. Reference: `canary-required.yml` already uses the correct `set -euo pipefail` pattern. ## Scope 1. In `.forgejo/workflows/platformctl-auto-apply.yml`: find all `set -eu` run-blocks and change to `set -euo pipefail` 2. In `.forgejo/workflows/release-root-promote.yml`: same change 3. Optionally add lint rule to `lint_workflows.py` that flags bare `set -eu` without `-o pipefail` ## Acceptance criteria - [ ] All deploy-host run-blocks use `set -euo pipefail` - [ ] 0 bare `set -eu` in deploy paths - [ ] `lint_workflows.py` detects missing pipefail (optional bonus) ## Do NOT read - Full repo — only the 3-4 files listed above ## Agent notes - Recommended executor: Gemini 3.5 Flash - Size: Trivial (~10 LOC) - Review tier: tier/trivial (if only workflows changed) or tier/lite (if lint rule added) - Audit ref: state/audit/deepseek-2026-06-08-multiperspective.md §D2 - This is a subset of #729 item 1 (claude's deslop issue)

ollama referenced this issue

2026-06-08 23:09:24 +02:00

[meta] DeepSeek audit 2026-06-08 — atomic Gemini-ready task batch #766

pdurlej added the

safety:no-prod-mutation

size/small

status:codex-ready

labels

2026-06-17 23:35:35 +02:00

pdurlej referenced this issue

2026-06-17 23:35:38 +02:00

[meta] DeepSeek audit 2026-06-08 — atomic Gemini-ready task batch #766

pdurlej commented

2026-06-17 23:43:04 +02:00

Owner

Closing as already implemented on current main. Evidence: targeted scan for bare set -eu in .forgejo/workflows/platformctl-auto-apply.yml and .forgejo/workflows/release-root-promote.yml returned no matches; deploy workflow run-blocks have moved to pipefail-safe form. Verification: full platformctl test suite passed with UV_CACHE_DIR=/tmp/platform-uv-cache PYTHONPATH=control-plane uv run --project control-plane --extra dev pytest control-plane/platformctl/tests -q -> 756 passed.

Closing as already implemented on current main. Evidence: targeted scan for bare `set -eu` in `.forgejo/workflows/platformctl-auto-apply.yml` and `.forgejo/workflows/release-root-promote.yml` returned no matches; deploy workflow run-blocks have moved to pipefail-safe form. Verification: full `platformctl` test suite passed with `UV_CACHE_DIR=/tmp/platform-uv-cache PYTHONPATH=control-plane uv run --project control-plane --extra dev pytest control-plane/platformctl/tests -q` -> `756 passed`.

pdurlej closed this issue

2026-06-17 23:43:05 +02:00

pdurlej referenced this issue

2026-06-18 00:06:36 +02:00

[meta] DeepSeek audit 2026-06-08 — atomic Gemini-ready task batch #766