[architect] refactor(ci): enforce release-version invariant — project.conf release-version vs Justfile fsdk_version (adds .github/scripts/check-release-version.py, Justfile validate recipe) - #34
Merged
Conversation
project.conf declares release-version as the single source of truth for asset filenames, while the Justfile independently derives fsdk_version from the pinned elements/freedesktop-sdk.bst junction ref and build.yml uses that derived value for the release tag. Nothing compared the two, and they have drifted: project.conf said 25.08.13 while the junction is pinned to freedesktop-sdk-25.08.15. While drifted, a release publishes a new tag whose assets still carry the old version string. files/os/sysupdate.d/*.transfer read that version from the filename via @v, see no change, and hosts stop updating with no error anywhere in the pipeline. Add .github/scripts/check-release-version.py, which parses both values and fails closed on mismatch. Wire it into the existing `just validate` entry point (already run by build.yml's "Validate Element Graph" step) and into pre-commit. Correct project.conf to 25.08.15 so the declared invariant holds. Refs #31 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: kubestellar-hive[bot] <280983584+kubestellar-hive[bot]@users.noreply.github.com>
kubestellar-hive
Bot
added
hold
This was referenced Aug 29, 2026
Merged
hanthor
approved these changes
Sep 2, 2026
hanthor
left a comment
hanthor
left a comment
Member
There was a problem hiding this comment.
Confirmed on live main that project.conf said 25.08.13 while elements/freedesktop-sdk.bst was pinned to 25.08.15 — exactly the drift this PR describes and fixes. The new checker script and pre-commit/Justfile wiring are sound. CI green. Note: #21 in this same review pass would re-bump the FSDK pin to 25.08.16 without updating project.conf, immediately re-drifting past this fix — flagged there.
Generated by Claude Code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Claimed cluster
Exact ground this PR occupies, for the next occupied-ground comparison:
.github/scripts/check-release-version.pyJustfile— thevalidate:recipe only (one added line, ~line 51). Does not touchbuild,build-ddi,export-ddi,build-installer,export-installer,export-pxe,build-sysext,export-sysext,flash-installer, orshow-me-the-future. Deliberately disjoint from the PXE Justfile hunks in [scanner] feat: add PXE installer artifacts #22 / [scanner] fix: add PXE netboot installer support #25 / [scanner] feat: add PXE installer support #26, which all sit in theexport-installer/export-pxeregion.project.conf— thevariables.release-versionvalue and its comment..pre-commit-config.yaml— one addedcheck-release-versionhook.No
elements/, nofiles/, no.github/workflows/, no docs. Disjoint from #22/#25/#26/#27 (installer + PXE elements), #29 (sshd drop-in), and #18 (build.ymltoken scope).Refactor
The asset version axis has two independently-computed sources of truth that were never compared:
project.conf→release-versionbluefin-server-ddi-<v>.raw.zst,bluefin-server-installer-<v>.raw.zst,bluefin-server-<v>.efi,k3s-<v>.raw.zst)Justfile→fsdk_version, grepped from the pinnedelements/freedesktop-sdk.bstjunction refjust versioninbuild.ymlRenovate (and
build.yml's own "Track and Resolve BuildStream Refs" step) moves the junction ref automatically. Nothing movesrelease-version. They had already drifted two point releases:project.confsaid25.08.13, the junction is pinned tofreedesktop-sdk-25.08.15.Failure mode this closes
While drifted, a
mainbuild publishes taginstaller-v25.08.15containing assets still named...-25.08.13...— the upload steps copy by glob, so nothing objects.files/os/sysupdate.d/50-root.transfer,60-uki.transfer, and70-k3s.transferall extract the version from the filename via@vagainstreleases/latest/download/. systemd-sysupdate reads25.08.13, matches what is already installed, and reports nothing to do. OS, UKI, and k3s sysext updates stop fleet-wide, with green CI and a fresh Release as evidence that everything shipped. There is no error surface anywhere in the pipeline.Changes
.github/scripts/check-release-version.py— parsesrelease-versionfromproject.confand thefreedesktop-sdk-X.Y.Zpoint release from the pinned junction ref, and exits non-zero with a remediation message when they disagree.Justfilevalidate:— runs the checker before thebst showgraph checks.build.ymlalready invokesjust validatein its "Validate Element Graph" step, so this is enforced in CI on every PR and push with no workflow change..pre-commit-config.yaml— same checker, path-filtered toproject.conf,elements/freedesktop-sdk.bst, and the script, so a Renovate FSDK bump without a matchingrelease-versionbump fails locally too.project.conf— correctsrelease-versionto25.08.15so the invariant the repo already declares actually holds. This is the one behavior-affecting line in the PR and deserves explicit human sign-off: it renames the next release's assets to match the tag, which is the intended contract but is the first release since the drift began.Note for reviewers
The natural home for this gate is a dedicated
.github/workflows/version-consistency.yml. The hive App token lacks theworkflowspermission, so the push was rejected; the check is wired intojust validateinstead, which reaches the same CI surface via the existing "Validate Element Graph" step. A maintainer may prefer to lift it into its own workflow later.Verification
Also verified fail-closed against a synthetic
25.08.99value, and both edited YAML files parse.The invariant enforced here is the repo's own:
docs/skills/avoid-over-engineering.mdlists "The same version string in more than one.bstfile" as a red flag and asserts "release-versioninproject.confis the single source of truth" — theJustfilewas an unlisted second source.Refs #31
Filed by architect agent (ACMM L5 — hold-gated mode). Hold-gated: human review required. Do not merge without maintainer sign-off; the
project.confversion correction affects the next release's asset names.— hive: agent=architect backend=copilot model=claude-opus-5