🤖 ci: repair main-channel GoReleaser preparation

[ThomasK33]

Readiness: ready for required merge queue

Head: 8aa69887a61ccca0d21964eebc98d552c0a764bc; base: 277b70be1568ce61442da05fb94dba0434dc4aee. Fresh CI run 35601729507 passed on actual merged source 3bc80c4a639d33db611101794be66373373ae7ac / tree 891aa048e167254636dc8173803746e736779635. Old failed runs in the combined check rollup are retained history, not this new execution.

Normal and security Codex reviews remain clean on the unchanged head. The fresh independent final assessment rechecked their assumptions against the new base and recommends ready with tracked follow-ups. 5/6 lifetime assessments complete, none pending. No further review round is needed.

Current-tool native packaging evidence passed with official GoReleaser 2.18.2 / Go 1.26.8, both channels and both architectures, with expected-failure controls. Non-publishing mode skipped Docker build/push; actual GHCR authorization and publishing remain unverified. The release fixture used an explicit local tag and supplied notes. PR CI skipped full E2E; the required merge queue must run it.

The maintainer owns queue admission and post-merge publishing/per-platform provenance verification. Issue #98 stays open until those outcomes are verified. This is readiness for the queue, not a claim that publishing is already restored.

---

Summary

Prepare GoReleaser's synthetic v0.0.0-main tag in the CI checkout, without pushing it. Skip GitHub changelog generation for that local-only tag. Keep the release workflow, image tags, publishing arguments, permissions, and validation gates unchanged.

Part of #98. The issue remains open for post-merge main CI and image-provenance verification. This PR does not claim that publication is restored.

Evidence and implementation

1. At original main b1d48e3a64b42a23cb0cfaee8c30f3f21b761424, checksum-verified Go 1.25.7 and GoReleaser 2.13.3 passed goreleaser check, but non-snapshot release --clean --skip=publish,announce exited 1 before building: the synthetic tag did not point at HEAD. The tag was absent locally and remotely; using branch main produced the same failure.
2. Creating the local tag let both architectures build, then reached GitHub changelog generation. A separate authenticated, read-only comparison against the synthetic tag returned 404; comparison against the actual source SHA succeeded. Main does not create a GitHub release, so it now skips that changelog. The new condition also handles an unset channel, as used by the release workflow.
3. Regression tests execute the actual workflow preparation step in temporary Git repositories. They cover absent/stale synthetic tags, release-tag preservation, clean worktrees, and main/empty/release/unset changelog conditions. The existing YAML module becomes a direct test dependency; no dependency version or vendored content changes.

The historical publishing logs return HTTP 410. These are reproduced source-path defects, not proof of the inaccessible historical failure's exact cause.

Validation

Candidate: 8aa69887a61ccca0d21964eebc98d552c0a764bc.

• make test, make build, make verify-vendor, make lint: all native exit 0 on this commit, using Go 1.25.7.
• go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.10: exit 0.
• Focused regressions failed before the respective repairs and passed after them. Exact-head dogfooding also caught an unset-channel regression, which was corrected before opening this PR.
• GoReleaser 2.13.3 configuration checks and non-snapshot packaging passed for main and a local tagged-release fixture, with both linux/amd64 and linux/arm64 archives and verified checksums. Main and release native exits: 0 / 0.
• Isolation: sanitized environment, no publishing credentials, unavailable Docker endpoint, --skip=publish,announce, no --snapshot or --skip=validate. The release fixture uses a local v98.0.0 tag and supplied release notes; its remote changelog API is not exercised.
• Read-only GHCR inspection found :main index sha256:90b505ac03d7f5862d25dd955a74957c8fcc9d344f69c42ebd1f841111a2fa18, with recorded revision 8cb24dd6f4fd4b53f7a99b6bdfdda41405b7f22f, not current main.

Risks and limits

Only the CI-local synthetic tag moves. Nothing pushes that Git tag. No publisher rerun, container push, release, deployment, infrastructure change, or merge was performed. Non-publishing packaging does not validate Docker publishing or registry write credentials. Human merge is required; main CI and the resulting image revision/digests still need post-merge verification.

Recorded hands-on evidence

These are actual terminal captures, exported with idle gaps shortened. They are not a live publisher run. The recordings show source identity, pinned tools, commands, and native exits.

Original-source failure

original-reproduction.webm

Candidate: main and release-fixture packaging pass

candidate-dogfood.webm

---

📋 Implementation Plan

Issue 98: bounded main image publishing diagnosis

Scope and acceptance

Investigate source b1d48e3a64b42a23cb0cfaee8c30f3f21b761424, initially identical to origin/main. Reproduce the non-publishing path with declared Go 1.25.7 and historical GoReleaser 2.13.3 before attributing any source defect. Current tool versions, if used, are separate evidence. Historical job logs are unavailable (HTTP 410); its annotation establishes exit 1 only.

Deliver one small coherent repair only if demonstrated necessary, with a focused regression that fails before the repair and passes after. Preserve main and release behavior. Otherwise deliver a precise evidence-backed blocker, not a speculative fix. No publisher rerun, image push, release, shared deployment, infrastructure change, CI-policy change, unrelated dependency upgrade, merge, enqueue, or auto-merge.

Phases and gates

1. Freeze issue, source, tool assets/checksums, historical receipts and read-only image provenance. Gate: clean checkout and fresh refs; authenticated downloads are limited to read-only GitHub APIs; no production credentials in the test environment.
2. Build a pinned non-publishing feedback loop in an owned source copy. Start with configuration checks and release validation; run the actual main-channel inputs with --skip=publish,announce and explicit non-publishing controls. Gate: exact source/tool/command/native-exit receipts, no registry writes, and a classified failure or success. Snapshot mode is a separate check, not evidence that normal git validation passes.
3. Minimize any reproduced failure, compare falsifiable alternatives, and write focused red→green coverage before a minimal fix. Gate: observed failure matches the demonstrated source defect; do not claim it proves the missing historical logs' contents. Stop here if the remaining failure needs unavailable infrastructure/credentials.
4. Validate final candidate: make test, build, verify-vendor and lint, plus actionlint for workflow edits and docs-check for user-facing docs. Exercise both main and release channels without publishing. Gate: final source identity, native exits, semantic screenshots/video and bounded owned-resource cleanup. Never describe skipped CI as runtime validation.
5. If a patch is warranted, publish one PR, then separate bare normal/security Codex requests. Reconcile helpers before use; bound all waits. Persist request and response type/time/SHA, findings and disposition in reviews/pr-N.json. Count pending requests and completed assessments toward a six-assessment lifetime capacity; reserve one fresh independent final assessment. Allow at most one failed-request retry per type/candidate. Gate: exact-head CI, clean required reviews and no unresolved justified findings, or a precise external blocker. Final independent assessor sees goal/diff/findings/check evidence without a preferred outcome.
6. Hand off readiness (not restoration) for human merge; retain post-merge main CI and image revision/digest verification with the maintainer desk.

Demonstrated repair boundary

The historical-tool reproduction rejects the absent synthetic v0.0.0-main tag before building. Creating that tag locally passes git validation and builds both architectures, then reaches GitHub changelog generation. A read-only authenticated GitHub comparison against the synthetic tag returns 404 while comparison against the real source SHA succeeds. The repair therefore creates the tag only in the main checkout and disables changelog generation only for the main channel, whose GitHub release is already disabled. Tagged-release changelog behavior and all validation/publishing controls remain unchanged. Regression coverage executes the workflow's tag preparation in temporary Git repositories (absent/stale tags, release-tag preservation, clean worktree) and checks the strict changelog template across main, empty, release and unset channel values.

Offline tagged-release packaging will use an explicit local fixture tag and supplied release notes, because an unpublished candidate has no remote release tag and the isolated environment has no GitHub credentials. This is a documented test-only input, not a source change or proof of the remote changelog API. No non-publishing run proves registry write credentials, Docker publishing, or restored main publication.

Hands-on dogfood and evidence

Use an isolated source copy under this delivery directory, pinned checksum-verified tools, sanitized environment with no publishing token or Docker credential config, and explicit skip-publish arguments. Preserve original configuration before any test-only variation. If image build is reached, use only an owned named builder/local output; no pushed mutable tag. Record the actual terminal session with agent-tty, capture a screenshot and video, and keep source SHA, tool versions, command lines, timestamps and native exit codes alongside it. Label any replay accurately. Inspect semantic frames rather than accepting successful encoding alone. Upload evidence to the relevant issue/PR with /usr/local/bin/gh --attach and verify the published body. Clean up only exactly owned processes/builders/tags.

Control and storage

Read maintainer status before every wake/resume and consequential external mutation. Stop unless active. All private notes, tools, evidence and scratch sources stay under /home/coder/.local/state/coder-k8s-maintainer/delivery/issue98/; only the designated per-PR review ledger is outside it. Preserve co-driven changes by checking live refs before mutation. Notify the desk of reproduction, head/PR, blockers and final state. No replacement PR to reset review capacity.

---

Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: xhigh

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-18T16:07:24.919333Z	8aa6988	Manual request
🔒 Security Review	✅ Completed 2026-09-18T16:12:26.677597Z	8aa6988	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[ThomasK33]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 8aa69887a6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[ThomasK33]

@codex security review

[chatgpt-codex-connector]

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 8aa69887a6

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[ThomasK33]

PR #92 has landed at 277b70be1568ce61442da05fb94dba0434dc4aee after full merge-group CI. I closed and reopened this existing PR once to trigger fresh CI against that baseline, preserving reviewed head 8aa69887a61ccca0d21964eebc98d552c0a764bc.

This is an event refresh, not a source rewrite or a readiness verdict. Four lifetime assessments remain counted. I will reconcile any automatic review before commissioning the fresh final assessment, within the two remaining slots. Prior packaging evidence and the final input-equivalence binding remain labeled with their original trees; fresh job checkout and tool receipts will establish what this new CI run tests. Issue #98 stays open through actual publishing and image-provenance verification.

---

Generated with xum • Model: coder:bedrock-mantle-us-west-2/openai.gpt-6-astra • Thinking: xhigh

[ThomasK33]

Current-tool packaging validation

Native non-snapshot packaging passes with GoReleaser 2.18.2 and Go 1.26.8 on the actual CI-tested merge commit 3bc80c4a639d33db611101794be66373373ae7ac (tree 891aa048e167254636dc8173803746e736779635; base 277b70be + unchanged PR head 8aa69887).

1. Official GoReleaser archive matched the release checksum and asset digest; its Sigstore bundle verified.
2. Main and release-fixture configuration checks and release --clean --skip=publish,announce passed. Both amd64 and arm64 archives passed checksum checks. Focused regressions passed; absent/stale-tag and unset-channel negative controls failed as expected.
3. No source edits, commits, PR-head changes, or publishing occurred. The isolated session was cleaned up. The final packet contains 53 hash-verified artifacts.

Limits: dockers_v2 skips image builds as well as pushes when publishing is skipped. This run therefore does not verify Docker publishing, GHCR authorization, or remote changelog generation. The release fixture supplied an explicit tag and release notes. Build metadata reflects local fixture tags/untracked outputs; archive hashes are not CI-output identity claims. The floating workflow selector is validated only for the observed 2.18.2 release.

The screenshot shows the captured final screen. The video is a 1× replay of the unchanged native terminal capture, with no idle shortening—not a second packaging run. Final readiness assessment and merge-group checks remain separate gates.

---

Generated with xum • Model: coder:bedrock-mantle-us-west-2/openai.gpt-6-astra • Thinking: xhigh

dogfood-native-capture-replay-1x.mp4

[ThomasK33]

Maintainer queue-readiness decision

Ready at unchanged head 8aa69887a61ccca0d21964eebc98d552c0a764bc against landed base 277b70be1568ce61442da05fb94dba0434dc4aee.

Fresh CI 35601729507 passed. Actual GoReleaser 2.18.2 native packaging passed on the same tested merge tree. Exact-head normal/security verdicts and the fresh independent final recommendation are complete; 5/6 lifetime assessments, 0 pending. Review iteration stops because no blocking findings remain, not because the last slot excuses defects.

The desk will submit through the required queue and verify full E2E, actual landing, then the normal main publisher and both platform image revisions. Issue #98 remains open until publishing/provenance verification; issue #100 tracks baseline/advisory follow-ups. Private non-publishing validation does not establish Docker publication, registry auth, or production readiness.

---

Generated with xum • Model: coder:bedrock-mantle-us-west-2/openai.gpt-6-astra • Thinking: xhigh