IW-399 — Move installation and releases to code.iterative.works #408

Merged

mph merged 34 commits from IW-399 into main 2026-07-26 06:37:54 +00:00

Conversation 0 Commits 34 Files changed 22 +2484 -110

mph commented 2026-07-14 15:58:11 +00:00

Owner

Copy link

Integration PR for IW-399 — Move installation and releases from GitHub to code.iterative.works.

All three phases are complete. Ready for final review.

Status

• Phase 1 — Consumption side: docs + bootstrap repoint (merged via #403)
• Phase 2 — CI image cutover: fj added to the image, workflows repointed off ghcr.io to code.iterative.works/iterative-works/iw-cli-ci:latest, runner auto-token pull credentials
• Phase 3 — Release publishing + verify: publishing moved from gh/GitHub Releases to Forgejo REST

Phase 3 summary

• scripts/forgejo-release.sh (new): shared create-or-clobber Forgejo release publisher over REST (idempotent, fails loudly, never echoes the token).
• release.yml: versioned + vlatest publish via the REST helper using secrets.FORGEJO_RELEASE_TOKEN; auto-token still does checkout + the vlatest tag force-move.
• release-prepare.sh (fj pr instead of gh), release-publish.sh (break-glass; SHA-pinning preserved), RELEASE.md (tag-triggered workflow is now primary).

Decision: the runner auto-token cannot publish releases on Forgejo 11.0.8 (403 — no releases scope; the forgejo-actions id -2 user lacks release-unit write on the private org). Publishing uses the FORGEJO_RELEASE_TOKEN Actions secret (maintainer token, write:repository) via REST.

Verification (Tier-2 authenticated E2E)

A throwaway v0.0.0-test tag published a versioned release with the correct asset via the token — green in CI. The E2E surfaced three real release-blockers, all fixed here (each would have killed the first real v0.6.3 release):

1. rsync missing from the CI image → build exit 127.
2. scala-cli 1.12.5 couldn't start Bloop cold (its deps purged from the maven-nightlies repo it resolves from) → bumped to 1.15.0.
3. package-release.sh tarball validation tar | grep -q SIGPIPE-under-pipefail false failure.

Code review (3 reviewers): all acceptance criteria met; four findings addressed (delete all same-named assets on clobber; trigger scoped to v[0-9]*; checkout fetch-depth: 0; RELEASE.md checklist fix).

Gated / follow-up (not blocking this PR)

• Tier-3 anonymous install (acceptance criterion #2): blocked until a human opens anonymous release-asset read access on the private iterative-works org.
• The vlatest step was isolated out of the Tier-2 run (to not touch the production rolling release); it is the same validated helper call + a git force-push and gets its first real run on the first genuine release.

See .github/ci-image.md for how the image is built and pushed.

Integration PR for **IW-399 — Move installation and releases from GitHub to code.iterative.works**. All three phases are complete. Ready for final review. ## Status - [x] **Phase 1 — Consumption side**: docs + bootstrap repoint (merged via #403) - [x] **Phase 2 — CI image cutover**: `fj` added to the image, workflows repointed off `ghcr.io` to `code.iterative.works/iterative-works/iw-cli-ci:latest`, runner auto-token pull credentials - [x] **Phase 3 — Release publishing + verify**: publishing moved from `gh`/GitHub Releases to Forgejo REST ## Phase 3 summary - `scripts/forgejo-release.sh` (new): shared create-or-clobber Forgejo release publisher over REST (idempotent, fails loudly, never echoes the token). - `release.yml`: versioned + `vlatest` publish via the REST helper using `secrets.FORGEJO_RELEASE_TOKEN`; auto-token still does checkout + the `vlatest` tag force-move. - `release-prepare.sh` (`fj pr` instead of `gh`), `release-publish.sh` (break-glass; SHA-pinning preserved), `RELEASE.md` (tag-triggered workflow is now primary). **Decision:** the runner auto-token cannot publish releases on Forgejo 11.0.8 (403 — no `releases` scope; the `forgejo-actions` id -2 user lacks release-unit write on the private org). Publishing uses the `FORGEJO_RELEASE_TOKEN` Actions secret (maintainer token, `write:repository`) via REST. ## Verification (Tier-2 authenticated E2E) A throwaway `v0.0.0-test` tag published a versioned release with the correct asset via the token — green in CI. The E2E surfaced **three real release-blockers**, all fixed here (each would have killed the first real `v0.6.3` release): 1. `rsync` missing from the CI image → build exit 127. 2. scala-cli 1.12.5 couldn't start Bloop cold (its deps purged from the `maven-nightlies` repo it resolves from) → bumped to 1.15.0. 3. `package-release.sh` tarball validation `tar | grep -q` SIGPIPE-under-`pipefail` false failure. **Code review** (3 reviewers): all acceptance criteria met; four findings addressed (delete all same-named assets on clobber; trigger scoped to `v[0-9]*`; `checkout fetch-depth: 0`; RELEASE.md checklist fix). ## Gated / follow-up (not blocking this PR) - **Tier-3 anonymous install** (acceptance criterion #2): blocked until a human opens anonymous release-asset read access on the private `iterative-works` org. - The `vlatest` step was isolated out of the Tier-2 run (to not touch the production rolling release); it is the same validated helper call + a git force-push and gets its first real run on the first genuine release. See `.github/ci-image.md` for how the image is built and pushed.

mph added 20 commits 2026-07-14 15:58:11 +00:00

workflow(wf): Create analysis for IW-399 ... 08732d94d1

Move installation and releases from GitHub to code.iterative.works

Artifacts:
- analysis.md

🤖 Generated with Claude Code

workflow(wf): Resolve triage CLARIFYs for IW-399 via live-instance research ... d27bc3c126

Probed the live Forgejo instance, registry, and Forgejo/Gitea docs to
resolve research-answerable CLARIFYs and surface one new blocker:

- URL scheme: explicit-tag path is GitHub-identical (verified); the
  /releases/latest/download/ magic path is NOT implemented in Forgejo
- fj release subcommand present locally (no --clobber; view-then-update)
- vlatest tag + rolling "latest" release already exist on Forgejo
- iw-cli-ci is NOT yet on the Forgejo registry (Group E confirmed blocked)
- NEW BLOCKER: iterative-works org is private -> anonymous install
  one-liner 404s; private web download route needs basic auth, not tokens

🤖 Generated with Claude Code

workflow: Resolve clarifications for IW-399 ... 5b436c0c94

Resolved:
- analysis.md: Public vs credentialed install → make iw-cli public (credential-free)
- analysis.md: Runner release-publishing auth → use Forgejo auto-token, no PAT
- analysis.md: Container-registry cutover scope → build+publish iw-cli-ci to Forgejo, in scope (adds fj to CI image)
- analysis.md: Workflow location → keep under .github/workflows/
- analysis.md: One vs two release paths → tag-triggered workflow canonical, local scripts as break-glass fallback

🤖 Generated with Claude Code

workflow(wf): Track review-state for IW-399 ... 34bf01095e

Dashboard review state written during triage (analysis_ready).

🤖 Generated with Claude Code

workflow(wf): Revise phase plan for IW-399 after clarification decisions ... b5c00d35c0

Group E (CI image cutover) is now in scope and gates Group C, so it
becomes its own phase between consumption and publishing:
- Phase 1: docs + bootstrap (A+B)
- Phase 2: CI image cutover (E) — add fj, build+push to Forgejo
- Phase 3: release publishing + verify (C+D+F)

Total re-estimated 9.5-17h; confidence raised to Medium-High now that
the load-bearing unknowns are resolved.

🤖 Generated with Claude Code

workflow(wf): Create task index for IW-399 ... 9ceeefb8c3

Move installation and releases from GitHub to code.iterative.works

Artifacts:
- tasks.md (3 phases)
- review-state.json (tasks_ready)

🤖 Generated with Claude Code

Phase 1: context ready ... 97d9852b50

Issue: IW-399
Phase: 1 - Consumption side — docs + bootstrap repoint

This commit marks the checkpoint for phase 1 context generation.
Use wf-implement IW-399 to return to this point.

🤖 Generated with Claude Code

chore(IW-399): update review-state to context_ready 1693857e16

workflow(wf): Generate Phase 1 tasks for IW-399 ... 879d0cc3ee

Consumption side — docs + bootstrap repoint

Artifacts:
- phase-01-tasks.md

🤖 Generated with Claude Code

chore(IW-399): update review-state to tasks_ready 6954616ed1

Phase 1: Consumption side — docs + bootstrap repoint (#403) ... f3acd5acd5

Co-authored-by: Michal Prihoda <michal@prihoda.net>
Co-committed-by: Michal Prihoda <michal@prihoda.net>

chore(IW-399): update review-state for phase 01 22db1ca67c

chore(IW-399): mark phase 01 complete in tasks.md b81c039b05

Phase 2: context ready ... 099afcbdda

Issue: IW-399
Phase: 2 - CI image cutover

This commit marks the checkpoint for phase 2 context generation.
Use wf-implement IW-399 to return to this point.

🤖 Generated with Claude Code

chore(IW-399): update review-state to context_ready 08d36530f6

Phase 2: CI image cutover — code side (fj + Forgejo registry) ... 0ecd2872ae

Issue: IW-399
Phase: 2 - CI image cutover

Add fj (forgejo-cli) to .github/Dockerfile.ci (deps/ COPY convention),
repoint the image source LABEL off github.com, and add fj to the tool
verification RUN. Swap all 7 container.image + credentials blocks
(release.yml x1, ci.yml x6) from ghcr.io + github.actor/GITHUB_TOKEN to
the Forgejo registry image + FORGEJO_REGISTRY_USER/_TOKEN pull secrets.

Code side only. Image build/push to the Forgejo registry and the green
CI-run verification need registry access and are a documented human/infra
handoff (see phase-02-tasks.md + implementation-log.md). The gh release
publishing steps in release.yml are untouched (Phase 3).

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(IW-399): update review-state to tasks_ready 695b4b4a04

Phase 2: use Forgejo runner auto-token for registry pull ... 93936b4c00

Issue: IW-399
Phase: 2 - CI image cutover

Pull the Forgejo-registry CI image with the runner auto-token
(github.actor / secrets.GITHUB_TOKEN, which resolves to the Forgejo
auto-token) instead of dedicated registry secrets — lowest-setup path,
tried first. Add packages: read to release.yml permissions so the
auto-token can pull the private image (ci.yml already had it).

Docs updated: iw-cli-ci is a container package under the org (no git
repo needed); auto-token decision + scheduled-run caveat + dedicated-secret
fallback recorded in phase-02-tasks.md and implementation-log.md.

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(IW-399): update review-state 1c67d4739f

docs(IW-399): document CI image build/push and deps staging ... 50374b65a6

Captures how to assemble .github/deps/, build iw-cli-ci from
Dockerfile.ci (context .github), and push to the Forgejo registry
(write:package required). Includes the portable-fj caveat.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mph referenced this pull request from a commit 2026-07-14 16:15:28 +00:00

chore(IW-399): mark Phase 2 complete — image live + CI green

mph added 2 commits 2026-07-14 16:15:29 +00:00

chore(IW-399): mark Phase 2 complete — image live + CI green ... 262fa20a34

iw-cli-ci pushed to code.iterative.works; PR #408 green on all six
jobs via the runner auto-token. Handoff checkboxes closed, log updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(IW-399): update review-state to phase_merged d107dad189

mph added 5 commits 2026-07-15 19:24:21 +00:00

Phase 3: context ready ... a983087057

Issue: IW-399
Phase: 3 - Release publishing + verify

Checkpoint for phase 3 context generation. Groups C+D+F:
release.yml + local scripts gh->fj, RELEASE.md rewrite, E2E verify.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(IW-399): update review-state to context_ready 9a43397327

workflow(wf): Generate Phase 3 tasks for IW-399 ... 4581f65ad8

Release publishing + verify

Artifacts:
- phase-03-tasks.md

🤖 Generated with Claude Code

chore(IW-399): update review-state to tasks_ready d15b09eb4b

feat(IW-399): move release publishing from gh/GitHub to Forgejo (Phase 3, groups C+D) ... f4581fa594

Rewrite the release production side off GitHub. New shared REST helper
scripts/forgejo-release.sh does create-or-clobber Forgejo release publishing
(idempotent, loud on non-2xx), reused by both the workflow and the local script.

- release.yml: versioned + vlatest publish steps gh -> forgejo-release.sh (REST),
  using the FORGEJO_RELEASE_TOKEN secret. vlatest git tag force-move keeps the
  auto-token. Phase-2 container/credentials block untouched.
- release-prepare.sh: gh pr -> fj pr; drop gh-auth gate; reword PR body.
- release-publish.sh: break-glass fallback via REST; SHA-pin via explicit
  tag-at-MAIN_SHA; github.com URLs -> code.iterative.works.
- RELEASE.md: tag-triggered workflow is the primary path; local publish demoted
  to break-glass; prereq gh -> fj + FORGEJO_RELEASE_TOKEN.

Probe-driven pivot: the runner auto-token 403s on the Forgejo 11.0.8 releases API
(no releases scope; forgejo-actions id -2 lacks release-unit write on the private
org), so publishing requires a maintainer/bot token secret. The no-PAT plan is
superseded; recorded in analysis DECISION + phase-03 context/tasks. Resolved
CLARIFY C1/C2/C3/D1.

🤖 Generated with Claude Code

mph added 1 commit 2026-07-15 19:25:24 +00:00

chore(IW-399): update review-state to implementing 7f8c403021

mph added 3 commits 2026-07-24 09:39:03 +00:00

fix(IW-399): add rsync to CI image (release build needs it) ... f13a698ff2

package-release.sh:65 uses rsync to stage command *.scala files into the
release tarball. The iw-cli-ci image lacked rsync, so release.yml's build
step failed with exit 127 (rsync: command not found) before publish —
blocking every tag-triggered release. GitHub-hosted ubuntu-latest ships
rsync; this restores that parity. Also asserted in the image verify step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(IW-399): bump CI image scala-cli 1.12.5 -> 1.15.0 ... 7cdd86d1a4

scala-cli 1.12.5's Bloop launcher resolves Bloop's own dependencies from
repo.scala-lang.org/.../maven-nightlies, which has purged the versions it
wants (gigahorse-core_2.12 0.9.3, util-interface 1.11.7, zinc/compiler-bridge
2.12 1.12.0). A cold-cache container can no longer start Bloop, so any fresh
image build fails every scala-cli compile. 1.15.0's Bloop deps are still
present there, so it compiles cold. Verified: real core/ compile (-Werror)
succeeds cold through the maven mirror in the rebuilt image.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(IW-399): release packaging false 'missing core/project.scala' error ... a0733b83b2

The tarball validation piped tar into 'grep -q'. grep -q exits on first
match, SIGPIPE-killing tar; under 'set -o pipefail' the pipeline then
returns non-zero and the guard fires even though core/project.scala is
present (it sorts early in the listing, so grep matches and exits before
tar finishes). Run tar to completion first, then grep a here-string.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

mph added 3 commits 2026-07-24 19:50:24 +00:00

fix(IW-399): address Phase 3 code-review findings ... 73ec428c75

forgejo-release.sh: clobber now deletes ALL existing assets of a given
name, not just the first — Forgejo does not enforce unique attachment
names, so a duplicate from an interrupted run or a legacy asset would
otherwise never converge to one.

release.yml:
- Scope the tag trigger to v[0-9]* (real version tags) so the rolling
  'vlatest' tag no longer matches. A break-glass 'git push vlatest'
  (maintainer credentials, not the recursion-suppressed auto-token) would
  otherwise retrigger the workflow with VERSION=latest and publish junk.
- checkout fetch-depth: 0 so the workflow_dispatch path's 'git describe
  --tags' can resolve the latest tag (a shallow checkout fetches no tags).

RELEASE.md: correct the checklist — the versioned release carries only
iw-cli-<version>.tar.gz; iw-bootstrap ships on the vlatest release.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs(IW-399): Phase 3 complete — implementation log, tasks index, AC ... 195377a13c

Record Phase 3 (release publishing → Forgejo, groups C+D+F): the rewrite,
the Tier-2 authenticated E2E, the three release-blockers it surfaced
(rsync / scala-cli 1.15.0 / package-release SIGPIPE), and the code-review
findings addressed. Mark Phase 3 done in the tasks index; correct the
'package-release.sh unchanged' acceptance line (an orthogonal SIGPIPE fix
landed).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(IW-399): update review-state to all_complete ba067be0da

mph changed title from WIP: IW-399 — Move installation and releases to code.iterative.works to IW-399 — Move installation and releases to code.iterative.works 2026-07-26 06:37:35 +00:00

mph merged commit ccef805ed6 into main 2026-07-26 06:37:54 +00:00

mph referenced this pull request from a commit 2026-07-26 06:37:55 +00:00

Merge pull request 'IW-399 — Move installation and releases to code.iterative.works' (#408) from IW-399 into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something isn't working

  

contract

Run the tool-contract suite on this PR

  

documentation

Improvements or additions to documentation

  

duplicate

This issue or pull request already exists

  

enhancement

New feature or request

  

good first issue

Good for newcomers

  

help wanted

Extra attention is needed

  

invalid

This doesn't seem right

  

question

Further information is requested

  

wontfix

This will not be worked on

No labels

bug

contract

documentation

duplicate

enhancement

good first issue

help wanted

invalid

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

iterative-works/iw-cli!408

No description provided.