release: bump-formula job has failed on every release since run 33 #103

New issue

Open

opened 2026-05-27 00:14:48 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-27 00:14:48 +00:00

Owner

Problem

The bump-formula job in .forgejo/workflows/release.yml has failed on every release since run #33 (sha 21072fd, 2026-05-25). All subsequent releases (#34, #35, #36, #37, #38, #39) ship with release: success + bump-formula: failure.

The Forgejo bump-formula job is the equivalent of the dispatch to coilysiren/homebrew-tap from the old GitHub pipeline. With it failing, Formula/coily.rb is not getting the new tag/revision pinned automatically. Every released version since v2.38.0 has only stayed installable via brew upgrade coily because the formula in this repo is what brew reads (forgejo direct-repo tap), and there is one in-repo source of truth - but the pin still isn't refreshing on its own, so brew install users are getting whichever revision was hand-edited last.

(Confirming: most recent commit to Formula/coily.rb is git log -1 --format=%h Formula/coily.rb - need to verify drift between formula pin and current tag.)

Symptom

bump-formula job exits within ~7s of starting on every release run. Failure happens before any visible step output in the API summary. Job is reproducibly red - this is a stable bug, not a flake.

Likely cause (verify against Forgejo UI logs, which aren't exposed via the API in this version)

The coilysiren/agentic-os/actions/bump-formula@main composite was the third action ported as part of coilysiren/coily#80. The likely culprits, ranked:

Forgejo's auto-issued ${{ github.token }} (passed implicitly to the composite) lacks the repository: contents:write scope needed to commit Formula/coily.rb back to main. The release and new windows-assets jobs only need read+release; they work. The formula commit needs write-to-main, which may be gated separately.
The composite calls the Forgejo Contents API to update Formula/coily.rb, and the existing file SHA lookup is failing because the composite was written against the GitHub Contents API shape and never re-tested against Forgejo.
git push from inside the composite is being rejected by a branch protection rule on main (rulesets applied via agentic-os/scripts/rulesets/default.json).

Repro

Any push to main triggers the workflow. bump-formula will fail in ~7s.

Inspect the UI: https://forgejo.coilysiren.me/coilysiren/coily/actions/runs/39 (run number 39, latest as of filing).

Fix sequence

Read the actual failure log from the Forgejo UI (API doesn't expose logs in this version).
If it's the token scope: either escalate the workflow's permissions: block or set a PAT secret and pass it explicitly.
If it's the API shape: fix the composite in coilysiren/agentic-os/actions/bump-formula/action.yml and re-run.
If it's branch protection: bypass via a deploy key or the release rule's actor allowlist.

Why now

Now that the Windows release assets are landing correctly (#102 closed), the bump-formula failure is the only red on every release. It also means the brew install path is silently drifting from the tag. Worth fixing before the scoop-bucket cutover so the full release pipeline is green.

Out of scope

Migrating bump-formula away from a composite to in-line.
Replacing the brew tap with a different distribution channel.

**Problem** The `bump-formula` job in `.forgejo/workflows/release.yml` has failed on every release since run #33 (sha `21072fd`, 2026-05-25). All subsequent releases (#34, #35, #36, #37, #38, #39) ship with `release: success` + `bump-formula: failure`. The Forgejo `bump-formula` job is the equivalent of the dispatch to `coilysiren/homebrew-tap` from the old GitHub pipeline. With it failing, `Formula/coily.rb` is not getting the new tag/revision pinned automatically. Every released version since v2.38.0 has only stayed installable via `brew upgrade coily` because the formula in this repo is what brew reads (forgejo direct-repo tap), and there is one in-repo source of truth - but the pin still isn't refreshing on its own, so `brew install` users are getting whichever revision was hand-edited last. (Confirming: most recent commit to `Formula/coily.rb` is `git log -1 --format=%h Formula/coily.rb` - need to verify drift between formula pin and current tag.) **Symptom** `bump-formula` job exits within ~7s of starting on every release run. Failure happens before any visible step output in the API summary. Job is reproducibly red - this is a stable bug, not a flake. **Likely cause** (verify against Forgejo UI logs, which aren't exposed via the API in this version) The `coilysiren/agentic-os/actions/bump-formula@main` composite was the third action ported as part of `coilysiren/coily#80`. The likely culprits, ranked: 1. Forgejo's auto-issued `${{ github.token }}` (passed implicitly to the composite) lacks the `repository: contents:write` scope needed to commit `Formula/coily.rb` back to main. The `release` and new `windows-assets` jobs only need read+release; they work. The formula commit needs write-to-main, which may be gated separately. 2. The composite calls the Forgejo Contents API to update `Formula/coily.rb`, and the existing file SHA lookup is failing because the composite was written against the GitHub Contents API shape and never re-tested against Forgejo. 3. `git push` from inside the composite is being rejected by a branch protection rule on `main` (rulesets applied via `agentic-os/scripts/rulesets/default.json`). **Repro** Any push to main triggers the workflow. `bump-formula` will fail in ~7s. Inspect the UI: https://forgejo.coilysiren.me/coilysiren/coily/actions/runs/39 (run number 39, latest as of filing). **Fix sequence** 1. Read the actual failure log from the Forgejo UI (API doesn't expose logs in this version). 2. If it's the token scope: either escalate the workflow's `permissions:` block or set a PAT secret and pass it explicitly. 3. If it's the API shape: fix the composite in `coilysiren/agentic-os/actions/bump-formula/action.yml` and re-run. 4. If it's branch protection: bypass via a deploy key or the `release` rule's actor allowlist. **Why now** Now that the Windows release assets are landing correctly (`#102` closed), the bump-formula failure is the only red on every release. It also means the brew install path is silently drifting from the tag. Worth fixing before the scoop-bucket cutover so the full release pipeline is green. **Out of scope** - Migrating bump-formula away from a composite to in-line. - Replacing the brew tap with a different distribution channel.

coilysiren referenced this issue

2026-05-30 05:43:12 +00:00

release automation: bump-formula fails every run and push did not trigger a new run #137

coilysiren added the

label

2026-05-31 01:52:39 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-bridge/coily#103

No description provided.

Rows
Columns