Bound release composite action dependency installs and API calls #354

New issue

Closed

opened 2026-07-09 03:41:39 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-09 03:41:39 +00:00

Member

Ward release run 1130 hung in the coilysiren/agentic-os/actions/create-release@main step on 2026-07-09. The action usually completes in about a minute, but this run sat for 5+ minutes and continued running beyond 13 minutes. The action currently self-installs jq with unbounded apt-get update/install or apk add, then calls Forgejo release APIs with unbounded curl. That makes transient package mirror or Forgejo/API stalls look like a silent CI hang.

Acceptance criteria:

Harden actions/create-release/action.yml so dependency setup and release API calls are bounded with explicit timeouts and useful progress/error output.
Prefer avoiding package-manager install in the hot path if the runner has a simpler JSON marshalling tool available; keep a bounded fallback for minimal images.
Apply the same pattern to sibling release actions that self-install jq, especially actions/upload-release-asset and actions/bump-formula, or explain why they differ.
Keep the actions idempotent and compatible with Forgejo Actions composite-action execution.
Add or update docs/tests if the repo has an existing action validation convention.

Ward release run 1130 hung in the `coilysiren/agentic-os/actions/create-release@main` step on 2026-07-09. The action usually completes in about a minute, but this run sat for 5+ minutes and continued running beyond 13 minutes. The action currently self-installs `jq` with unbounded `apt-get update/install` or `apk add`, then calls Forgejo release APIs with unbounded `curl`. That makes transient package mirror or Forgejo/API stalls look like a silent CI hang. Acceptance criteria: * Harden `actions/create-release/action.yml` so dependency setup and release API calls are bounded with explicit timeouts and useful progress/error output. * Prefer avoiding package-manager install in the hot path if the runner has a simpler JSON marshalling tool available; keep a bounded fallback for minimal images. * Apply the same pattern to sibling release actions that self-install `jq`, especially `actions/upload-release-asset` and `actions/bump-formula`, or explain why they differ. * Keep the actions idempotent and compatible with Forgejo Actions composite-action execution. * Add or update docs/tests if the repo has an existing action validation convention.

coilyco-ops referenced this issue from coilyco-flight-deck/ward

2026-07-09 03:45:01 +00:00

Run ward release composite-action jobs on aos dev-base #757

coilyco-ops commented

2026-07-09 03:45:10 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-agentic-os-354 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-09T03:45:08Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/agentic-os#354 · branch issue-354 · harness codex · workflow pr
Run: engineer-codex-agentic-os-354 · ward v0.470.0 · dispatched 2026-07-09T03:45:08Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.470.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-agentic-os-354` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-09T03:45:08Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/agentic-os#354` · branch `issue-354` · harness `codex` · workflow `pr` - **Run:** `engineer-codex-agentic-os-354` · ward `v0.470.0` · dispatched `2026-07-09T03:45:08Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.470.0). </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-09 03:58:30 +00:00

fix: bound release action installs and API calls #357

coilyco-ops commented

2026-07-09 03:58:56 +00:00

Author

Member

WARD-OUTCOME: done - bounded the Forgejo release action installs and API calls
Review: skipped because --skip-preflight / --no-preflight also skips review.
The change settled into a shared helper after the first pass. The main friction was the docs size cap, plus the container's root-owned ward home cache, both of which were straightforward to work around. Confidence is high; no follow-up looks necessary right now.

WARD-OUTCOME: done - bounded the Forgejo release action installs and API calls Review: skipped because --skip-preflight / --no-preflight also skips review. The change settled into a shared helper after the first pass. The main friction was the docs size cap, plus the container's root-owned ward home cache, both of which were straightforward to work around. Confidence is high; no follow-up looks necessary right now.

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-09 03:59:10 +00:00

ward salvage: ward-salvage/agentic-os-13a8951a #358

coilyco-ops commented

2026-07-09 03:59:11 +00:00

Author

Member

⚠️ Reopened: this run's work did not land on `main`

An ephemeral ward container (codex mode) dispatched for this issue finished but its work was not merged to main, so the reaper preserved it on a branch before teardown and reopened the issue (a closing reference for #354 never reached main). Recover from the salvage branch below.

Repo: coilyco-flight-deck/agentic-os
Salvage branch: ward-salvage/agentic-os-13a8951a
Pull request: not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input
Reason: run workflow does not land on main (--workflow pr/patch-only)
Container uptime at reap: 13m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token)

Reap diagnostics

--- reap diagnostics ---
ward version:      v0.470.0
version source:    pinned via WARD_VERSION/--ward-version (v0.470.0)
HEAD:              956be1ac948b
origin/main:       ae3677c83d75
ancestry:          HEAD is NOT yet on origin/main - residual work remains to land
decision gate:     workflow does not land on main (--workflow pr/patch-only)
reason:            run workflow does not land on main (--workflow pr/patch-only)
provenance:        not read (workflow hold)
run-owned landed:  no
working tree:      clean
container uptime:  13m (baked Forgejo PAT age proxy)
--- end reap diagnostics ---

Recover

git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os.git ward-salvage/agentic-os-13a8951a
git checkout -b ward-salvage/agentic-os-13a8951a FETCH_HEAD

— Codex, via ward agent

## ⚠️ Reopened: this run's work did not land on `main` An ephemeral `ward container` (codex mode) dispatched for this issue finished but its work was **not merged to `main`**, so the reaper preserved it on a branch before teardown and reopened the issue (a closing reference for #354 never reached `main`). Recover from the salvage branch below. - **Repo:** `coilyco-flight-deck/agentic-os` - **Salvage branch:** `ward-salvage/agentic-os-13a8951a` - **Pull request:** not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input - **Reason:** run workflow does not land on main (--workflow pr/patch-only) - **Container uptime at reap:** 13m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token) ## Reap diagnostics ``` --- reap diagnostics --- ward version: v0.470.0 version source: pinned via WARD_VERSION/--ward-version (v0.470.0) HEAD: 956be1ac948b origin/main: ae3677c83d75 ancestry: HEAD is NOT yet on origin/main - residual work remains to land decision gate: workflow does not land on main (--workflow pr/patch-only) reason: run workflow does not land on main (--workflow pr/patch-only) provenance: not read (workflow hold) run-owned landed: no working tree: clean container uptime: 13m (baked Forgejo PAT age proxy) --- end reap diagnostics --- ``` ## Recover ```bash git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/agentic-os.git ward-salvage/agentic-os-13a8951a git checkout -b ward-salvage/agentic-os-13a8951a FETCH_HEAD ```  — Codex, via `ward agent`

coilyco-ops closed this issue

2026-07-09 05:01:31 +00:00