Remove the scheduled dev-base dependency auto-bump #966

New issue

Closed

opened 2026-08-07 01:00:57 +00:00 by coilyco-ops · 1 comment

coilyco-ops commented

2026-08-07 01:00:57 +00:00

Member

Remove the scheduled dev-base dependency auto-bump.

Why

It has been more failing than working, and the pins it manages did not stay current in practice. Last green scheduled run was 2026-07-29; every run from 07-30 through 08-06 failed, so every managed pin sat frozen for a week while the workflow reported red daily.

The immediate failure was repaired in dc01d5b3 (it set a repo-local git identity to commit, then ran the gate in the same checkout, and a repo-local identity outranks the isolated global one the git-identity tests stage). So this is a removal by choice, not a removal of something broken.

Surface to remove

.forgejo/workflows/dep-bump.yml - scheduled workflow (09:17 UTC daily)
scripts/dep-bump.py - the resolver and rewriter
scripts/ci/dep-bump.sh - the CI driver
scripts/rotate-dep-bump-token.sh - token rotation helper
tests/test_dep_bump.py
docs/dev-base-auto-bump.md
.ward/ward.yaml - the dep-bump verb (lines 118-120)
docs/dev-base-image.md - the "Pinning a tool" paragraph referencing ward exec dep-bump -- check / -- apply
tests/test_agent_name_gitidentity.py - the cwd=home comment names dep-bump as the polluter; keep the cwd=home isolation itself, it is correct regardless, just reword
.forgejo/workflows/freshness.yml - header comment references dep-bump's :17 cron slot (moot if #965 lands first)

Secrets to retire

DEP_BUMP_TOKEN - coilyco-ops write:repository PAT, only consumer is this workflow
UPSTREAM_GH_TOKEN - optional github.com rate-limit lift; check for other consumers before revoking

Revoke in Forgejo Actions secrets and in SSM, not just in the workflow file.

Consequence to accept deliberately

Every dev-base pin becomes manual-only and will drift silently, with no red run to signal it. Nothing else watches these versions.

The empirical case for what manual-only produces is already in the tree: AOS_VERSION was the one pin with no resolver, precisely because it is this repo's own release train. It drifted 16 minor versions (0.166.0 -> 0.182.0) before anyone noticed, and was caught by hand today rather than by any alarm. WARD_VERSION and AGENT_COMPOSE_VERSION were auto-managed and drifted one and five releases respectively over the same failed week.

That is the trade being made. Post-removal, currency is a recurring human task, so it is worth deciding who owns that cadence and writing it down somewhere durable rather than leaving it implied.

Alternative considered

Keeping it now that dc01d5b3 is in. Rejected per removal request. Noting only that the currency check and the currency automation are separable: ward exec dep-bump -- check is a read-only drift report with no commit, push, or gate, so keeping just that verb as an on-demand audit is available if the scheduled push is the objectionable part rather than the resolvers.

Remove the scheduled dev-base dependency auto-bump. ## Why It has been more failing than working, and the pins it manages did not stay current in practice. Last green scheduled run was **2026-07-29**; every run from 07-30 through 08-06 failed, so every managed pin sat frozen for a week while the workflow reported red daily. The immediate failure was repaired in `dc01d5b3` (it set a repo-local git identity to commit, then ran the gate in the same checkout, and a repo-local identity outranks the isolated global one the git-identity tests stage). So this is a removal by choice, not a removal of something broken. ## Surface to remove * `.forgejo/workflows/dep-bump.yml` - scheduled workflow (09:17 UTC daily) * `scripts/dep-bump.py` - the resolver and rewriter * `scripts/ci/dep-bump.sh` - the CI driver * `scripts/rotate-dep-bump-token.sh` - token rotation helper * `tests/test_dep_bump.py` * `docs/dev-base-auto-bump.md` * `.ward/ward.yaml` - the `dep-bump` verb (lines 118-120) * `docs/dev-base-image.md` - the "Pinning a tool" paragraph referencing `ward exec dep-bump -- check` / `-- apply` * `tests/test_agent_name_gitidentity.py` - the `cwd=home` comment names dep-bump as the polluter; keep the `cwd=home` isolation itself, it is correct regardless, just reword * `.forgejo/workflows/freshness.yml` - header comment references dep-bump's `:17` cron slot (moot if #965 lands first) ## Secrets to retire * `DEP_BUMP_TOKEN` - `coilyco-ops` `write:repository` PAT, only consumer is this workflow * `UPSTREAM_GH_TOKEN` - optional github.com rate-limit lift; **check for other consumers before revoking** Revoke in Forgejo Actions secrets and in SSM, not just in the workflow file. ## Consequence to accept deliberately Every dev-base pin becomes manual-only and will drift silently, with no red run to signal it. Nothing else watches these versions. The empirical case for what manual-only produces is already in the tree: `AOS_VERSION` was the one pin with no resolver, precisely because it is this repo's own release train. It drifted **16 minor versions** (0.166.0 -> 0.182.0) before anyone noticed, and was caught by hand today rather than by any alarm. `WARD_VERSION` and `AGENT_COMPOSE_VERSION` were auto-managed and drifted one and five releases respectively over the same failed week. That is the trade being made. Post-removal, currency is a recurring human task, so it is worth deciding who owns that cadence and writing it down somewhere durable rather than leaving it implied. ## Alternative considered Keeping it now that `dc01d5b3` is in. Rejected per removal request. Noting only that the currency check and the currency *automation* are separable: `ward exec dep-bump -- check` is a read-only drift report with no commit, push, or gate, so keeping just that verb as an on-demand audit is available if the scheduled push is the objectionable part rather than the resolvers.

coilyco-ops referenced this issue from a commit

2026-08-07 02:21:14 +00:00

chore: remove the scheduled dev-base dependency auto-bump (#966)

coilyco-ops referenced this issue

2026-08-07 02:22:05 +00:00

Remove the knowledge-base freshness probe #965

coilyco-ops commented

2026-08-07 02:22:13 +00:00

Author

Member

Landed on main in a795177f.

Removed the listed surface: .forgejo/workflows/dep-bump.yml, scripts/dep-bump.py, scripts/ci/dep-bump.sh, scripts/rotate-dep-bump-token.sh, tests/test_dep_bump.py, docs/dev-base-auto-bump.md, and the dep-bump ward verb. The .forgejo/workflows/freshness.yml cron-slot reference was already moot, #965 landed first in 711ee76f.

Two deviations worth naming:

One cross-link the issue did not list. docs/ci-in-dev-base.md:74 carried a "See also" entry pointing at docs/dev-base-auto-bump.md. Removed, otherwise the dead-cross-links hook would have failed the commit.
docs/dev-base-image.md "Pinning a tool" was reworded, not deleted. The issue asked to remove the paragraph referencing ward exec dep-bump -- check / -- apply. Deleting it outright would have left the section silently implying pins are managed. It now states plainly that every pin is manual, nothing resolves them against upstream, and nothing fails when one falls behind. That is the durable written record the issue asked for on the mechanics. It does not name a cadence owner, which is Kai's call rather than mine to invent.

tests/test_agent_name_gitidentity.py keeps its cwd=home isolation, comment reworded to stop naming dep-bump as the polluter.

Verified zero residual references to dep-bump, dep_bump, DEP_BUMP_TOKEN, UPSTREAM_GH_TOKEN, or dev-base-auto-bump anywhere in the tree.

Open, not done by this change: secret retirement. DEP_BUMP_TOKEN and UPSTREAM_GH_TOKEN still exist in Forgejo Actions secrets and in SSM. Revoking them is a live-credential mutation outside the engineer boundary, so it needs an operator. Within this repo the only consumer of either was the removed workflow, but UPSTREAM_GH_TOKEN still needs a cross-repo consumer check before revocation, per the issue.

Landed on `main` in `a795177f`. Removed the listed surface: `.forgejo/workflows/dep-bump.yml`, `scripts/dep-bump.py`, `scripts/ci/dep-bump.sh`, `scripts/rotate-dep-bump-token.sh`, `tests/test_dep_bump.py`, `docs/dev-base-auto-bump.md`, and the `dep-bump` ward verb. The `.forgejo/workflows/freshness.yml` cron-slot reference was already moot, #965 landed first in `711ee76f`. Two deviations worth naming: * **One cross-link the issue did not list.** `docs/ci-in-dev-base.md:74` carried a "See also" entry pointing at `docs/dev-base-auto-bump.md`. Removed, otherwise the dead-cross-links hook would have failed the commit. * **`docs/dev-base-image.md` "Pinning a tool" was reworded, not deleted.** The issue asked to remove the paragraph referencing `ward exec dep-bump -- check` / `-- apply`. Deleting it outright would have left the section silently implying pins are managed. It now states plainly that every pin is manual, nothing resolves them against upstream, and nothing fails when one falls behind. That is the durable written record the issue asked for on the mechanics. It does **not** name a cadence owner, which is Kai's call rather than mine to invent. `tests/test_agent_name_gitidentity.py` keeps its `cwd=home` isolation, comment reworded to stop naming dep-bump as the polluter. Verified zero residual references to `dep-bump`, `dep_bump`, `DEP_BUMP_TOKEN`, `UPSTREAM_GH_TOKEN`, or `dev-base-auto-bump` anywhere in the tree. **Open, not done by this change:** secret retirement. `DEP_BUMP_TOKEN` and `UPSTREAM_GH_TOKEN` still exist in Forgejo Actions secrets and in SSM. Revoking them is a live-credential mutation outside the engineer boundary, so it needs an operator. Within this repo the only consumer of either was the removed workflow, but `UPSTREAM_GH_TOKEN` still needs a cross-repo consumer check before revocation, per the issue.

coilyco-ops closed this issue

2026-08-07 02:22:25 +00:00

coilyco-ops referenced this issue

2026-08-17 02:56:02 +00:00

Retire or make the dev-base dependency planner fail closed #865