Run release workflow in aos dev-base #209

New issue

Closed

opened 2026-07-09 03:51:59 +00:00 by coilyco-ops · 3 comments

coilyco-ops commented

2026-07-09 03:51:59 +00:00

Member

The dev-base scan found .forgejo/workflows/release.yml running shared agentic-os release composite actions on the minimal docker runner. Those composite actions are being hardened separately, but the consuming job should also run in the pinned aos dev-base image so jq/curl/git are already present.

Acceptance criteria:

Add the pinned aos dev-base container to the Forgejo release job.
Preserve tag-bump/create-release outputs and release semantics.
Keep existing CI jobs unchanged where they already run in dev-base.
Coordinate with the shared composite action hardening in agentic-os.

The dev-base scan found `.forgejo/workflows/release.yml` running shared `agentic-os` release composite actions on the minimal `docker` runner. Those composite actions are being hardened separately, but the consuming job should also run in the pinned aos dev-base image so jq/curl/git are already present. Acceptance criteria: * Add the pinned aos dev-base container to the Forgejo release job. * Preserve tag-bump/create-release outputs and release semantics. * Keep existing CI jobs unchanged where they already run in dev-base. * Coordinate with the shared composite action hardening in `agentic-os`.

coilyco-ops commented

2026-07-09 03:54:00 +00:00

Author

Member

🔒 Reserved by ward agent --harness codex — container engineer-codex-cli-guard-209 on host kais-macbook-pro-2.local is carrying this issue (reserved 2026-07-09T03:53:58Z). Concurrent ward agent runs are blocked until it finishes or the reservation goes stale (1h TTL); --force overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/cli-guard#209 · branch issue-209 · harness codex · workflow pr
Run: engineer-codex-cli-guard-209 · ward v0.470.0 · dispatched 2026-07-09T03:53:58Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.470.0).

— Codex, via ward agent

🔒 Reserved by `ward agent --harness codex` — container `engineer-codex-cli-guard-209` on host `kais-macbook-pro-2.local` is carrying this issue (reserved 2026-07-09T03:53:58Z). Concurrent `ward agent` runs are blocked until it finishes or the reservation goes stale (1h TTL); `--force` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh** — that is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/cli-guard#209` · branch `issue-209` · harness `codex` · workflow `pr` - **Run:** `engineer-codex-cli-guard-209` · ward `v0.470.0` · dispatched `2026-07-09T03:53:58Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.470.0). </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-09 03:56:15 +00:00

Run release workflow in aos dev-base #210

coilyco-ops commented

2026-07-09 03:56:25 +00:00

Author

Member

WARD-OUTCOME: done - pinned the release job to the aos dev-base image
Review gate: skipped because --skip-preflight / --no-preflight also skips review.
This was a small, clean change. The only thing I had to confirm was that the release job should reuse the same pinned image the CI jobs already use, and that preserved the tag and release outputs without any extra churn. Confidence is high; no follow-up looks necessary from this side.

WARD-OUTCOME: done - pinned the release job to the aos dev-base image Review gate: skipped because --skip-preflight / --no-preflight also skips review. This was a small, clean change. The only thing I had to confirm was that the release job should reuse the same pinned image the CI jobs already use, and that preserved the tag and release outputs without any extra churn. Confidence is high; no follow-up looks necessary from this side.

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-09 03:56:33 +00:00

ward salvage: ward-salvage/cli-guard-a8e13cf8 #211

coilyco-ops commented

2026-07-09 03:56:34 +00:00

Author

Member

⚠️ Reopened: this run's work did not land on `main`

An ephemeral ward container (codex mode) dispatched for this issue finished but its work was not merged to main, so the reaper preserved it on a branch before teardown and reopened the issue (a closing reference for #209 never reached main). Recover from the salvage branch below.

Repo: coilyco-flight-deck/cli-guard
Salvage branch: ward-salvage/cli-guard-a8e13cf8
Pull request: not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input
Reason: run workflow does not land on main (--workflow pr/patch-only)
Container uptime at reap: 2m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token)

Reap diagnostics

--- reap diagnostics ---
ward version:      v0.470.0
version source:    pinned via WARD_VERSION/--ward-version (v0.470.0)
HEAD:              760ac3798033
origin/main:       a90604c56b17
ancestry:          HEAD is NOT yet on origin/main - residual work remains to land
decision gate:     workflow does not land on main (--workflow pr/patch-only)
reason:            run workflow does not land on main (--workflow pr/patch-only)
provenance:        not read (workflow hold)
run-owned landed:  no
working tree:      clean
container uptime:  2m (baked Forgejo PAT age proxy)
--- end reap diagnostics ---

Recover

git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard.git ward-salvage/cli-guard-a8e13cf8
git checkout -b ward-salvage/cli-guard-a8e13cf8 FETCH_HEAD

— Codex, via ward agent

## ⚠️ Reopened: this run's work did not land on `main` An ephemeral `ward container` (codex mode) dispatched for this issue finished but its work was **not merged to `main`**, so the reaper preserved it on a branch before teardown and reopened the issue (a closing reference for #209 never reached `main`). Recover from the salvage branch below. - **Repo:** `coilyco-flight-deck/cli-guard` - **Salvage branch:** `ward-salvage/cli-guard-a8e13cf8` - **Pull request:** not opened - PR creation failed: forgejo: parse created pull request: unexpected end of JSON input - **Reason:** run workflow does not land on main (--workflow pr/patch-only) - **Container uptime at reap:** 2m (age of the baked Forgejo PAT snapshot; a long-lived container is likelier to carry a rotated token) ## Reap diagnostics ``` --- reap diagnostics --- ward version: v0.470.0 version source: pinned via WARD_VERSION/--ward-version (v0.470.0) HEAD: 760ac3798033 origin/main: a90604c56b17 ancestry: HEAD is NOT yet on origin/main - residual work remains to land decision gate: workflow does not land on main (--workflow pr/patch-only) reason: run workflow does not land on main (--workflow pr/patch-only) provenance: not read (workflow hold) run-owned landed: no working tree: clean container uptime: 2m (baked Forgejo PAT age proxy) --- end reap diagnostics --- ``` ## Recover ```bash git fetch https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard.git ward-salvage/cli-guard-a8e13cf8 git checkout -b ward-salvage/cli-guard-a8e13cf8 FETCH_HEAD ```  — Codex, via `ward agent`

coilyco-ops closed this issue

2026-07-09 15:51:39 +00:00