yonlu
7be4a02e31
Second defect in the same workflow. The shell fix took -- the step ran under `bash --noprofile --norc -e -o pipefail` -- and got one layer further before failing: curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt ubuntu:24.04 ships no CA bundle, and --no-install-recommends skips the ca-certificates that curl recommends, so curl came up unable to verify TLS against our own Gitea. This was avoidable by reading the repo rather than reasoning about it: ci.yml (twice), desktop-assets.yml, android-apk.yml and release.yml all spell out `ca-certificates curl ... jq` for exactly this reason. The convention was written down five times already. Validated in the real image this time rather than by extracting the script and running it on the host, which is what missed this: the step now succeeds inside `docker run ubuntu:24.04` against a scratch issue -- label present, 204, label gone -- and the previous version reproduces `curl: (77)` in the same image. Both checked, then the scratch issue was deleted. The DELETE also keeps its response body now and prints it on a non-204. Whether the automatic token carries issue-write scope is still unproven, because both failures happened before the API call, and "403" without Gitea's own sentence would cost another merge to interpret. Closes #102
108 lines
4.5 KiB
YAML
108 lines
4.5 KiB
YAML
name: Unclaim
|
|
|
|
# A `Closes #N` footer in a commit body closes the issue on merge — and
|
|
# leaves `Status/In Progress` on it, because Gitea's auto-close touches
|
|
# state and nothing else. So #100 was closed and simultaneously marked
|
|
# as being actively worked on, and `scripts/issue.sh close` (which does
|
|
# drop the label) is exactly the thing the footer exists to avoid
|
|
# calling.
|
|
#
|
|
# **This hooks the close, not the merge.** Stripping the label in the
|
|
# PR would work and would be a per-PR habit; habits are what the footer
|
|
# removed. `issues: [closed]` covers every path an issue can close by —
|
|
# the footer on merge, `issue.sh close`, someone clicking Close in the
|
|
# web UI — and asks nothing of anyone at any of them.
|
|
#
|
|
# **Reopening deliberately does not restore it.** Reopening says the
|
|
# work was not finished, not that somebody is at a keyboard doing it
|
|
# now; the claim gets re-made by whoever picks it up.
|
|
#
|
|
# **This is not instant, and should not be described as it.** The
|
|
# runner has capacity 1 and is shared with an index build that can hold
|
|
# it for three hours, so a label tweak can queue behind one. Stale for
|
|
# an afternoon beats stale forever, which is what it was.
|
|
#
|
|
# The audit that answers "is this still firing" stays in CLAUDE.md and
|
|
# is one command:
|
|
#
|
|
# ./scripts/issue.sh list --state closed --label "Status/In Progress"
|
|
#
|
|
# A workflow that silently stops working is the failure mode this whole
|
|
# area has already produced once.
|
|
|
|
on:
|
|
issues:
|
|
types: [closed]
|
|
|
|
jobs:
|
|
unclaim:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: ubuntu:24.04
|
|
|
|
steps:
|
|
- name: Drop the claim label
|
|
# **Inside a container the act runner selects `sh`, not bash**, so
|
|
# `set -o pipefail` fails the job on its second line with "Illegal
|
|
# option" and the step never reaches the API. `homebrew-formula.yml`
|
|
# carries the same `set -euo pipefail` without trouble because it
|
|
# runs with **no container**, on the host image where bash is the
|
|
# default — so "another workflow does it" is not evidence here.
|
|
shell: bash
|
|
env:
|
|
# The automatic Actions token, as release.yml uses for the
|
|
# floor tag. It needs no more than write access to this repo.
|
|
TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
|
|
ISSUE: ${{ github.event.issue.number }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
# `ca-certificates` is named because `--no-install-recommends`
|
|
# skips it, and `ubuntu:24.04` ships no CA bundle of its own —
|
|
# so curl comes up unable to verify TLS against our own Gitea
|
|
# and fails with "error setting certificate file" (exit 77).
|
|
# Every other containerised workflow here spells it out for the
|
|
# same reason; this one did not, and cost a release cycle.
|
|
apt-get update -qq
|
|
apt-get install -y -qq --no-install-recommends \
|
|
ca-certificates curl jq >/dev/null
|
|
|
|
label_id=$(
|
|
curl -sSf -H "Authorization: token $TOKEN" "$API/labels?limit=100" |
|
|
jq -r '.[] | select(.name == "Status/In Progress") | .id'
|
|
)
|
|
|
|
# The label not existing is a repo somebody reorganised, not a
|
|
# failure of this run — say so and stop, rather than failing a
|
|
# job on every close from then on.
|
|
if [ -z "$label_id" ]; then
|
|
echo "unclaim: no 'Status/In Progress' label in this repo; nothing to do"
|
|
exit 0
|
|
fi
|
|
|
|
# DELETE is idempotent here: an issue that never carried the
|
|
# label answers the same as one that did, which is what makes
|
|
# this safe to run on *every* close rather than only the ones
|
|
# that were claimed.
|
|
# The body is captured, not discarded, so a refusal is
|
|
# diagnosable from this log alone. Whether the automatic
|
|
# token carries issue-write scope is still unproven, and
|
|
# "DELETE returned 403" without Gitea's own sentence costs
|
|
# another merge to find out which of the two it is.
|
|
body=$(mktemp)
|
|
code=$(
|
|
curl -sS -o "$body" -w '%{http_code}' -X DELETE \
|
|
-H "Authorization: token $TOKEN" \
|
|
"$API/issues/$ISSUE/labels/$label_id"
|
|
)
|
|
|
|
case "$code" in
|
|
204) echo "unclaim: #$ISSUE is closed and unclaimed" ;;
|
|
*)
|
|
echo "unclaim: DELETE returned $code for #$ISSUE" >&2
|
|
cat "$body" >&2
|
|
exit 1
|
|
;;
|
|
esac
|