Compare commits

...
4 Commits
Author SHA1 Message Date
mathias 6c1b6ce9db chore(release): plugin.json version 0.4.2
Skip-Release: true
2026-08-24 15:31:15 +00:00
mathiasandClaude Opus 5 5c8341c797 fix(mcp): drop the gitea server — it was a redundant, silently stale copy
release / tag (push) Successful in 2s
Every gitea__* call from Claude Code on koala already resolves through the
claude.ai connector, not through this env-var-authenticated HTTP server. The
entry was a second path to the same service that nothing actually used.

That redundancy is exactly why it rotted unnoticed. GITEA_MCP_TOKEN on koala
resolves ~/.op-env -> op://HomeLab/GITEA_MCP_TOKEN, an item orphaned by the
2026-07-30 consolidation that moved gitea-mcp, agentsquad-serve and
crush-runner onto a single shared item in the AgentSecrets vault. The host
env-file was never migrated and cannot be: koala's 1Password service account
has no access to AgentSecrets, while onepassword-connect in-cluster maps both
vaults. So the host copy diverged and stayed diverged for five days.

The cluster was never affected — zero 401s from the pod CIDR in 30 days, every
rejection came from the gateway. Deleting the divergent copy beats maintaining
a second source of truth for a token this host does not need.

brain stays: it authenticates, and it is genuinely used from the plugin.
infra stays but is currently unreachable for an unrelated reason —
infra-mcp.d-ma.be fails TLS with "unrecognized name", an SNI/cert gap at the
NPM edge, tracked separately.

Bump-Type: patch

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
2026-08-24 17:31:11 +02:00
mathias 5ca44c9c6b chore(release): plugin.json version 0.4.1
Skip-Release: true
2026-08-23 12:39:55 +00:00
mathiasandClaude Opus 5 e2a312d05e fix(ci): anchor the release-skip marker to a trailer, and test it
release / tag (push) Successful in 1s
The tagger searched the entire commit message for a bracketed marker as a
substring. The commit that introduced the manifest-bump step described that
marker in its own body — so the tagger read its own documentation as an
instruction and skipped the release. Run 15 reported success with no tag, no
manifest bump and no error. Same failure family as everything else in this
sweep: the wrong thing happened silently.

The rule is now a git trailer matched anchored to its own line, consistent
with Bump-Type, and it lives in bin/should-skip-release rather than untested
inside YAML. tests/release_skip_test.sh pins six cases, including the exact
regression: a message that spells the marker out in prose must still tag.

A marker you cannot mention without triggering is a footgun, not a mechanism.

Bump-Type: patch

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BeAp5LTscnz2W7Ubt4eJ6m
2026-08-23 14:39:31 +02:00
5 changed files with 93 additions and 12 deletions
+1 -1
View File
@@ -1,7 +1,7 @@
{ {
"name": "skills", "name": "skills",
"description": "Mathias's engineering skills library, plus the hooks and MCP servers that make it enforceable: TDD, clean code, debugging, specs, discovery, CI, and secret hygiene.", "description": "Mathias's engineering skills library, plus the hooks and MCP servers that make it enforceable: TDD, clean code, debugging, specs, discovery, CI, and secret hygiene.",
"version": "0.3.3", "version": "0.4.2",
"author": { "author": {
"name": "Mathias", "name": "Mathias",
"url": "https://git.d-ma.be/mathias" "url": "https://git.d-ma.be/mathias"
+6 -4
View File
@@ -30,8 +30,10 @@ jobs:
run: | run: |
set -euo pipefail set -euo pipefail
last_commit=$(git log -1 --pretty=%B) last_commit=$(git log -1 --pretty=%B)
if printf '%s' "$last_commit" | grep -qi '\[skip-release\]'; then # Delegated to bin/should-skip-release so the rule is covered by
echo "skipping — commit marked [skip-release]" # tests/release_skip_test.sh rather than living untested in YAML.
if printf '%s\n' "$last_commit" | sh bin/should-skip-release; then
echo "skipping — commit carries the Skip-Release trailer"
echo "skip=true" >> "$GITHUB_OUTPUT" echo "skip=true" >> "$GITHUB_OUTPUT"
exit 0 exit 0
fi fi
@@ -73,8 +75,8 @@ jobs:
if [ "$current" != "$version" ]; then if [ "$current" != "$version" ]; then
sed -i "s/\"version\"[[:space:]]*:[[:space:]]*\"$current\"/\"version\": \"$version\"/" "$manifest" sed -i "s/\"version\"[[:space:]]*:[[:space:]]*\"$current\"/\"version\": \"$version\"/" "$manifest"
git add "$manifest" git add "$manifest"
# [skip-release] stops this push from re-triggering the tagger. # The trailer below stops this push from re-triggering the tagger.
git commit -m "chore(release): plugin.json version $version [skip-release]" git commit -m "chore(release): plugin.json version $version" -m "Skip-Release: true"
git push origin HEAD:main git push origin HEAD:main
echo "bumped $manifest to $version" echo "bumped $manifest to $version"
fi fi
-7
View File
@@ -7,13 +7,6 @@
"Authorization": "Bearer ${BRAIN_MCP_TOKEN}" "Authorization": "Bearer ${BRAIN_MCP_TOKEN}"
} }
}, },
"gitea": {
"type": "http",
"url": "https://git-mcp.d-ma.be/mcp",
"headers": {
"Authorization": "Bearer ${GITEA_MCP_TOKEN}"
}
},
"infra": { "infra": {
"type": "http", "type": "http",
"url": "https://infra-mcp.d-ma.be/mcp" "url": "https://infra-mcp.d-ma.be/mcp"
+25
View File
@@ -0,0 +1,25 @@
#!/bin/sh
# should-skip-release — reads a commit message on stdin. Exits 0 when the
# release tagger should skip this commit, 1 when it should tag.
#
# Skipping is opt-in via a git trailer:
#
# Skip-Release: true
#
# It is a TRAILER, matched anchored to its own line, deliberately. The first
# version searched the whole message for a bracketed marker as a substring,
# and the very commit that introduced the manifest-bump step described that
# marker in its body — so the tagger read its own documentation as an
# instruction and skipped the release. Success, no tag, no bump, no error
# (run 15, 2026-08-23). A marker you cannot mention without triggering is a
# footgun, not a mechanism.
set -u
msg=$(cat)
if printf '%s\n' "$msg" | grep -qiE '^[[:space:]]*Skip-Release:[[:space:]]*true[[:space:]]*$'; then
exit 0
fi
exit 1
+61
View File
@@ -0,0 +1,61 @@
#!/bin/sh
# Tests for bin/should-skip-release.
#
# The regression these exist for: an unanchored substring match let a commit
# that merely *described* the skip marker skip its own release.
set -u
ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
SUT="$ROOT/bin/should-skip-release"
pass=0
fail=0
if [ ! -f "$SUT" ]; then
printf 'FAIL: %s does not exist\n' "$SUT"
exit 1
fi
# expect <skip|tag> <label> <<message on stdin>>
expect() {
_want=$1
_label=$2
_msg=$3
printf '%s\n' "$_msg" | sh "$SUT"
_rc=$?
if [ "$_want" = skip ]; then _wrc=0; else _wrc=1; fi
if [ "$_rc" -eq "$_wrc" ]; then
pass=$((pass + 1)); printf ' ok %s\n' "$_label"
else
fail=$((fail + 1)); printf ' FAIL %s (want %s, rc=%s)\n' "$_label" "$_want" "$_rc"
fi
}
expect skip 'trailer on its own line' 'chore(release): bump
Skip-Release: true'
expect skip 'trailer, case-insensitive' 'chore: x
skip-release: TRUE'
expect tag 'ordinary commit' 'feat: add a thing
Bump-Type: minor'
# --- the actual regression -------------------------------------------------
expect tag 'prose MENTIONING the marker must still tag' 'docs+ci: document the release flow
CI commits the manifest bump with a Skip-Release: true trailer so it does
not re-trigger the tagger. The old [skip-release] marker was a substring
match, which is exactly why this commit would have skipped itself.
Bump-Type: patch'
expect tag 'legacy bracketed marker no longer skips' 'chore: something [skip-release]'
expect tag 'empty message' ''
printf '\nrelease_skip: %d passed, %d failed\n' "$pass" "$fail"
[ "$fail" -eq 0 ]