The Gitea Actions runner (ubuntu-latest) uses dash as /bin/sh. The
previous script used #!/bin/bash with 'set -uo pipefail' — pipefail is
bash-only and causes 'set: illegal option -o pipefail' (exit 2) in dash.
This was the root cause of the build job failing in 2 seconds.
Fix: #!/bin/sh with 'set -u' only (no pipefail). Removed bash-only
features. The script is POSIX-compliant.
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
The build job fails with exit 2 but stdout/stderr is not visible in
Gitea Actions logs (CoreCI captures it internally). Add stderr logging
for PATH, go location, and Go env vars. Remove set -e so the script
continues past errors and we can see all output.
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
CoreCI's buildIsolatedEnv does NOT forward GOROOT, GOPATH, GOCACHE,
GOMODCACHE (they're in the systemVars deny-list in pass_through.go).
The shell-isolated executor's env only has PATH, HOME, LANG, TMPDIR,
TERM, CI + CORECI_* + CI_* + job vars. Without GOMODCACHE/GOCACHE, Go
commands fail (can't find module/build cache). Fix: re-derive them from
the go binary on PATH via 'go env GOROOT' etc.
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
CoreCI's ValidateShellCommand (internal/runner/validate.go) rejects
invoke: strings containing &|;`><$() — security measure to prevent
shell injection. The previous .coreci.yml jobs had inline invoke:
commands with || redirects and $(date) substitution, causing:
job "gitleaks" failed: shell command contains forbidden metacharacters
Fix: all complex logic moved to scripts/ci-run.sh. Each .coreci.yml job
uses invoke: "sh scripts/ci-run.sh <job-name>" — no metacharacters in
the invoke: string. The script itself can use any shell features
internally (CoreCI only validates the invoke: field, not what the script
does).
---ci---
project: orca
phase: 1
milestone: v0.16
status: execute
---/ci---
The fallback walk (REQ-098) reassigns VERSION from the requested
release to the nearest older release carrying a binary asset, but
never recomputed TARBALL (set once at line 106 from the requested
version). The stale tarball name then flowed into:
- grep -F "$TARBALL" SHA256SUMS -> matched nothing (the fallback
release's SHA256SUMS only lists the fallback tarball)
- sha256sum -c - -> empty stdin -> "no properly
formatted checksum lines found" -> REQ-132 refusal
- tar -xzf "${TMPDIR}/${TARBALL}" -> would look for the wrong
filename (download saved under the stale name too)
User-visible symptom (v0.14.2 latest had no asset, fell back to
v0.12.18):
install: verifying checksum...
sha256sum: 'standard input': no properly formatted checksum lines found
install: error: checksum verification failed (REQ-132); refusing to install
Fix: recompute TARBALL immediately after VERSION is reassigned in the
fallback branch, so download/grep/sha256sum/tar all reference the
fallback version's tarball. ASSET_URL and SHA256SUMS_URL were already
correct (derived from the API/ASSET_URL); TARBALL was the only stale
variable.
Reproduced the exact error before the fix; confirmed end-to-end
install succeeds after (orca-v0.12.18-linux-amd64.tar.gz: OK ->
extracting -> installed). Added a bats regression test pinning
--version v0.14.2 and asserting the dry-run "would install" line
references the fallback version (not the stale pinned one).
---ci---
project: orca
phase: 1
milestone: v0.15
status: execute
decisions:
- id: D-001
decision: Recompute TARBALL in the fallback branch immediately
after VERSION is reassigned, so grep/sha256sum/tar use the
fallback version's filename instead of the stale requested
version's.
rationale: Reproduced the exact user error ("no properly formatted
checksum lines found") by running grep -F "$TARBALL" SHA256SUMS
| sha256sum -c with a stale v0.14.2 tarball name against v0.12.18
SHA256SUMS. TARBALL is the only stale variable: ASSET_URL and
VERSION are correctly updated from API output, and SHA256SUMS_URL
derives from ASSET_URL. Single-line fix, minimal blast radius,
preserves the working non-fallback path.
confidence: 0.96
alternatives:
- lazy TARBALL via a function (over-engineering for one stale
assignment)
- move TARBALL= assignment past the fallback block (breaks
find_asset_url which needs the requested version's name
pre-walk)
lessons:
- When a fallback/walk mutates one variable (VERSION), audit every
variable derived from it (TARBALL) for the same mutation. The
user-facing info line at 167 constructed the name inline and
looked correct, masking that the variable itself was stale.
---/ci---
Root or writable /usr/local/bin: install there (no PATH edits needed).
Non-root without sudo: fall back to ~/.local/bin + auto-add to .bashrc.
This eliminates the 'NOTE: not on your PATH' message for the common case.
install.sh:
- find_asset_url now matches by asset NAME (python3 JSON parse), not
URL path — Gitea attachment URLs are opaque UUIDs that don't contain
the tarball name. This was the root cause of the v0.12.18 install
failure (asset existed but install.sh couldn't find it).
- find_asset_in_releases walks recent releases by asset name and
returns both URL + version for the fallback walk.
- Handles 404 (tag without release) gracefully via fallback walk.
Dockerfile:
- golang:1.25 -> golang:1.25.12 (go.mod requires 1.25.12; the Docker
image was using patch 0, causing `go mod download` to fail with
"go.mod requires go >= 1.25.12 (running go 1.25.10)")
coreci.yml:
- All golang:1.25 images -> golang:1.25.12
- Release pipeline: add SHA256SUMS generation (sha256sum tarball)
- Release pipeline: attach SHA256SUMS alongside tarball
- Release pipeline: verify assets are actually attached after
tea releases create (REQ-097 gate C-21); auto-attach via API if
tea failed silently
release.sh:
- Add SHA256SUMS generation (sha256sum tarball > SHA256SUMS)
---ci---
project: orca
milestone: v0.12.18
phase: release-fix
status: complete
---/ci---
---ci---
project: orca
phase: 17
milestone: v0.12
status: execute
---/ci---
install.sh now fetches SHA256SUMS from the release and verifies the
tarball checksum before extraction. Fail closed on mismatch. Warns
if SHA256SUMS is absent (insecure). Build green.
release.sh used $REPO in the tea releases create command (line 133) but never defined it, causing 'unbound variable' under set -u. Define REPO from GITEA_OWNER/GITEA_REPO env vars (same pattern as the verify_asset function at line 147). This is the v0.8.x zero-asset root cause's sibling bug — tea releases create failed silently on REPO unbound, but the script's error handling surfaced it.
---ci---
project: orca
phase: 0
milestone: v0.11
status: ship
---/ci---
P01 — release/install pipeline fix (REQ-097, REQ-098; gate C-21).
release.sh (REQ-097):
- Cross-build linux-amd64 regardless of host arch (GOOS=linux GOARCH=amd64
go build, CGO_ENABLED=0). D-193: the host-arch build produced the wrong
tarball when cut from arm64 — root cause of the v0.8.x asset-less
releases.
- Hardcode tarball name to orca-${VERSION}-linux-amd64.tar.gz (not
host-arch-dependent).
- Post-create asset verification (C-21): after tea releases create, query
the Gitea API and assert the tarball appears in attachments. Retry once
via tea release edit if missing. Fail loudly if still missing. This
catches the tea CLI bug where create exits 0 without attaching the asset.
install.sh (REQ-098):
- Asset fallback walk: if the resolved release (latest or --version) lacks
the matching tarball, query /releases?limit=50, extract all
browser_download_urls from the list response (assets are inline), find
the newest release with a matching orca-*-linux-amd64.tar.gz asset, print
a WARNING, and use that release. Fixes the v0.4.5 install incident where
v0.8.15 had no asset and install.sh errored out with no fallback.
- --check dry-run mode (D-194): prints version + asset URL + install path
+ current version without writing anything.
Tests (scripts/tests/):
- install_test.bash: 5 tests (--help, --check happy path, --check fallback
walk, unknown arg rejection, --system root check).
- release_test.bash: 5 tests (script exists, syntax valid, cross-build
command present, amd64 tarball name hardcoded, asset verification present).
All 30 bats tests pass. make lint clean (no new warnings).
---ci---
project: orca
phase: 1
milestone: v0.10
status: execute
---/ci---
---ci---
project: orca
phase: 3
milestone: v0.3
status: complete
requirements:
covered: [REQ-022, REQ-030, REQ-032]
partial: []
---/ci---
v0.3 milestone merged to main. Includes all v0.2 work (P08-P10) that
was previously on the milestone branch but not yet merged to main, plus
the v0.3 completion work (iter.Seq streaming + doctor network/db).
v0.2 phases included: P08 (mTLS), P09 (scheduling), P10 (security scan).
v0.3 phases: P0 (pre-execution), P1 (iter.Seq streaming), P2 (doctor),
P3 (final review+ship).
Total: 40 requirements, all complete. No new go.mod dependencies.
Full test suite passes under -race. gofmt + go vet clean.
- Fast-forward merge of phase/07-v0.1-backfill into milestone/v0.1-initial
- Annotated tag v0.1.7 created at dc67522
- Gitea release v0.1.7 published with orca-v0.1.7-linux-amd64.tar.gz
- Fix -> typo in release.sh notes block
(unbound variable under set -u; surfaced on first end-to-end run
of release.sh for v0.1.7). Patch is minimal and contained to the
release-notes echo line.
The v0.1 milestone COMPLETE commit (d76ff84) was tagged v0.2.0 and the
per-phase tags v0.1.1..v0.1.6 were created, but the standing rule
'every phase tag produces a Gitea release' was only codified in P06
(RELEASE_POLICY.md) and never applied retroactively.
This commit adds scripts/backfill_releases.sh, an idempotent helper that:
- iterates over v0.1.1..v0.1.6 and v0.2.0
- skips tags that already have a release
- builds the orca binary from the milestone branch HEAD (which includes
the post-COMPLETE entry-point fix and workflow-block commits)
- injects the historical version via -ldflags
- packages a per-tag tarball (orca-<tag>-<os>-<arch>.tar.gz)
- creates a Gitea release with the tarball as an asset, and release
notes that include the phase summary and a v0.2.0 milestone recap
After backfill, the v0.1 milestone is fully released end-to-end and the
discipline carries forward into v0.2.
---ci---
project: orca
phase: 7
milestone: v0.1
status: execute
version: v0.1.7
requirements:
covered: [REQ-007]
partial: []
---/ci---
Jon Chery
cloudinit-bot