docs(changelog): drop the Unreleased section; document machine-written policy #38

Closed

rcsheets wants to merge 1 commit from docs/changelog-machine-written into main

pull from: docs/changelog-machine-written

merge into: brooktrails:main

brooktrails:main

Conversation 4 Commits 1 Files changed 15 +686 -62

rcsheets commented 2026-06-26 23:41:45 +00:00

Owner

Copy link

The changelog is generated at release time from the commit range, so the
Keep a Changelog "[Unreleased]" section had no role — nothing ever populated it,
and a hand-written note there would have been orphaned at release rather than
promoted into the cut version. Remove the section and its link, and stop the
script from maintaining them.

Document the policy that CHANGELOG.md is machine-written and human-read in both
README.md and CLAUDE.md, including that the way to shape an entry is to write a
detailed commit message (the body is summarized along with the subject).

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

The changelog is generated at release time from the commit range, so the Keep a Changelog "[Unreleased]" section had no role — nothing ever populated it, and a hand-written note there would have been orphaned at release rather than promoted into the cut version. Remove the section and its link, and stop the script from maintaining them. Document the policy that CHANGELOG.md is machine-written and human-read in both README.md and CLAUDE.md, including that the way to shape an entry is to write a detailed commit message (the body is summarized along with the subject). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

rcsheets added 1 commit 2026-06-26 23:41:45 +00:00

docs(changelog): drop the Unreleased section; document machine-written policy ... 89bb477549

The changelog is generated at release time from the commit range, so the
Keep a Changelog "[Unreleased]" section had no role — nothing ever populated it,
and a hand-written note there would have been orphaned at release rather than
promoted into the cut version. Remove the section and its link, and stop the
script from maintaining them.

Document the policy that CHANGELOG.md is machine-written and human-read in both
README.md and CLAUDE.md, including that the way to shape an entry is to write a
detailed commit message (the body is summarized along with the subject).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pr-reviewer-bot commented 2026-06-26 23:41:46 +00:00

Collaborator

Copy link

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3f0e3a-66f16e
This is an AI-generated review and may contain mistakes.

Status: ❌ Failed

---

Review failed. Tracking id r-3f0e3a-66f16e — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3f0e3a-66f16e`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3f0e3a-66f16e` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.

rcsheets added 13 commits 2026-06-27 00:29:05 +00:00

fix: install protobuf-compiler before using it 7ed9778d37

chore: try a little harder on the install step 37de059952

ci: allow container builds on feature branches ... b02744dea5

The Makefile guards container-build against non-master branches to prevent
accidental local builds of mis-tagged :latest images. CI builds images on
every branch as a smoke test and never pushes them, so set ALLOW_BRANCH=1
(the documented override) on the build step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: provide a docker:dind service for the image build ... 527800d227

The runner exposes no Docker socket at the default path, so the build hit
"Cannot connect to the Docker daemon". Run docker:dind as a privileged service
and point DOCKER_HOST at it over TCP, with a readiness wait before building.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: check system prerequisites before the build pipeline ... d516189edd

Install the Docker CLI and verify the daemon is reachable up front, alongside
protobuf-compiler, so a misconfigured runner fails in seconds instead of after
generate, the diff checks, vet, the full test suite, and the build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: allow e2e image build on non-master checkouts ... f14a0d88fe

The e2e smoke test builds the controller image via make, which tripped the
non-master branch guard — pull_request checks out a detached HEAD, so the branch
reads as "HEAD". The image is built locally and loaded into kind, never pushed,
so set ALLOW_BRANCH=1 in the step env (make imports env vars as variables).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: provide docker daemon + CLI for the e2e smoke test ... d8ed9475c5

e2e failed with "docker: No such file or directory" — the job had no docker
client and no daemon. Mirror ci.yml: install the docker CLI, run docker:dind as
a service, point DOCKER_HOST at it, and wait for readiness before the test.
kind builds its cluster inside this same daemon.

Note: kind writes a kubeconfig pointing at 127.0.0.1, but with a separate dind
service the API server is reachable at the 'docker' host — expect the next
hurdle to be kubectl reaching the cluster, addressed once observed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: make e2e workflow self-testable ... 05f8642696

Add workflow_dispatch for manual runs and include the e2e workflow file itself
in the pull_request paths, so changes to e2e CI re-run e2e instead of sitting
untested until an unrelated code/config change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix: make container build generate its own proto code ... 03567a0665

The controller/provisioner images import the gitignored protobuf package via
COPY . . in the Containerfile, so the image build only worked when make generate
had already run on the host (as in ci.yml). The e2e smoke test built the image
cold and failed: "no required module provides package .../proto/provisioner/v1".

Make container-build-controller/-provisioner depend on `proto` so the generated
code is always present (locally, in CI, and in e2e), and install protobuf-compiler
in the e2e job so that generation can run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: quiet curl and print versions in e2e install steps ... 72bfc62bf7

curl -Lo dumped a progress meter (noise in CI) and would not fail on HTTP
errors, so a 404 could write an error page into the binary and "succeed". Use
curl -fsSL (fail on error, no progress meter, show real errors, follow
redirects) and print 'kind version' / 'kubectl version --client' as the
step's useful output.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(e2e): make kind reachable from the job and apply CRDs via kustomize ... dbd37681d2

The smoke test ran kind inside the remote dind daemon, so the generated
kubeconfig pointed at 127.0.0.1:<port> — unreachable from the job container,
giving "connection refused" on kubectl. When DOCKER_HOST is a remote dind, create
the cluster with apiServerAddress 0.0.0.0 on a fixed port and repoint kubeconfig
at the daemon host (TLS verify off; client-cert auth still applies). Local runs
with no remote DOCKER_HOST are unchanged.

Also apply CRDs with `kubectl apply -k` so kustomization.yaml isn't applied as a
resource.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

feat(controller): add --enable-webhooks toggle; disable in e2e ... 09bbed8f0f

The controller always registered admission webhooks, whose serving certs are
normally supplied by cert-manager. The e2e smoke test has none, so the manager
failed with "open .../serving-certs/tls.crt: no such file or directory" and shut
down before reconciling.

Add --enable-webhooks (default true, production unchanged); when false, the
webhook setup is skipped so the manager never requires certs. The e2e deployment
sets --enable-webhooks=false.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(controller): reconcile ConfigMap before fetching registration token ... dbea68fa9e

The runner config ConfigMap is derived purely from the spec and does not depend
on Forgejo, but it was created only after a successful token fetch — so a Forgejo
outage (or a missing/invalid token) left no ConfigMap at all. Reconcile the
ConfigMap first; only the registration Secret and Deployment depend on the token.

This also makes the e2e smoke test's ConfigMap assertion valid without a live
token, matching its documented expectation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pr-reviewer-bot commented 2026-06-27 00:29:06 +00:00

Collaborator

Copy link

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3f1952-a2e973
This is an AI-generated review and may contain mistakes.

Status: ❌ Failed

---

Review failed. Tracking id r-3f1952-a2e973 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3f1952-a2e973`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3f1952-a2e973` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.

rcsheets added 8 commits 2026-06-27 01:58:14 +00:00

ci: target the trusted DinD runner instead of ubuntu-latest ... d3816f4b2e

The operator's own CI was stuck ("Waiting for a runner with the following
label: ubuntu-latest") because no such runner exists. The dedicated pool
for this repo (trusted-forgejo-runner-operator) registers the labels
[trusted dind runner-operator], matching the convention used by the other
repos' build/publish workflows.

Point all four workflows at [dind, trusted] so the existing runner picks
them up. All of them need Docker anyway (ci builds container images, e2e
runs kind, publish does docker build/push).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: provide a docker:dind service for the image build ... a72e2017bc

The runner exposes no Docker socket at the default path, so the build hit
"Cannot connect to the Docker daemon". Run docker:dind as a privileged service
and point DOCKER_HOST at it over TCP, with a readiness wait before building.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: make e2e workflow self-testable ... 6c49490732

Add workflow_dispatch for manual runs and include the e2e workflow file itself
in the pull_request paths, so changes to e2e CI re-run e2e instead of sitting
untested until an unrelated code/config change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(e2e): make kind reachable from the job and apply CRDs via kustomize ... 64b316d21c

The smoke test ran kind inside the remote dind daemon, so the generated
kubeconfig pointed at 127.0.0.1:<port> — unreachable from the job container,
giving "connection refused" on kubectl. When DOCKER_HOST is a remote dind, create
the cluster with apiServerAddress 0.0.0.0 on a fixed port and repoint kubeconfig
at the daemon host (TLS verify off; client-cert auth still applies). Local runs
with no remote DOCKER_HOST are unchanged.

Also apply CRDs with `kubectl apply -k` so kustomization.yaml isn't applied as a
resource.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: check system prerequisites before the build pipeline ... 4d7f54186d

Install the Docker CLI and verify the daemon is reachable up front, alongside
protobuf-compiler, so a misconfigured runner fails in seconds instead of after
generate, the diff checks, vet, the full test suite, and the build.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: allow e2e image build on non-master checkouts ... 47598071b4

The e2e smoke test builds the controller image via make, which tripped the
non-master branch guard — pull_request checks out a detached HEAD, so the branch
reads as "HEAD". The image is built locally and loaded into kind, never pushed,
so set ALLOW_BRANCH=1 in the step env (make imports env vars as variables).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

ci: provide docker daemon + CLI for the e2e smoke test ... e8d44ddc4c

e2e failed with "docker: No such file or directory" — the job had no docker
client and no daemon. Mirror ci.yml: install the docker CLI, run docker:dind as
a service, point DOCKER_HOST at it, and wait for readiness before the test.
kind builds its cluster inside this same daemon.

Note: kind writes a kubeconfig pointing at 127.0.0.1, but with a separate dind
service the API server is reachable at the 'docker' host — expect the next
hurdle to be kubectl reaching the cluster, addressed once observed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(controller): reconcile ConfigMap before fetching registration token ... c6da70f01b

The runner config ConfigMap is derived purely from the spec and does not depend
on Forgejo, but it was created only after a successful token fetch — so a Forgejo
outage (or a missing/invalid token) left no ConfigMap at all. Reconcile the
ConfigMap first; only the registration Secret and Deployment depend on the token.

This also makes the e2e smoke test's ConfigMap assertion valid without a live
token, matching its documented expectation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

pr-reviewer-bot commented 2026-06-27 01:58:16 +00:00

Collaborator

Copy link

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3f2e38-0a2bb2
This is an AI-generated review and may contain mistakes.

Status: ❌ Failed

---

Review failed. Tracking id r-3f2e38-0a2bb2 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3f2e38-0a2bb2`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3f2e38-0a2bb2` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.

rcsheets force-pushed docs/changelog-machine-written from c6da70f01b to 59b6af08fd 2026-06-27 02:16:08 +00:00 Compare

pr-reviewer-bot commented 2026-06-27 02:16:09 +00:00

Collaborator

Copy link

Automated review by pr-reviewer v0.29.1 | Safety Check | Mistral Small | tracking id r-3f3269-d4bac3
This is an AI-generated review and may contain mistakes.

Status: ❌ Failed

---

Review failed. Tracking id r-3f3269-d4bac3 — see logs for details.

Comment @pr-reviewer-bot retry to try again.

*Automated review by [pr-reviewer](https://git.brooktrails.org/brooktrails/pr-reviewer) v0.29.1 | Safety Check | Mistral Small | tracking id `r-3f3269-d4bac3`* *This is an AI-generated review and may contain mistakes.* **Status:** ❌ Failed --- Review failed. Tracking id `r-3f3269-d4bac3` — see logs for details. Comment `@pr-reviewer-bot retry` to try again.

rcsheets closed this pull request 2026-06-27 02:28:32 +00:00

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

brooktrails/forgejo-runner-operator!38

No description provided.