seed-bump: advance the stable line automatically at a series boundary #56

Merged

zach merged 1 commit from automate-line-advance into main 2026-09-14 04:49:31 +00:00

Conversation 0 Commits 1 Files changed 9 +323 -47

zach commented 2026-09-14 04:38:07 +00:00

Owner

Copy link

Follow-up to #55. When anthraxx's packaging moves to a new kernel series, the weekly seed-bump bot used to rewrite the stable line's seed file in place, producing a cross-series pin that validate.yml rejects. This makes the bot open a correct PR: a full stable-line advance.

Changes

• tools/advance-line.sh <new-series> <ref> — single code path for a line advance (operators and CI). Creates configs/seeds/<new>.toml from tools/seed-header.tmpl, pins it via bump-seed.sh (signature-verified), refuses unless the ref is a <new>-series tag, repoints configs/upstream-seed.toml, demotes the current stable block to kind = "previous", appends the new stable block. Failure restores the tree.
• tools/seed-header.tmpl — seed header with no bump-volatile facts, so bump-seed.sh never leaves stale prose. configs/seeds/7.2.toml regenerated from it (values unchanged).
• seed-bump.yml — detects a series boundary after the trial bump, runs the helper, commits registry + symlink + new seed, opens the PR with an advance-specific body (merge together with the first tag; first build logs drift-guard SKIPPED).
• configs/lines.toml — 7.1 re-registered as previous; kinds and the procedure documented.
• bump-seed.sh — loud error on a half-formed pin file instead of a silent exit 1.
• fetch-seed.sh, lines.py error text and operator docs point at the helper; docs gain the apt behaviour across an advance.

Verification

• Ran tools/advance-line.sh 7.2 7.2.5.hardened1-1 on a worktree at the pre-#55 commit: output matches #55 (same commit + sha256), seed-pins-well-formed script passes, lines.py kinds → 7.1=previous 7.2=stable.
• Negative: advance-line.sh 7.3 7.2.5.hardened1-1 aborts with a clear message and leaves the tree clean.
• Locally: shellcheck (build + tools), yamllint -d relaxed, lint-workflow-shell.py --severity error, workflow-expressions grep, py_compile, seed-pins check — all pass.

🤖 Generated with Claude Code

Follow-up to #55. When anthraxx's packaging moves to a new kernel series, the weekly seed-bump bot used to rewrite the stable line's seed file in place, producing a cross-series pin that `validate.yml` rejects. This makes the bot open a correct PR: a full stable-line advance. **Changes** - `tools/advance-line.sh <new-series> <ref>` — single code path for a line advance (operators and CI). Creates `configs/seeds/<new>.toml` from `tools/seed-header.tmpl`, pins it via `bump-seed.sh` (signature-verified), refuses unless the ref is a `<new>`-series tag, repoints `configs/upstream-seed.toml`, demotes the current stable block to `kind = "previous"`, appends the new stable block. Failure restores the tree. - `tools/seed-header.tmpl` — seed header with no bump-volatile facts, so `bump-seed.sh` never leaves stale prose. `configs/seeds/7.2.toml` regenerated from it (values unchanged). - `seed-bump.yml` — detects a series boundary after the trial bump, runs the helper, commits registry + symlink + new seed, opens the PR with an advance-specific body (merge together with the first tag; first build logs drift-guard SKIPPED). - `configs/lines.toml` — 7.1 re-registered as `previous`; kinds and the procedure documented. - `bump-seed.sh` — loud error on a half-formed pin file instead of a silent exit 1. - `fetch-seed.sh`, `lines.py` error text and operator docs point at the helper; docs gain the apt behaviour across an advance. **Verification** - Ran `tools/advance-line.sh 7.2 7.2.5.hardened1-1` on a worktree at the pre-#55 commit: output matches #55 (same commit + sha256), `seed-pins-well-formed` script passes, `lines.py kinds` → `7.1=previous 7.2=stable`. - Negative: `advance-line.sh 7.3 7.2.5.hardened1-1` aborts with a clear message and leaves the tree clean. - Locally: shellcheck (build + tools), `yamllint -d relaxed`, `lint-workflow-shell.py --severity error`, workflow-expressions grep, py_compile, seed-pins check — all pass. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

zach added 1 commit 2026-09-14 04:38:07 +00:00

seed-bump: advance the stable line automatically at a series boundary ... b37fb6e08f

PR #55 showed the gap: when anthraxx's packaging moved 7.1 -> 7.2, the
weekly seed-bump bot rewrote configs/seeds/7.1.toml in place with a 7.2 tag,
which validate.yml's seed-pins-well-formed job correctly rejects as a
cross-series pin. The fix was mechanical but manual (new seed file,
symlink, lines.toml). Make the bot open a *correct* PR instead.

  - tools/advance-line.sh <new-series> <ref>: the one code path for a
    stable-line advance, shared by operators and CI. Creates
    configs/seeds/<new>.toml from tools/seed-header.tmpl with the old pin's
    values, runs bump-seed.sh (signature-verified), refuses unless the ref
    resolved to a <new>-series tag, repoints configs/upstream-seed.toml,
    demotes the current stable block to kind = "previous" and appends the new
    stable block with the same keep_in_main. Any failure restores the tree.
    Verified against the pre-#55 tree: reproduces #55's commit/sha256 exactly;
    a wrong-series ref aborts and leaves the tree clean.
  - tools/seed-header.tmpl: templated seed header with no bump-volatile
    facts (no tag, no date), so bump-seed.sh's "never touches prose" no
    longer leaves stale comments behind. configs/seeds/7.2.toml regenerated
    from it.
  - seed-bump.yml: after the trial bump, compare the resolved tag's series
    with the stable line; if newer, revert and run advance-line.sh, commit
    registry + symlink + new seed, and open the PR with an advance-specific
    title/body (merge-with-first-tag caveat, drift-guard SKIPPED note).
  - configs/lines.toml: re-register 7.1 as kind = "previous" so retention
    stays an explicit per-line decision; document kinds + the helper.
  - bump-seed.sh: fail with a message on a half-formed pin file instead of
    exiting 1 silently from inside a $(...) pipeline.
  - fetch-seed.sh / lines.py error text and operator docs point at the
    helper; docs gain the apt behaviour across a line advance.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

zach referenced this pull request 2026-09-14 04:46:32 +00:00

intent: follow 7.2 rename RANDOM_KMALLOC_CACHES -> KMALLOC_PARTITION_CACHES #57

zach merged commit f693a0501b into main 2026-09-14 04:49:31 +00:00

zach deleted branch automate-line-advance 2026-09-14 04:49:32 +00:00

zach referenced this pull request from a commit 2026-09-14 04:49:33 +00:00

Merge pull request 'seed-bump: advance the stable line automatically at a series boundary' (#56) from automate-line-advance into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

unredacted/linux-hardened-unredacted!56

No description provided.