Skip to content

Commit 13df2c5

Browse files
gatezhgatezh
committed
Merge branch 'master' into feat/claude-code-bake-happy
Resolves the renovate.json5 conflict: master (#126) rewrote the "devcontainer agent tools" rationale to explain why platformAutomerge must stay at its default and added a 3-day minimumReleaseAge soak with a claude-code exemption. Keep master's version verbatim and carry over only this branch's "four tools" -> "five tools" count. Effect on happy: it inherits the 3-day soak, so a happy release is not adopted until it has been public for three days.
2 parents 788a0d6 + 3efc9c7 commit 13df2c5

5 files changed

Lines changed: 94 additions & 22 deletions

File tree

‎.devcontainer/init-plugins.sh‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,11 @@ done
4646

4747
# Initialize rtk global hook for Claude Code (auto-rewrite mode).
4848
# --hook-only: installs only the PreToolUse rewrite hook, no workspace artifacts.
49-
# WORKAROUND: RTK ≥0.36.0 added a GDPR telemetry consent prompt that hangs in
50-
# non-interactive environments. timeout + RTK_TELEMETRY_DISABLED work around it.
51-
# Remove when upstream fixes it: https://github.com/rtk-ai/rtk/issues/1307
49+
# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
50+
# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
51+
# would otherwise block on stdin here. rtk's own TTY check is not enough — a
52+
# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
53+
# interactive. timeout stays as a backstop against a future init-time hang.
5254
echo "Initializing rtk (token optimizer)..."
5355
RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch || {
5456
echo "Note: rtk init may have already been configured or rtk not available"

‎.github/renovate.json5‎

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,17 @@
2929
},
3030
{
3131
// Group the five tools into one PR and auto-merge once CI passes.
32-
// platformAutomerge:false => Renovate performs the merge itself only
33-
// after it observes the branch tests are green, so CI gating needs no
34-
// branch-protection rule. (Optional hardening: enable branch protection
35-
// requiring the CI checks and set platformAutomerge:true for native
36-
// GitHub auto-merge.)
32+
//
33+
// Relies on Renovate's default platformAutomerge:true — GitHub's native
34+
// auto-merge merges on green with no second Renovate run. The previous
35+
// explicit platformAutomerge:false is what broke this: only a Renovate
36+
// run could merge, and every run found a newer claude-code, force-pushed
37+
// the branch and ended before CI finished (#121 sat green for 3.5 weeks).
38+
//
39+
// Requires: repo setting "Allow auto-merge", and a ruleset on master
40+
// requiring the "CI complete" check (.github/workflows/ci.yml). Without
41+
// that required check nothing blocks the PR, GitHub never offers native
42+
// auto-merge, and Renovate silently falls back to the broken path.
3743
matchPackageNames: [
3844
'rtk-ai/rtk',
3945
'umputun/ralphex',
@@ -43,7 +49,18 @@
4349
],
4450
groupName: 'devcontainer agent tools',
4551
automerge: true,
46-
platformAutomerge: false,
52+
53+
// These bumps merge unreviewed and publish straight to ghcr.io, so let a
54+
// release soak before adopting it. internalChecksFilter defaults to
55+
// 'strict', so a too-young version is simply not offered yet — the group
56+
// PR carries whichever tools are currently eligible.
57+
minimumReleaseAge: '3 days',
58+
},
59+
{
60+
// ...except claude-code, which is tracked at latest deliberately.
61+
// Later packageRules win, so this clears the soak period above.
62+
matchPackageNames: ['@anthropic-ai/claude-code'],
63+
minimumReleaseAge: null,
4764
},
4865
],
4966
}

‎.github/workflows/ci.yml‎

Lines changed: 53 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@ name: CI
33
on:
44
pull_request:
55
branches: [master]
6-
paths:
7-
- '**/Dockerfile'
8-
- '**/*.sh'
9-
- '.github/workflows/**'
10-
- '.hadolint.yaml'
6+
# Deliberately unfiltered: "CI complete" below is the required status check
7+
# for master, and a required check that never runs blocks a PR forever -- a
8+
# docs-only PR would deadlock. Image builds are still skipped per-image via
9+
# detect-changes; the always-on jobs are lint-only and take seconds.
1110

1211
concurrency:
1312
group: ci-${{ github.event.pull_request.number || github.ref }}
@@ -194,3 +193,52 @@ jobs:
194193
IMAGE_TAG: ${{ matrix.image }}:test
195194
VERIFY_CMD: ${{ matrix.verify }}
196195
run: docker run --rm --entrypoint sh "$IMAGE_TAG" -c "$VERIFY_CMD"
196+
197+
# -- Single required status check for branch protection ------------------
198+
# Aggregates every job above so master needs exactly one required check.
199+
# Passes when each job succeeded or was legitimately skipped (path-filtered
200+
# builds), and fails if any job failed or was cancelled.
201+
#
202+
# Any job added to this workflow must also be added to `needs` below: this is
203+
# the only required check on master and Renovate auto-merges on it, so an
204+
# unwatched job would go red while the gate stayed green. The first step
205+
# enforces that rather than trusting anyone to remember.
206+
ci-complete:
207+
name: CI complete
208+
# always(), not !cancelled(): GitHub counts a *skipped* required check as
209+
# passing, so !cancelled() would let a cancelled run report a green gate.
210+
if: always()
211+
needs: [lint-dockerfiles, lint-workflows, detect-changes, build-and-verify]
212+
runs-on: ubuntu-latest
213+
steps:
214+
- name: Checkout repository
215+
uses: actions/checkout@v6
216+
217+
- name: Verify every job is watched
218+
env:
219+
WATCHED: ${{ toJSON(needs) }}
220+
run: |
221+
missing=""
222+
for job in $(yq '.jobs | keys | .[]' .github/workflows/ci.yml); do
223+
[ "$job" = "ci-complete" ] && continue
224+
jq -e --arg j "$job" 'has($j)' <<< "$WATCHED" > /dev/null || missing="$missing $job"
225+
done
226+
if [ -n "$missing" ]; then
227+
echo "::error::Jobs missing from ci-complete.needs:$missing"
228+
exit 1
229+
fi
230+
231+
- name: Check results of all CI jobs
232+
env:
233+
WATCHED: ${{ toJSON(needs) }}
234+
run: |
235+
jq -r 'to_entries[] | "\(.key): \(.value.result)"' <<< "$WATCHED"
236+
bad=$(jq -r '
237+
to_entries[]
238+
| select(.value.result != "success" and .value.result != "skipped")
239+
| "\(.key) (\(.value.result))"' <<< "$WATCHED")
240+
if [ -n "$bad" ]; then
241+
echo "::error::CI jobs did not pass: $(echo "$bad" | tr '\n' ' ')"
242+
exit 1
243+
fi
244+
echo "All CI jobs passed or were skipped."

‎claude-code/.devcontainer/init-plugins.sh‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,11 @@ done
7070
# ── rtk init (token-optimized CLI proxy) ────────────────────────────────────
7171
# Global hook-first mode: installs only the PreToolUse rewrite hook to ~/.claude/,
7272
# no workspace artifacts (CLAUDE.md, .rtk/). Safe to run multiple times.
73-
# WORKAROUND: RTK ≥0.36.0 added a GDPR telemetry consent prompt that hangs in
74-
# non-interactive environments. timeout + RTK_TELEMETRY_DISABLED work around it.
75-
# Remove when upstream fixes it: https://github.com/rtk-ai/rtk/issues/1307
73+
# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround: since
74+
# rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent prompt that
75+
# would otherwise block on stdin here. rtk's own TTY check is not enough — a
76+
# devcontainer postCreateCommand gets a pseudo-TTY, so the prompt believes it is
77+
# interactive. timeout stays as a backstop against a future init-time hang.
7678
if command -v rtk &>/dev/null; then
7779
RTK_TELEMETRY_DISABLED=1 timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
7880
fi

‎ralphex-fe/init-docker.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,14 @@ if [ -d /mnt/claude ]; then
2929
chown -R app:app /home/app/.claude
3030

3131
# ── RTK: ensure rewrite hook is configured ─────────────────────────────
32-
# Host mount usually brings the hook, but init idempotently to cover
33-
# standalone usage (no host mount). --hook-only avoids workspace artifacts.
34-
# WORKAROUND: RTK ≥0.36.0 added a GDPR telemetry consent prompt that hangs
35-
# in non-interactive environments. Remove when upstream fixes it:
36-
# https://github.com/rtk-ai/rtk/issues/1307
32+
# The host mount usually brings the hook; re-init idempotently in case the
33+
# mounted ~/.claude carries none. --hook-only avoids workspace artifacts.
34+
# Scope: this sits inside the /mnt/claude guard, so a container started
35+
# without the host mount gets no rtk hook and rtk stays inert.
36+
# RTK_TELEMETRY_DISABLED=1 is the supported opt-out, not a workaround:
37+
# since rtk-ai/rtk#2477 (v0.44.0+) it short-circuits the telemetry consent
38+
# prompt that would otherwise block on stdin here. timeout stays as a
39+
# backstop against a future init-time hang.
3740
if command -v rtk >/dev/null 2>&1; then
3841
RTK_TELEMETRY_DISABLED=1 gosu app timeout 10 rtk init -g --hook-only --auto-patch 2>/dev/null || true
3942
fi

0 commit comments

Comments
 (0)