open/ktg-plugin-marketplace
1
0
Fork 0
Code Issues Releases Activity

fix(scripts): --create-tag is a write and must obey --write

Browse source 
`--create-tag` minted AND PUSHED a plugin tag to a public remote without
`--write`, on the entry point CLAUDE.md documents as "dry-run by default".
The tag was public before the plan was even printed.

Extracts `shouldCreateTag(args, observed, target)` as a pure exported
predicate ('create' | 'dry-run' | 'skip') so the flag's write-ness is
testable, and gates minting on `--write`. Without it the CLI now reports
what it would mint, printed after the missing-tag blocker that points at
the flag.

Deliberately NOT placed behind the catalog-wide pre-flight: every
precondition it checks is local to the plugin being released
(plugin.json == target, badge agrees, tag absent), so the tag is correct
by construction. A red *other* plugin can only make the tag early, never
wrong, and the tag-absent check makes the retry idempotent. Gating it
would let plugin Y block the tagging of plugin X — the same over-coupling
that reading the ERROR set only (never `failed`) exists to avoid.

Tests 19 -> 25; 131/131 across the six suites. check-versions 12 OK.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019i3rnU2VNRdGcrUFMnRb6R
This commit is contained in:
Kjell Tore Guttormsen 2026-08-10 20:46:45 +02:00
commit ea8231f3c8
3 changed files with 87 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

15
CLAUDE.md
View file

@ -23,8 +23,9 @@ their own Forgejo repositories under `https://git.fromaitochitta.com/open/`.
step strands users on the old version (the exact drift this helper exists to prevent). Run
`node scripts/release-plugin.mjs <plugin> [--version X.Y.Z]` — dry-run by default; it REFUSES unless
`plugin.json` == README badge == the target version AND the `vX.Y.Z` tag exists, then prints the
planned bump. Apply with `--write [--commit] [--push]`; `--create-tag` mints+pushes a missing plugin
tag first. On `--write` it bumps the catalog `ref` AND the catalog README's per-plugin `` `vX.Y.Z` ``
planned bump. Apply with `--write [--commit] [--push]`; `--create-tag --write` mints+pushes a missing
plugin tag first (**`--create-tag` is a WRITE and obeys `--write`** — on a dry-run it only reports
what it would mint). On `--write` it bumps the catalog `ref` AND the catalog README's per-plugin `` `vX.Y.Z` ``
label together (and `git add`s both on `--commit`). Because it only moves both to a verified, tagged,
consistent version, `check-versions.mjs` is green by construction. Never hand-edit a `ref` or a
README label for a release — use this. Pure planner + label reconciler + pre-flight/write step
@ -36,8 +37,14 @@ their own Forgejo repositories under `https://git.fromaitochitta.com/open/`.
the public remote. The pre-flight reads the **ERROR set only**, never `failed`/`--strict`: pre-bump,
the plugin being released is *supposed* to be WARN (catalog `ref` behind `plugin.json`), so gating on
WARN would brick every release. The post-write gate at the end stays — pre-flight validates the old
state, that one validates the new state. **Known remaining hole:** `--create-tag` mints and pushes
the plugin tag *before* the pre-flight runs, so that irreversible side effect is still unprotected.
state, that one validates the new state. **`--create-tag` is deliberately NOT behind this gate**
(decided 2026-08-11): it mints and pushes the plugin tag *before* the pre-flight runs, but every
precondition it checks is local to that one plugin (`plugin.json` == target, badge agrees, tag
absent), so the tag is correct by construction. A red *other* plugin can only make the tag EARLY,
never WRONG, and the tag-absent check makes the retry idempotent — gating it would let plugin Y
block the *tagging* of plugin X, the same over-coupling that reading ERROR-only avoids. What WAS
closed is the worse half: `--create-tag` used to push on the documented dry-run path, with no
`--write` at all. It now requires `--write` (`shouldCreateTag`, tested).
- **Version-consistency gate:** run `node scripts/check-versions.mjs` before committing any `ref`
change. For each plugin it checks (against the sibling repo) that the catalog `ref` resolves to a
real git tag (ERROR if dangling — breaks install), that `plugin.json` version == README