Skip to content

release-train: develop -> staging - #442

Merged
tracebloc-release-train[bot] merged 3 commits into
stagingfrom
release-train/to-staging
Jul 31, 2026
Merged

release-train: develop -> staging#442
tracebloc-release-train[bot] merged 3 commits into
stagingfrom
release-train/to-staging

Conversation

@LukasWodka

@LukasWodka LukasWodka commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Automated promotion by the release train (RFC-0008 D14). Head is the train-managed release-train/to-staging branch (a mirror of develop), so it never collides with a human PR. Merged only when the fr-gate is green.


Note

Low Risk
Changes are mostly installer awk parsing and CI/docs; installer behavior improves idempotency for fish users with no auth or data-path impact.

Overview
Develop → staging promotion bundling installer fixes, CI secret-scan baseline, and contributor template updates.

The install.sh rc_lists_dir logic for fish fish_add_path no longer field-splits quoted paths. It tokenises arguments from the first fish_add_path on the line, honours single/double quotes (including paths with spaces), skips flags, stops at trailing comments, and walks multiple directory arguments—fixing false “not listed” detection that duplicated PATH blocks (cli#439). install-verify.sh adds cases 16–18 for spaced prefixes, inline comments mentioning fish_add_path, and a second quoted path on one line.

CI passes gitleaks-baseline: .gitleaks-baseline.json into the shared code-quality workflow so one known generic-api-key finding in internal/submit/submit_test.go (IdempotencyKey test fixture) does not fail the gate.

The pull request template expands guidance: cross-repo issue examples, Breaking change type, test plan / screenshots / deployment notes sections, and checklist items for docs, security reviewers, expand-then-contract rollouts, and local Go/style checks.

Reviewed by Cursor Bugbot for commit be16f6f. Bugbot is set up for automated code reviews on this repo. Configure here.

LukasWodka and others added 3 commits July 30, 2026 16:43
* fix(install): match a quoted fish path, spaces included

rc_lists_dir field-split fish_add_path arguments on whitespace. Since #434
started writing fish_add_path "$PREFIX", a prefix containing spaces became
two fields, matched neither, and the installer appended a SECOND block
directly beneath an existing line naming the same directory -- while
reporting that it had added a PATH entry that was already there.

The read path now parses quotes like the ownership reader further up the
file already does: a quoted argument is one path, spaces included, while an
unquoted line still splits so several bare paths on one line keep working.
Single quotes are handled too, which the old code also missed.

Verified in both directions: the two new harness cases fail against the
current installer (29 passed / 2 failed) and pass with this change
(31 passed / 0 failed).

Found by Bugbot on the develop->staging promotion (cli#438).

* fix(install): take the FIRST fish_add_path, not the last

A greedy /^.*fish_add_path/ strips through the LAST occurrence on the
line, so an inline comment mentioning fish_add_path left the comment text
as the path and missed the real argument -- reintroducing the exact bug
this branch fixes. index() takes the first occurrence instead.

Also restores the leading-whitespace strip that the greedy regex used to
consume: without it substr() left ' "/path"', so the quote check saw a
space and fell back to field-splitting, breaking the spaced-path fix.
Caught by re-running the whole case set rather than only the new one.

Bugbot, cli#439.

* fix(install): take the FIRST fish_add_path, not the last

A greedy /^.*fish_add_path/ strips through the LAST occurrence on the
line, so an inline comment mentioning fish_add_path left the comment text
as the path and missed the real argument -- reintroducing the exact bug
this branch fixes. index() takes the first occurrence instead.

Also restores the leading-whitespace strip that the greedy regex used to
consume: without it substr() left ' "/path"', so the quote check saw a
space and fell back to field-splitting, breaking the spaced-path fix.
Caught by re-running the whole case set rather than only the new one.

Bugbot, cli#439.

* fix(install): tokenise the fish argument list properly

Replaces three rounds of patching with one quote-aware tokenizer, because
each patch fixed its own case and broke or missed another:

  * greedy .* strip lost the real argument to an inline comment
  * index() alone dropped the leading space, so the quote check failed
    and spaced paths regressed
  * taking only the first quoted argument missed the prefix when
    fish_add_path lists several directories

The loop now walks the argument list: quoted tokens are one path (spaces
included), bare tokens split on whitespace, flags are skipped, and a
trailing # comment ends parsing. 18 direct variants and 33 harness cases
green.

Bugbot, cli#439.

* fix(install): tokenise the fish argument list properly

Replaces three rounds of patching with one quote-aware tokenizer, because
each patch fixed its own case and broke or missed another:

  * greedy .* strip lost the real argument to an inline comment
  * index() alone dropped the leading space, so the quote check failed
    and spaced paths regressed
  * taking only the first quoted argument missed the prefix when
    fish_add_path lists several directories

The loop now walks the argument list: quoted tokens are one path (spaces
included), bare tokens split on whitespace, flags are skipped, and a
trailing # comment ends parsing. 18 direct variants and 33 harness cases
green.

Bugbot, cli#439.
Records a redacted gitleaks baseline at the repo root so the full-history
dispatch scan runs clean, and wires the code-quality caller to consume it
via the gitleaks-baseline input. Part of tracebloc/backend#1303.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@LukasWodka

Copy link
Copy Markdown
Contributor Author

bugbot run

@LukasWodka

Copy link
Copy Markdown
Contributor Author

👋 Heads-up — Code review queue is at 37 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)

Comment thread .gitleaks-baseline.json
@LukasWodka

Copy link
Copy Markdown
Contributor Author

bugbot run

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Fix All in Cursor

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit be16f6f. Configure here.

@LukasWodka

Copy link
Copy Markdown
Contributor Author

bugbot run

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit be16f6f. Configure here.

@tracebloc-release-train tracebloc-release-train Bot added gate-nudge Toggled by the release train to (re-)fire the fr-gate and removed gate-nudge Toggled by the release train to (re-)fire the fr-gate labels Jul 31, 2026
@tracebloc-release-train
tracebloc-release-train Bot merged commit 61323b3 into staging Jul 31, 2026
55 checks passed
@tracebloc-release-train
tracebloc-release-train Bot deleted the release-train/to-staging branch July 31, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant