[clubanderson]

Follow-up to #14199/#14221 after the first syncs ran green (hivecommons/crux ab8097b, bb649b1 via TOPUP_PUSH_TOKEN).

A crux/vX.Y.Z tag run checked out hive at the tag, rebuilt the publish tree and committed it on top of hivecommons/crux main. If the tag points at a hive commit older than the latest push-triggered sync (normal: tag after a few more src/crux merges), that commit rolls main back to the older tree. Tag runs now never move main: they walk main for the commit whose tree matches the tagged hive commit (ignoring .hive-sync) and push vX.Y.Z there; no match → clear error telling you to sync first; tag already on crux → error rather than clobber.

Verified the match loop locally: publish tree of hive 4bee931f95f7 → crux 4478555 (the newest commit with that code), hive 6350270f14dc → crux bb649b1. Docs updated in src/docs/crux-publish.md; notes that v0.1.0 was tagged directly on crux.

Refs #14138

[kubestellar-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign kellyaa for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Open PR overlap check

Base branch: v5

Conflicts are checked with every PR merged onto the current tip of v5, so a PR that only needs a rebase is not reported as conflicting with its siblings.

No conflicting open PRs or same-file overlaps were found.

[hivecommons-hive]

@clubanderson is auto-promoted for contributor-lane merging on this PR: the last 5 merged PRs by this author in this repository have no revert or sentinel-alert evidence. CI, reviewer verdict, diff fences, soak, holds and branch protection still apply.

[hivecommons-hive]

@clubanderson this PR is held at stage/071-needs-author and the hive will not merge it yet.

Failing checks:

• test (rest 2/5)

Next: the hive does not push to your branch. Push a new head (or reply here); CI and the review swarm re-run automatically and the PR returns to the normal path.

[hivecommons-hive]

One real defect: the "find the already-synced commit" search can only ever see one commit, so the release path fails in exactly the case it was written for.

• .github/workflows/crux-sync.yml:106 — the hivecommons/crux checkout into crux-publish is fetch-depth: 1, and nothing in src/scripts/crux-publish.sh deepens it (its only git calls are rev-parse against the hive checkout, :53-54).
• .github/workflows/crux-sync.yml:149-150 — for c in $(git rev-list -n 200 HEAD) therefore iterates exactly one SHA (HEAD of main), and the match degenerates to "is the tagged hive commit's tree identical to current main".
• The comment at :144-146 names the motivating case: the tag points at a hive commit older than what the push trigger has already synced. In that case main HEAD carries the newer tree, the single comparison fails, and the step exits 1 at :152-154 with "no commit on main matches … sync it first" — but syncing cannot help, since the matching commit is already on main, just behind HEAD. Severity: high; consequence: every release tag cut on a commit that isn't the latest v5 sync fails and cannot be recovered via the documented remedy.

Fix is one line: fetch-depth: 0 on the crux-publish checkout (or ≥200 to match the rev-list bound). The crux repo is small (one synced copy of src/crux), so a full clone is cheap.

Everything else reads correctly to me: the Push step (:213-224) only moves main when changed=true, the ls-remote --exit-code --tags guard (:227-230) prevents a silent re-tag, $TARGET is a local commit so git tag -a … "$TARGET" resolves, and git diff --cached --quiet "$c" -- . ':!.hive-sync' correctly excludes the timestamped .hive-sync from the tree comparison. src/docs/crux-publish.md:80-88 describes the intended behaviour accurately once the depth is fixed.

The red test/coverage checks: this diff touches no Go, so they are not caused by this change; I have not triaged them.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

cc6844b

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @clubanderson, head cc6844bc94b7) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/crux-sync.yml
• ci_gate_weakening — CI configuration is deleted, softened or has gate checks removed (Disables or softens CI gates (continue-on-error, || true, removed checks))
  • .github/workflows/crux-sync.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

hive/awaiting-ci: test (rest 2/5) → test → coverage are red because crux/hivecap.TestDirectAndSocketParity (from #14222) has a hard-coded expiry that passed at 14:00Z; it fails on every v5 PR, including docs-only ones. Not caused by this diff. Tracked as shared incident #14230 (fix: #14229). Deferring until that lands.

---

🐝 Hive Agent: scanner | Instance: hosted-available-oke-11-placeholder-r05x | SHA: unknown

— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Correctness (read at head c4a3a2e)

1. The match loop can only ever see main's tip — the shallow checkout defeats the fix. .github/workflows/crux-sync.yml:106 checks out hivecommons/crux with fetch-depth: 1, but the new release path at :144-146 walks git rev-list -n 200 HEAD. In a depth-1 clone that yields exactly one commit (verified: git clone --depth 1 hivecommons/crux && git rev-list -n 200 HEAD | wc -l → 1). So a crux/vX.Y.Z tag matches only if it points at the hive commit of the latest sync; the exact case this PR exists for (tag behind the newest push-triggered sync) hits :147-150 and fails with "no commit on main matches … sync it first" — and re-syncing cannot help, since main is already ahead. The PR body's own example (hive 4bee931f95f7 → crux 4478555, two commits behind today's tip 544a36a) would fail in CI; it only worked locally because that clone had history. Fail-safe, but the feature doesn't work.

Fix — give the crux checkout history (repo is ~11 commits):

          persist-credentials: true
          fetch-depth: 0

(or, if you'd rather keep the push path shallow, git fetch -q --deepen=200 origin main just before the for c in $(git rev-list …) loop at :144.)

2. (low) In release mode git reset -q --hard HEAD at :151 runs before "Upload publish tree" (:181-188), so the crux-publish-tree artifact for a tag run now contains main's tip tree, not the tagged hive commit's tree. Harmless for the happy path, but the artifact is the documented manual-recovery input, and on the "no match" failure above it would be the wrong tree to push by hand. Consider moving the reset after the upload, or skipping it (the Push step never commits in release mode anyway).

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Conclusion: the tag-run design is right (never move main, tag the matching synced commit), but as wired the match loop can only ever see one commit, so the exact case this PR exists for — a crux/vX.Y.Z tag pointing at a hive commit older than the latest push-triggered sync — fails with "no commit on main matches … sync it first", and syncing again cannot fix it (it would produce the newest tree, not the tagged one).

Mechanism

• .github/workflows/crux-sync.yml:106 — the crux-publish checkout is fetch-depth: 1. This PR does not change it, and nothing in the job unshallows (grep -n 'unshallow\|git fetch' on the head file finds nothing).
• .github/workflows/crux-sync.yml:149 — for c in $(git rev-list -n 200 HEAD) runs in that checkout. On a depth-1 clone rev-list stops at the shallow boundary and returns only HEAD. (Checked: a fresh git clone --depth 1 of a 3-commit repo → git rev-list -n 200 HEAD | wc -l = 1; full clone = 3.)
• So git diff --cached --quiet "$c" -- . ':!.hive-sync' is evaluated against main's tip only. It matches only when the tag points at the most recently synced hive commit; otherwise target stays empty and the step exits 1 at line 152.

Consequence: tagging anything but the very latest synced src/crux commit is a hard failure in CI. The local verification in the body (4bee931f95f7 → 4478555, 6350270f14dc → bb649b1) walks real history, which is why it worked there and won't in the runner. Not a regression against today's rollback behaviour — the run fails instead of rewinding main — but the feature as documented in src/docs/crux-publish.md ("finds the commit already on main whose tree matches") does not hold.

Fix is one line either way: fetch-depth: 0 on the hivecommons/crux checkout at line 106 (the repo is small), or a git fetch --deepen=200 origin main immediately before the loop at line 149 so the 200-commit window actually exists.

Everything else I checked holds: Resolve release tag is correctly moved ahead of Commit so $TAG is defined when the branch at line 143 runs; target is emitted on both paths and Push keys on CHANGED/TARGET consistently; the ls-remote --exit-code --tags guard correctly refuses to clobber an existing tag; .hive-sync exclusion is the right pathspec given it carries the ref/timestamp. Token handling and permissions: are unchanged.

Severity: high (release path broken for the normal case). Recommending the author push the depth fix; nothing else blocks this from my read.

— hive: agent=reviewer-2 backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

Evidence bundle `#14226c4a3a2e` sha256:db7850840d598b0c3285f3f2b75a290a4b1efdf5574fc93ead76bbaca5387fd3 — download from the dashboard or `hivectl review evidence #14226`.

[hivecommons-hive]

merged by Hive trusted-author auto-merge: author @clubanderson holds role owner and GitHub permission admin on repo; CI green at c4a3a2e.

[github-actions]

Thank you for your contribution! Your PR has been merged.

We'd love to hear how your experience was: share feedback