orca/.ciagent/PLAN_v0.16.md

PLAN v0.16: Release Binary Asset Fix

Milestone Summary

Milestone: v0.16 (fix type — tags on v0.15.x patch line) Phases: P0 (pre-execution) → P1 (fix) → P2 (final review+ship) Requirements: REQ-183 (clone auth), REQ-184 (.coreci.yml rewrite)

Phase 1: Fix Gitea Actions clone auth + rewrite .coreci.yml

Wave 1: Both fixes (single wave — they are independent files)

Task 1.1 (REQ-183): Fix .gitea/workflows/release.yml — auth the coreci clone

File: .gitea/workflows/release.yml

Current failing step:

- name: Install CoreCI
  run: |
    git clone --depth=1 https://git.cloudinit.dev/coreci/coreci.git /tmp/coreci
    cd /tmp/coreci
    CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci
    coreci version

Fix: add GITEA_TOKEN env and embed in clone URL:

- name: Install CoreCI
  env:
    GITEA_TOKEN: ${{ secrets.PAT_TOKEN }}
  run: |
    git clone --depth=1 https://cloudinit-bot:${GITEA_TOKEN}@git.cloudinit.dev/coreci/coreci.git /tmp/coreci
    cd /tmp/coreci
    CGO_ENABLED=0 go build -tags sqlite_go,embed -o /usr/local/bin/coreci ./cmd/coreci
    coreci version

Task 1.2 (REQ-184): Rewrite .coreci.yml to CoreCI native jobs: format

File: .coreci.yml

Convert from pipelines:/steps:/image:/commands: to jobs:/plugin:/invoke:/vars: with a DAG.

DAG structure:

go-vet ──→ verify-reqs ──┐
      ├──→ gosec ────────┤
      ├──→ govulncheck ──┤──→ build ──→ test ──→ release
      └──→ gitleaks ─────┘

Key adaptations:

• plugin: docker://golang:1.25.12 on each job (container if available, shell-isolated fallback)
• invoke: | for multi-line commands (shell expansion works via sh -c)
• GITEA_TOKEN via vars: { GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }} } (resolved from env)
• CI_COMMIT_BRANCH (tag name on tag push) and CI_COMMIT_SHA for version injection
• No tag-conditional rules (workflow gates on on: push: tags: ['v*'])
• release job: build tarball + SHA256SUMS, install tea via curl, create release with assets (fallback to Gitea API asset attachment if release exists), verify asset count ≥ 2 (REQ-097 gate C-21)
• No apk add (runner is ubuntu, not alpine)

Must-haves (verification gates)

• .gitea/workflows/release.yml "Install CoreCI" step has GITEA_TOKEN env and token in clone URL
• .coreci.yml uses jobs: top-level key (not pipelines:)
• Each job has plugin: and/or invoke: (mutually exclusive rule)
• DAG via needs: (validate → build → test → release)
• GITEA_TOKEN passed via job vars: with ${{ secrets.GITEA_TOKEN }}
• Release job handles duplicate release (fallback to API asset attachment)
• Release job verifies asset count ≥ 2 (REQ-097)
• No apk add commands (ubuntu runner, not alpine)
• No ${VAR} interpolation in YAML fields (only in invoke: via sh -c)
• make verify-reqs passes (ROADMAP ↔ REQUIREMENTS consistency)

Verification

1. make verify-reqs — ROADMAP/REQUIREMENTS consistency
2. go vet ./... — no vet errors
3. gofmt -l . — no formatting issues
4. YAML validity check for .coreci.yml and .gitea/workflows/release.yml
5. Confirm .coreci.yml has jobs: key and at least 5 jobs (go-vet, verify-reqs, gosec, govulncheck, gitleaks, build, test, release)
6. Confirm .gitea/workflows/release.yml "Install CoreCI" step references GITEA_TOKEN