148 lines
6.8 KiB
Markdown
148 lines
6.8 KiB
Markdown
# Feature 0013 Remediation Review
|
|
|
|
Status: resolved
|
|
|
|
Reviewed implementation and release state:
|
|
|
|
- Application-role `v0.1.0` tags at the five roadmap-fixed commits
|
|
- Pipeline release commit and tag
|
|
`7c2bad827702fdcf78f8f77ece7d6270756bc3c5`
|
|
- Collection subtree import
|
|
`da348eb8bd9878a58404a37dbcf22ad6562ac5c9`
|
|
- Collection release commit and tag
|
|
`63e8f3fb090a583226c7435bd900e10d41a30b89`
|
|
- Public `rakestraw.dnd 0.1.0` Gitea release and
|
|
`rakestraw-dnd-0.1.0.tar.gz` attachment
|
|
- Workspace implementation record through
|
|
`06e1b35f25589a3a6ff3fd2884208c86c4fee9c4`
|
|
|
|
## Review Summary
|
|
|
|
Feature 0013 implements the release architecture and public consumer path.
|
|
The five application-role tags identify the exact reviewed commits selected by
|
|
the roadmap. The standalone pipeline and collection manifests use those
|
|
immutable tags, and the native collection dependencies remain pinned to
|
|
`ansible.posix` 2.2.0 and `community.general` 13.3.0. The collection subtree's
|
|
Git tree exactly matches public pipeline tag `v0.1.0`.
|
|
|
|
All seven repositories and tags are public and synchronized with their local
|
|
counterparts. The collection's non-draft, non-prerelease Gitea release carries
|
|
one correctly named archive. Its manifest declares `rakestraw.dnd` 0.1.0, the
|
|
expected Ansible baseline and collection dependencies, and its file payload
|
|
matches a fresh build from the tagged collection tree.
|
|
|
|
One low-severity documentation issue remains. The pipeline README now implies
|
|
that collection snapshots may be imported only from role releases. That
|
|
strengthens the settled maintenance contract beyond the requested release
|
|
feature and contradicts the documented development workflow, which also
|
|
permits a reviewed, pushed commit.
|
|
|
|
## Finding 1: Pipeline Documentation Narrows Subtree Imports to Releases
|
|
|
|
Severity: low
|
|
|
|
`ansible-role-dnd-pipeline/README.md:51-53` says that collection maintainers
|
|
“import a reviewed release as a snapshot.” The same sentence is present in the
|
|
faithfully imported collection copy at
|
|
`ansible-collection-dnd/roles/pipeline/README.md:51-53`.
|
|
|
|
That wording accurately describes the particular snapshot used for collection
|
|
release 0.1.0, but it reads as the general maintenance rule. The durable
|
|
architecture deliberately permits the collection to import any reviewed
|
|
pipeline commit that has been pushed to Gitea during development. An immutable
|
|
pipeline tag is required only when preparing a released compatibility set.
|
|
The collection's own maintenance section correctly accepts a pushed commit or
|
|
immutable tag.
|
|
|
|
This is an inadvertent requirement strengthening: it could force an otherwise
|
|
unnecessary pipeline-role release merely to assemble and test a development
|
|
collection snapshot. It does not affect runtime behavior, the released
|
|
dependency pins, subtree fidelity, or consumer installation.
|
|
|
|
### Required Remediation
|
|
|
|
- In the authoritative pipeline README, replace the release-only wording with
|
|
concise language saying that collection maintainers import a reviewed,
|
|
pushed commit or immutable tag as a snapshot.
|
|
- Make no role, manifest, default, task, template, handler, or test change.
|
|
- Commit and push the pipeline documentation correction before importing it
|
|
into the collection.
|
|
- Refresh `roles/pipeline` through the documented squashed subtree command
|
|
using the pushed pipeline documentation commit as the remote revision. Do
|
|
not edit the collection's subtree copy directly.
|
|
- Confirm that the resulting collection subtree Git tree exactly matches the
|
|
selected pushed pipeline commit outside Git metadata.
|
|
- Do not move or replace any `v0.1.0` tag, modify the published Gitea release,
|
|
or replace its attachment. Those immutable artifacts correctly describe the
|
|
historical 0.1.0 source state.
|
|
- Do not create a new role or collection release solely for this
|
|
maintainer-facing wording correction.
|
|
|
|
### Required Validation
|
|
|
|
Run:
|
|
|
|
```text
|
|
cd ansible-role-dnd-pipeline
|
|
git diff --check
|
|
|
|
cd ../ansible-collection-dnd
|
|
../.venv/bin/ansible-galaxy collection build --output-path "$(mktemp -d)"
|
|
git diff --check
|
|
```
|
|
|
|
Also compare the imported `roles/pipeline` tree with a disposable clone of the
|
|
selected pushed pipeline commit. The full application, pipeline, and
|
|
collection integration suites do not need to be rerun because the remediation
|
|
changes documentation only and preserves all Ansible and dependency content.
|
|
|
|
## Resolution
|
|
|
|
Resolved in pipeline commit `78afffe` and collection subtree import
|
|
`5e695f3`.
|
|
|
|
The authoritative pipeline README now states that collection maintainers may
|
|
import either a reviewed, pushed commit or an immutable tag. The pipeline
|
|
commit was pushed before the collection imported that exact Gitea revision
|
|
through the documented squashed subtree workflow. The imported subtree and
|
|
pipeline source have the same Git tree ID,
|
|
`37f619ac24d2303847c4b9ea60db1f9fc1bf9d0e`.
|
|
|
|
A fresh collection build succeeded, and `git diff --check` passed in both
|
|
repositories. No Ansible content or dependency selection changed, so the
|
|
integration suites were not rerun. The seven `v0.1.0` tags, published
|
|
collection release, and release attachment remain unchanged.
|
|
|
|
## Review Validation Evidence
|
|
|
|
- Every local and remote `v0.1.0` tag resolves to the commit recorded in the
|
|
Feature 0013 roadmap and implementation notes.
|
|
- All seven Gitea repositories report public visibility and `main` as their
|
|
default branch.
|
|
- The pipeline `v0.1.0` tree ID and the collection tag's
|
|
`roles/pipeline` tree ID are both
|
|
`44a9d2b010012d8a63720b3a4ed07e9f255a5dae`.
|
|
- The tagged raw collection manifest matches the repository manifest, and its
|
|
role and collection selections match the released pipeline manifests.
|
|
- The public release API reports tag `v0.1.0`, title
|
|
`rakestraw.dnd 0.1.0`, `draft: false`, `prerelease: false`, and one
|
|
`rakestraw-dnd-0.1.0.tar.gz` attachment.
|
|
- The published archive has the same file list, `MANIFEST.json`, `FILES.json`,
|
|
and file payload hashes as a fresh collection build from the tagged tree.
|
|
It contains the pipeline entry point and omits the selected development-only
|
|
subtree files.
|
|
- A fresh unauthenticated clone and release-attachment download installed the
|
|
five public role tags and the collection into isolated Ansible paths. The
|
|
installed `rakestraw.dnd.pipeline` role converged successfully and its
|
|
immediate repeat reported `changed=0` and `failed=0`.
|
|
- The complete repository-local collection integration suite independently
|
|
passed isolated bootstrap, collection build and installation, syntax check,
|
|
production-profile lint, native application validation, and immediate clean
|
|
convergence.
|
|
- `git diff --check` passes for the pipeline, collection, and workspace
|
|
implementation ranges. All workspace repositories are clean and synchronized
|
|
with their upstream branches before this review finding is recorded.
|
|
|
|
No runtime code-quality issue, release-architecture gap, test-policy violation,
|
|
or other inadvertent requirement strengthening was found.
|