fix(release-agent): restore go's hermetic HOME, and record what #440 excluded #486

Merged

gmackie merged 1 commit from fix/release-agent-hermetic-go into main

2026-08-27 17:52:32 +00:00

gmackie commented

2026-08-27 17:34:38 +00:00

Owner

Two corrections to #440, both mine, found by a post-merge review.

1. Restore `env -u HOME` around the go build

#434 ran go as nix shell nixpkgs#go_1_25 -c env -u HOME go build … specifically so go could not read $HOME/.config/go/env — a stray GOFLAGS or GOPROXY on the runner host would otherwise reach release binaries.

Collapsing the three per-arch shells into one dropped that flag silently. Nothing broke (GOPATH/GOMODCACHE/GOCACHE are pinned explicitly and 0.1.61 built clean), but the hermeticity was deliberate and was not meant to go. It now wraps the whole build block, so it covers all three targets rather than a single invocation.

Checked before restoring it: nothing inside that block reads HOME, so it is safe under set -u, and the Go cache vars are exported before the shell, so env -u HOME leaves them intact.

2. Record that tag-via-git-push was deliberately excluded

#440 carried a fourth commit (425448ef) replacing the tags REST call with git push https://${GIT_API_TOKEN}@…. It was dropped during the rebase as superseded — but the squashed merge title on main still names it. A commit message advertising a change that is not in the tree is exactly how a future session re-derives it believing it was lost.

The comment now records why it was refused:

it puts the secret in argv, where ps and git's own error output echoing the remote can leak it
it would have replaced the RUN_TOKEN fallback with a single un-fallback-ed path

And the empirical part: the REST route has tagged 0.1.58, 0.1.59, 0.1.60 and 0.1.61 without once reaching the fallback, so 425448ef's premise ("the tags API returns 401 for it") no longer holds.

Worth knowing separately

Main's RUN_TOKEN fallback has never executed in production — the primary path has won every release since it landed. It is untested insurance if GIT_API_TOKEN ever expires.

Also unaddressed here (harmless, left alone deliberately): the Build step now exports HOME twice, at lines 75 and 80. The first wins, so the /tmp/forgegraph-release-home fallback is dead code and its explanatory comment describes a line that does nothing. Tidying it would be churn in a hot path for no behavioural gain.

Two corrections to #440, both mine, found by a post-merge review. ## 1. Restore `env -u HOME` around the go build #434 ran go as `nix shell nixpkgs#go_1_25 -c env -u HOME go build …` specifically so go could not read `$HOME/.config/go/env` — a stray `GOFLAGS` or `GOPROXY` on the runner host would otherwise reach release binaries. Collapsing the three per-arch shells into one dropped that flag **silently**. Nothing broke (GOPATH/GOMODCACHE/GOCACHE are pinned explicitly and 0.1.61 built clean), but the hermeticity was deliberate and was not meant to go. It now wraps the whole build block, so it covers all three targets rather than a single invocation. Checked before restoring it: nothing inside that block reads `HOME`, so it is safe under `set -u`, and the Go cache vars are exported before the shell, so `env -u HOME` leaves them intact. ## 2. Record that tag-via-git-push was deliberately excluded #440 carried a fourth commit (`425448ef`) replacing the tags REST call with `git push https://${GIT_API_TOKEN}@…`. It was dropped during the rebase as superseded — but the squashed merge title on main **still names it**. A commit message advertising a change that is not in the tree is exactly how a future session re-derives it believing it was lost. The comment now records why it was refused: - it puts the secret in argv, where `ps` and git's own error output echoing the remote can leak it - it would have replaced the `RUN_TOKEN` fallback with a single un-fallback-ed path And the empirical part: the REST route has tagged **0.1.58, 0.1.59, 0.1.60 and 0.1.61** without once reaching the fallback, so `425448ef`'s premise ("the tags API returns 401 for it") no longer holds. ## Worth knowing separately Main's `RUN_TOKEN` fallback has **never executed in production** — the primary path has won every release since it landed. It is untested insurance if `GIT_API_TOKEN` ever expires. Also unaddressed here (harmless, left alone deliberately): the Build step now exports `HOME` twice, at lines 75 and 80. The first wins, so the `/tmp/forgegraph-release-home` fallback is dead code and its explanatory comment describes a line that does nothing. Tidying it would be churn in a hot path for no behavioural gain.

gmackie added 1 commit

2026-08-27 17:34:38 +00:00

fix(release-agent): restore go's hermetic HOME, and record what #440 excluded

CI / gitleaks (pull_request) Successful in 8s

Details

CI / storybook (pull_request) Successful in 2m17s

Details

forgegraph/ci CI passed

CI / ci (pull_request) Successful in 11m26s

Details

a784f9e726

Two corrections to #440, both mine.

**Restore `env -u HOME` around the go build.** #434 ran go as
`nix shell nixpkgs#go_1_25 -c env -u HOME go build …` so that go could not
read `$HOME/.config/go/env`; a stray GOFLAGS or GOPROXY on the runner host
would otherwise reach release binaries. Collapsing the three per-arch shells
into one dropped that flag silently. Nothing broke — GOPATH/GOMODCACHE/GOCACHE
are pinned explicitly and 0.1.61 built clean — but the hermeticity was real and
was not meant to go. It now wraps the whole build block, which covers all three
targets rather than one invocation.

Checked: nothing inside that block reads HOME, so it is safe under `set -u`,
and the cache vars are exported before the shell so `env -u HOME` leaves them
intact.

**Record that tag-via-git-push was deliberately excluded.** #440 carried a
commit replacing the tags REST call with `git push
https://${GIT_API_TOKEN}@…`; it was dropped during the rebase, but the squashed
merge title still advertises it. That combination is how a future session
re-derives the change believing it was lost. The comment now states why it was
refused: the secret lands in argv where `ps` and git's own error output can
leak it, and it would have replaced the RUN_TOKEN fallback with a single
un-fallback-ed path. The REST route has tagged 0.1.58 through 0.1.61 without
once reaching the fallback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

gmackie commented

2026-08-27 17:38:27 +00:00

Author

Owner

Preview environment is live: https://pr-486-forgegraph.forgegraf.com

Deployed a784f9e7 with the beta stage's environment. It redeploys on every push and is destroyed when this PR closes.

Preview environment is live: https://pr-486-forgegraph.forgegraf.com Deployed `a784f9e7` with the beta stage's environment. It redeploys on every push and is destroyed when this PR closes.

gmackie merged commit 1c2c415e3c into main

2026-08-27 17:52:32 +00:00

gmackie referenced this pull request from a commit

2026-08-27 17:52:33 +00:00

fix(release-agent): restore go's hermetic HOME, and record what #440 excluded (#486)