From a411ec3c90b4376c1cb46bc1f67bc989f5835e87 Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Tue, 13 Oct 2026 10:25:55 +0000 Subject: [PATCH 1/2] docs(rss-bridge): phrase the reproduced green without a run count The count was pinned at "two consecutive runs" and a third green arrived with the next push, which is a regress: every commit that records the number invalidates it. Phrased as "every run of that branch since" instead, which is stable, still establishes that it is not a fluke, and cannot go stale in main. The caution it carries is unchanged and is the one that matters: it is a colour, not a cause. Nobody has identified what changed on the runner, and #51's diagnostic programme is still unexecuted. --- README.md | 2 +- ci/httproute/rss-bridge.yaml | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index e7e6f82..7e2f159 100644 --- a/README.md +++ b/README.md @@ -183,7 +183,7 @@ Three things to know before touching it: Measured in CI (run 719, the pilot): **30 charts, 4 assertions held**, whole job 13 s including checkout and the Helm setup, no cluster. Group 1 took that to 20 assertions over 10 charts and group 2 to 36 over 15; the prefix/redirect pairing of Gitea #118 adds the first check since the pilot rather than a chart, which brought it to 37 over 15 — one assertion for `freesailarr`'s `/qbittorrent`, plus one more "not checked" line for the backend-less redirect rule it demands. Group 3 took it to `56` assertions over `21` charts, from six charts of which three contribute more than one route: `keycloak` 4 (public and admin routes), `matrix-synapse` 4 (homeserver and delegation routes), `homeassistant` 5 (two routes, three rules — its overlay was the first in the repo that has to *supply* hostnames, since the chart has no `ingress.domain`), `bulwark` 2, `stalwart` 2, `ytdlp-web-player` 2. **`rss-bridge` finishes the sweep at `58` assertions over `22` charts** — read on this branch, which does **not** contain the realm-hostname round of Gitea #122 (measured separately at `60` over `21`, on a branch that did not contain `rss-bridge`). **Neither total includes the other, so the figure to trust from either is the delta**; the running total is whatever the first run on `main` prints once both have landed, and it should be read there rather than added up by hand. The delta here is one route, so two assertions, and its overlay is the **second** that has to supply hostnames — for a different reason than `homeassistant`'s, which is worth keeping apart. `homeassistant` has no `httpRoute.hostnames` key at all and its overlay supplies the names through `ingress.hosts`; `rss-bridge` *has* the key and its overlay fills it, because this chart has no `ingress.domain` to fall back to either but its hostnames are unambiguous (one Service, one path). -**And in the same PR that chart's install-test went green, which is the event Gitea #51 was waiting for.** It had failed on the Gitea runner for months (uid 33 unable to read `/app/index.php`, startup probe 403 through its whole budget), and the chart was deliberately kept *out* of `ci/excluded-charts.txt` precisely so that the day it passed would be noticed rather than silenced. It passed: k3d cluster up, `helm install` in Ingress mode, pod `1/1 Ready` in 22 s with 0 restarts, and no `Permission denied` anywhere in the job. **The chart cannot be the reason, and that is measured rather than argued** — the rendered output for the fixture values is byte-identical to `origin/main`, so the pod spec that installed is exactly the one `main` produces. The implicated layer is the runner, which is where #51 had already put the burden of proof. Two cautions belong with the result: **nobody has identified what changed on the runner**, and a green test does not explain itself — it reproduced across two consecutive runs on two different commits of that PR, which is two data points rather than one, but still no cause; and the install covers **Ingress** mode, since that is what the fixture installs — so this chart's Gateway mode stays render-only, exactly like its 21 siblings rather than worse than them. +**And in the same PR that chart's install-test went green, which is the event Gitea #51 was waiting for.** It had failed on the Gitea runner for months (uid 33 unable to read `/app/index.php`, startup probe 403 through its whole budget), and the chart was deliberately kept *out* of `ci/excluded-charts.txt` precisely so that the day it passed would be noticed rather than silenced. It passed: k3d cluster up, `helm install` in Ingress mode, pod `1/1 Ready` in 22 s with 0 restarts, and no `Permission denied` anywhere in the job. **The chart cannot be the reason, and that is measured rather than argued** — the rendered output for the fixture values is byte-identical to `origin/main`, so the pod spec that installed is exactly the one `main` produces. The implicated layer is the runner, which is where #51 had already put the burden of proof. Two cautions belong with the result: **nobody has identified what changed on the runner**, and a green test does not explain itself — it has reproduced on every run of that branch since, across several commits, so it is not a fluke - but that is still a colour and not a cause; and the install covers **Ingress** mode, since that is what the fixture installs — so this chart's Gateway mode stays render-only, exactly like its 21 siblings rather than worse than them. The fail path was exercised rather than assumed: a Service renamed in the route, a port the Service does not expose, a port left out entirely, an emptied `parentRefs` with the chart's own guard disabled, an overlay that renders no route, a run with zero assertions, and — for the pairing — both the redirect rule deleted outright and the redirect pointed at a path other than the one stripped; each produced a `FAIL` naming both sides and a non-zero exit. diff --git a/ci/httproute/rss-bridge.yaml b/ci/httproute/rss-bridge.yaml index e8f4f6f..0dbc25f 100644 --- a/ci/httproute/rss-bridge.yaml +++ b/ci/httproute/rss-bridge.yaml @@ -28,8 +28,9 @@ # in the job. Since that PR's rendered defaults are byte-identical to # origin/main, the chart is ruled out as the cause and the runner is the # implicated layer - which is where #51 had already placed it. It reproduced -# over two consecutive runs, but nobody has identified what changed there, so -# #51 is not closed on the strength of a colour. +# on every run of that branch since, so it is not a fluke; but nobody has +# identified what changed on the runner, so #51 is not closed on the strength +# of a colour. # # Either way this overlay stays load-bearing: the install-test installs the # INGRESS mode (that is what the fixture sets), so the Gateway mode of this -- 2.54.0 From f530f58b1de29de1779bc1d78d3e9c2147e80e70 Mon Sep 17 00:00:00 2001 From: Justin Klein Date: Tue, 13 Oct 2026 10:28:09 +0000 Subject: [PATCH 2/2] docs(rss-bridge): #51 was closed, and the cause was never identified (2.1.1) PR #124 merged at 12:25 and the maintainer closed #51 one second later, on the strength of that round's green install-test. Three statements that merged with #124 are stale as a result, and they are stale in the direction that matters - they describe a failing test and an open issue: - rss-bridge/templates/rss-bridge.httproute.yaml and values.yaml said the install-test "fails on the Gitea runner (#51)", in the present tense, and values.yaml added "and that test is still red". - ci/httproute/rss-bridge.yaml said "#51 is not closed on the strength of a colour", which was true when written and is now the opposite of what happened. Replaced with what is actually known, and the emphasis moved to the part that outlives the colour: the test went green on a render byte-identical to main, which rules the chart out and leaves the runner - and THE CAUSE WAS NEVER IDENTIFIED. The diagnostic programme in #51 (docker info for userns and the dind configuration, the same image in a local k3d without remapping) was not executed. So a recurrence is a fresh finding rather than a known quirk, and the overlay comment now says so where whoever sees the red will be reading. Also carries the wording change that was already on this branch when #124 merged: the reproduced green is phrased as "every run of that branch since" rather than pinned to a count, because each commit recording the count invalidated it - a third green arrived with the push after "two". Patch bump, per the rule #40 was argued on: a comment in a chart directory is still a change to that chart, so it is a patch plus a publish. No template output changes - the render for the fixture values is byte-identical to the pre-#124 main, which the tests re-confirm. --- ci/httproute/rss-bridge.yaml | 10 +++++++--- rss-bridge/Chart.yaml | 2 +- rss-bridge/templates/rss-bridge.httproute.yaml | 7 +++++-- rss-bridge/values.yaml | 8 +++++--- 4 files changed, 18 insertions(+), 9 deletions(-) diff --git a/ci/httproute/rss-bridge.yaml b/ci/httproute/rss-bridge.yaml index 0dbc25f..338dfe6 100644 --- a/ci/httproute/rss-bridge.yaml +++ b/ci/httproute/rss-bridge.yaml @@ -28,9 +28,13 @@ # in the job. Since that PR's rendered defaults are byte-identical to # origin/main, the chart is ruled out as the cause and the runner is the # implicated layer - which is where #51 had already placed it. It reproduced -# on every run of that branch since, so it is not a fluke; but nobody has -# identified what changed on the runner, so #51 is not closed on the strength -# of a colour. +# on every run of that branch since, so it is not a fluke, and #51 was closed +# on that round. What was NEVER identified is the cause: nobody established +# what changed on the runner, and the diagnostic programme in that issue +# (docker info for userns and the dind configuration, the same image in a +# local k3d without remapping) was not executed. So if this chart's +# install-test goes red again, that is a fresh finding and not a known quirk - +# and this comment is the context it should be read against. # # Either way this overlay stays load-bearing: the install-test installs the # INGRESS mode (that is what the fixture sets), so the Gateway mode of this diff --git a/rss-bridge/Chart.yaml b/rss-bridge/Chart.yaml index 6583c8e..f2d9259 100644 --- a/rss-bridge/Chart.yaml +++ b/rss-bridge/Chart.yaml @@ -5,7 +5,7 @@ icon: https://raw.githubusercontent.com/RSS-Bridge/rss-bridge/master/static/logo type: application -version: 2.1.0+up2026.09.30 +version: 2.1.1+up2026.09.30 appVersion: "2026-09-30" maintainers: diff --git a/rss-bridge/templates/rss-bridge.httproute.yaml b/rss-bridge/templates/rss-bridge.httproute.yaml index 928c171..31260a6 100644 --- a/rss-bridge/templates/rss-bridge.httproute.yaml +++ b/rss-bridge/templates/rss-bridge.httproute.yaml @@ -2,8 +2,11 @@ The Gateway-API alternative to rss-bridge.ingress.yaml (Gitea #114), and the LAST chart of that sweep: 22 charts carried an Ingress template and 21 an HTTPRoute template, and the difference was this one. It was held back because -its install-test fails on the Gitea runner (#51), not for anything about its -shape. +its install-test had been failing on the Gitea runner (#51), not for anything +about its shape - and that test went green in the very PR that converted it, +on a render byte-identical to main, which is what ruled the chart out and left +the runner. #51 was closed on the strength of that round; the cause was never +identified, so a recurrence is a fresh finding rather than a known quirk. WHAT THIS RENDERS, AND WHAT IT DELIBERATELY DOES NOT diff --git a/rss-bridge/values.yaml b/rss-bridge/values.yaml index 3e2d21b..b5a4066 100644 --- a/rss-bridge/values.yaml +++ b/rss-bridge/values.yaml @@ -272,9 +272,11 @@ ingress: # THE GATEWAY-API ALTERNATIVE TO THE INGRESS ABOVE (Gitea #114), and this chart # is the LAST of that sweep - 22 charts carried an Ingress template, 21 an # HTTPRoute template, and the difference was this one. It was held back because -# its install-test fails on the Gitea runner (#51), not for anything about its -# shape, and that test is still red: the failure is a known, bounded -# environment defect and no finding about this mode. +# its install-test had been failing on the Gitea runner (#51), not for anything +# about its shape - and that test went green in the very PR that converted it, +# on a render byte-identical to main, which ruled the chart out and left the +# runner. #51 was closed on that round; the cause was never identified, so a +# recurrence is a fresh finding rather than a known quirk. # # Off by default, so an existing release is unaffected. Mutually exclusive with # ingress.enabled - the render aborts when both are true, naming both value -- 2.54.0