Zwei gemessene Befunde festhalten: leichtgewichtige Tags und verwaiste Verweise
Der Umzug von publish-helm-chart nach workflow-util/pipelines hat beides
geliefert. Erstens: tag.gpgsign erzwingt hier die annotierte Form, git tag
kann keinen leichtgewichtigen Tag erzeugen - update-ref ist der Weg, und
cat-file -t ist die Prufung. Zweitens: Ein ausgezogener Dateiname macht
seine Verweise nicht veraltet, sondern falsch; ein Kommentar, der eine
verschwundene Nachbardatei als ausfuhrliche Begrundung zitiert, liest sich
weiterhin vollstandig.
The instructions block is a snapshot from session start
Forge-and-Tooling: correct the mechanism. The block is not a live read of
the spawning session's working directory but a snapshot taken when that
session started, so fetching mid-session does not refresh it — the file
on disk can be correct while every agent started afterwards still gets
the superseded rules. Records the measurement that shows it: a directory
fast-forwarded and verified beforehand, an agent worktree identical to
origin/main (0 0), and a block from before Gitea #47 regardless. States
the two consequences that hold, separately from the ones that do not.
Lessons-Learned: a new entry, because the failure form is the one this
page collects — a stale instructions block looks exactly as
authoritative as a current one, like the probe that cannot fail and the
required array that never fires. Both measurements included, and the
point that it went well only because someone checked. One bullet added
to "The recurring shape".
Cut every worktree from a freshly fetched origin/main; name the wiki branch
Forge-and-Tooling gets the long form of both facts: a worktree branched
from the local main ref can be many merges behind, and the staleness is
invisible because a subagent's project-instructions block is read from
the spawning session's working directory. Diffs are therefore read
against origin/main, never against main. Both 2026-09-27 measurements
are recorded, including the 105-versus-one-line comparison.
The wiki's own default branch is main, not master — stated where the
clone is described, and again in Workflow next to the fetch-and-rebase
rule, which is where reaching for origin/master actually failed.
CI/CD: the all-charts install-test, and where the install-test job now lives
The install-test job moved into the reusable install-test.yml with two
callers - the PR pipeline with the charts a pull request changed, the new
install-test-all-charts.yml with every installable chart, on demand
(Gitea #52).
CI-CD: a section on the all-charts run - why it exists (the accidental
first one, Gitea PR #48: 19 of 20 charts Ready in 12m41s, rss-bridge not),
when to run it, what it records, the 20-charts-in-12m41s expectation, and
that it runs the same job with a different matrix. Plus the runtime row,
the shared-job note under the install-test stage, and select-charts next
to detect-changed-charts where the exclusion list is read.
Forge-and-Tooling: the quoted required-check name predates the move of the
job into a called workflow - read the current one off a real run.
Lessons-Learned: the green history from another machine, and one line in
the recurring shape about making an accidental answer repeatable.
Home: a row for "does every chart still come up on the current runner".
Both version rows leave every chart page's at-a-glance table; the image
repository stays, because it does not rot. A plain app-version bump obliges
no wiki edit — that rule is deliberate and stays — so any number written
here is stale within a Renovate round, as urlaubsverwaltung's already was.
Chart.yaml is where the pair is read, exactly as the chart index has said
from the start.
Home and Workflow no longer promise version snapshots. Forge and tooling
described remotes named github and JLab-Git; the checkout has exactly one,
origin, pointing at Gitea. Workflow gains the rule the wiki never had:
fetch and rebase before every push, never force-push.
Renovate: the PR policy after the alignment with cluster-config
The config now matches cluster-config's: global automerge with
platformAutomerge, no PR caps, separateMinorPatch, config:best-practices.
Two statements on these pages had become false and are rewritten rather
than left standing: that Renovate merges its own PRs because main has no
required status checks, and that majors are merged by hand. Both are
active on main now - a review requirement and validate-charts as the
single status context the matrix reports under - which is precisely why
platformAutomerge could be turned on and why automerging majors is not
unattended: the review is the gate.
Touches Renovate (PR policy), Forge-and-Tooling (auto-merge, required
check), Versioning (the order of a stepwise major jump is kept at the
review now), CI-CD (required check, why the install-test blocks), and the
two pages quoting the searxng downgrade as something that happened
"unattended".
One page per chart - prerequisites, installation walkthrough, the required
1Password fields, the complete values reference and the chart's operating
traps - plus the long form of the workflow, the forge and its measured
differences, the pipelines, versioning, Renovate, the chart style guide, the
procedure for a new chart, local development, and the incidents each rule was
bought with.
Chart pages quote versions as snapshots; Chart.yaml stays authoritative,
because Renovate moves app versions continuously and never edits the wiki.
jklein