ci(promote): finpilot main → stable 2026-09-14

[github-actions]

🦕 Finpilot testing → stable · 2026-09-14

319 days since the last stable release · v1.0.0 ↗
Auto-maintained by promote-testing-to-main.yml · Updated 2026-09-14T00:36:12Z · Run ↗

Release checklist

✅ All checks passed

Check	Status	Details
Digest resolution	✅ passed	Resolved 1 digest(s) from testing.
Cosign signatures	✅ passed	All resolved digests passed cosign verification.
E2E	⏭️ skipped	E2E check disabled by caller. Caller disabled the E2E gate.

Variants being promoted

Variant	Tag
finpilot	:testing

Changes since last stable

121 commits ahead of stable · Compare main…testing ↗

Recent commits (showing last 20)

SHA	Subject
be4b0eb	Merge pull request #365 from projectbluefin/quality/test-justfile-clean-sudoif
df6fd96	[quality] test: executed coverage for Justfile clean, sudo-clean and sudoif
dd3b1fd	Merge pull request #338 from projectbluefin/renovate/github-actions-(non-major)
7c3995c	Merge pull request #359 from projectbluefin/arch/validate-flatpaks-extract
f297208	Merge pull request #345 from projectbluefin/renovate/quay.io-fedora-ostree-desktops-silverblue-44
e9661a1	Merge pull request #341 from projectbluefin/renovate/projectbluefinactions
b3d0ab4	Merge remote-tracking branch 'origin/main' into renovate/projectbluefinactions
1bcdf13	[architect] refactor: extract flatpak preinstall validation into build/validate-flatpaks.sh
830e41d	chore(deps): update quay.io/fedora-ostree-desktops/silverblue:44 docker digest to 065a194
2cff419	chore(deps): align Homebrew actions pin
1db684b	Merge pull request #328 from mrbobbytables/docs/document-e2e-gate-risk-281
f64a645	Merge branch 'main' into docs/document-e2e-gate-risk-281
9a5504c	Merge pull request #336 from projectbluefin/renovate/quay.io-fedora-ostree-desktops-silverblue-44
b840f27	chore(deps): update quay.io/fedora-ostree-desktops/silverblue:44 docker digest to c05886f
fe328d4	Merge pull request #340 from projectbluefin/quality/test-check-token-health
e365158	fix(test): use portable shebang in mock curl script
bef946b	chore(deps): update projectbluefin/actions digest to 2564c7b
7ed95b4	ci: rerun failing checks
c0a096d	test(quality): BATS coverage for .github/actions/check-token-health/check_token_health.sh
e006d09	chore(deps): update homebrew/actions digest to 6373c73

---

Follow this repository's branch-protection requirements before merging. Force: gh pr merge <pr-number> --repo projectbluefin/finpilot --merge --admin

Desktop Screenshot

Caution

Auto-merge scheduled for Tuesday 04:00 UTC (bluefin/dakota) / Thursday 04:00 UTC (bluefin-lts).
To block this release: add the do-not-merge label to this PR before that time.
Remove the label when the issue is resolved -- the next weekly window will pick it up automatically.

[hanthor]

The gate section is honest about what it did not check, and the auto-approver is not unblocking this PR

Two things a reviewer should see before merging a 108-commit promotion.

1. The E2E leg of the release gate did not run

From the gate section in the description:

Check	Status
Digest resolution	✅ passed
Cosign signatures	✅ passed
E2E	⏭️ skipped — "E2E check disabled by caller"

That is accurate and expected — promote-main-to-stable.yml on main currently passes run_e2e: false, with a comment saying so. But it means the release/ready label on this PR attests to digest resolution and signature verification only. No test has been run against the image being promoted to production. #329 is the open PR that would change this. Merging is a judgement call; just do not read release/ready as "tested".

2. The required checks are stuck at action_required, and the workflow meant to fix that is not fixing it

mergeable_state is unstable. The reason is visible in the workflow-run history for this head:

Unit Tests, run_number 53, head_sha 4f0fa19 (this PR's head)
  event: pull_request
  status: completed
  conclusion: action_required
  created_at: 2026-09-10T22:23:16Z
  updated_at: 2026-09-10T22:23:16Z      <-- never touched again

Same for the two earlier heads of this PR (4ff908a, 5412d9c): all three action_required, all three with updated_at == created_at, meaning nothing ever approved them.

This is precisely the condition approve-trusted-promotion-runs.yml was merged to handle (#335, landed 2026-09-08 in 88fb7a1 — two days before the run above was created). Its filters look right on paper for this run: head_repository.full_name == repo ✅, head_branch matches ^auto/promote-(main-to-stable|testing-to-main)$ ✅, actor.login == "github-actions[bot]" ✅, triggering_actor.login == "github-actions[bot]" ✅. Yet the run is still unapproved a day later, on a */15 * * * * schedule.

So one of these is true and somebody should determine which:

• The scheduled workflow is not running at all (worth checking its own run history).
• gh api "repos/${REPO}/actions/runs?status=action_required" is not returning these runs. Note these runs report status: "completed" with conclusion: "action_required" — if the API's status filter is matching on the status field rather than folding in conclusion, the --jq selector never sees them and the job cheerfully prints "No pending trusted promotion runs to approve" and exits 0. That failure mode is silent by construction.
• The approve call is 403ing and being swallowed by the ::warning:: branch.

Either way, the auto-approver is reporting success while the checks it exists to unblock stay blocked, which is worse than it failing loudly. Worth a follow-up issue against #308/#335.

Unrelated but relevant to this queue

The same action_required wall is blocking five other open PRs (#349, #350, #351, #353, #355) — all fork PRs with total_count: 0 check runs. Those need manual "approve and run" from a maintainer; they are not covered by the trusted-promotion-branch filter and never will be, since they are not on auto/promote-*.

---

Generated by Claude Code