From f1c77d5a2b311237ebd5be0265551cd978daabde Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Thu, 6 Aug 2026 09:47:48 +0800 Subject: [PATCH] ci: let the READMEs name the old repository without pointing at it The previous commit added a rename note to both READMEs and broke the gate I added one commit earlier. That gate rejected the string pgsty/minio anywhere outside three guard files, which was the wrong invariant: the point is that the old name must never be a live target, not that it must never be spoken. A README explaining where the MinIO-named artifacts went has to name them, and doing so is the opposite of stranding a reader on a dead repository. Split into two rules that say what is actually meant: - No live URL may resolve to the old repository anywhere, READMEs included - github.com/pgsty/minio and hub.docker.com/r/pgsty/minio are rejected outright. This is the rule that protects users. - The bare name is allowed only in five files: the pinned pre-rebrand image digest in the upgrade test, the two guards that refuse a legacy image, and the two READMEs. Both halves are negative-tested: adding a github.com/pgsty/minio link to README.md fails rule one, and adding a bare pgsty/minio to docs/docker/README.md fails rule two. Co-Authored-By: Claude Opus 5 (1M context) --- buildscripts/verify-rebrand.sh | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/buildscripts/verify-rebrand.sh b/buildscripts/verify-rebrand.sh index 56802d297..92236c4a0 100755 --- a/buildscripts/verify-rebrand.sh +++ b/buildscripts/verify-rebrand.sh @@ -135,11 +135,28 @@ if rg -n 'pgsty/minio:' .github/workflows Dockerfile.goreleaser helm/silo; then fail "an active delivery surface still publishes the frozen pgsty/minio image" fi -# The repository and its default branch are pgsty/silo and main. Only three -# places may still name the old repository, and each one exists to reject or -# freeze it rather than to point users at it: the pinned pre-rebrand image -# digest in the upgrade test, and the two guards that refuse a legacy image. -repo_guard_allowlist='^(buildscripts/minio-upgrade\.sh|buildscripts/verify-rebrand\.sh|buildscripts/helm-migration-guard/main\.go):' +# The repository and its default branch are pgsty/silo and main. The invariant +# is that the old name is never a live target, not that it is never spoken: the +# READMEs have to name it to explain the rename and to point at the archived +# artifacts, which is the opposite of stranding a reader on it. +# +# So two rules. First, no live URL may resolve to the old repository anywhere, +# READMEs included. +stale_repo_url="$(rg -n -e 'github\.com/pgsty/minio' -e 'hub\.docker\.com/r/pgsty/minio' \ + --glob '!.git/**' --glob '!dist/**' \ + --glob '!SILO_REBRANDING_MIGRATION.md' \ + --glob '!buildscripts/rebrand-guard/compat-baseline.json' . | + sed 's#^\./##' | grep -v '^buildscripts/verify-rebrand\.sh:' || true)" +if [ -n "${stale_repo_url}" ]; then + printf '%s\n' "${stale_repo_url}" >&2 + fail "a link still resolves to the pre-rename pgsty/minio repository" +fi + +# Second, the bare name may only appear where it is deliberate: the pinned +# pre-rebrand image digest in the upgrade test, the two guards that refuse a +# legacy image, and the two READMEs that document the rename and the archived +# minio branch. +repo_guard_allowlist='^(buildscripts/minio-upgrade\.sh|buildscripts/verify-rebrand\.sh|buildscripts/helm-migration-guard/main\.go|README\.md|README_ZH\.md):' stale_repo="$(rg -n 'pgsty/minio' --glob '!.git/**' --glob '!dist/**' \ --glob '!SILO_REBRANDING_MIGRATION.md' \ --glob '!buildscripts/rebrand-guard/compat-baseline.json' . |