werkrevisor 0.31.3: release tools keep only the two newest archives #69

2026-10-09T21:57:56+02:00

claude-code commented

2026-10-09 21:57:56 +02:00

🤖 Generated with Claude Code

See [the PR document](docs/prs/2026-10-09-PR%2369-keep-two-archives.md). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-code added 1 commit 2026-10-09 21:57:57 +02:00

PR document: release tools keep only the two newest archives

werkator build succeeded after 00:13

Details

werkator/werkrevisor-statistics build succeeded after 00:49

Details

bde511bdd9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

mi added 1 commit 2026-10-09 21:59:32 +02:00

build-rootfs and the new deploy-rootfs keep only the two newest archives (0.31.3)

werkator build succeeded after 00:30

Details

werkator/werkrevisor-statistics build succeeded after 01:06

Details

ai-review/assessment AI findings; a developer approval after checking them unlocks the merge; review requested from mi; merge scheduled for when the checks succeed

Details

ai-review/gate build succeeded after 05:52

Details

8a2c916848

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-code marked the pull request as ready for review 2026-10-09 22:00:32 +02:00

ai-reviewer commented

2026-10-09 22:06:35 +02:00

🟠 werkrevisor ORANGE for 8a2c916, superseded by the result for 8e11f82

🟠 werkrevisor: ORANGE / FINDINGS

Change kind: mixed.

Reasons

ORANGE 1 finding(s) that Jev rates as probably real and severe: tools/deploy-rootfs:39
YELLOW risky build changes according to Jev: tools/build-rootfs (weakens checks 0.04, risk 1.91, security 0.02)
hint 4 changed file(s) that neither weaken the checks nor touch security according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.01)
hint 6 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3 according to Jev
hint model recommends merge with caution

Findings

Backup Overwrite at tools/deploy-rootfs:39, severity unknown, counted as medium, ORANGE, as a line comment

Classifier

6 of 6 units passed all questions (1 PR document(s)).

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 12168, calls 1, tokens in 11730 / out 43621 (reasoning included in out), duration 346.8 s, cost 0.0558 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4909, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1550, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 3089 / out 1821, cost 0.0031 USD (reported), PR document check `jev-1.13.0` calls 6, tokens in 9139, cost 0.0004 USD, build file judge `jev-1.13.0` calls 6, tokens in 4851, cost 0.0002 USD, phases: path_judge 0.5 s, classifier 0.5 s, change_summary 15.2 s, doc_check 0.6 s, context 1.5 s, model_review 328.0 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main 62eb894).

Reviewed head `8a2c916848c1a81a975a1f412f58abd76d2d086e` against base `62eb8948ca2d77f2291b38f4473ae55edc8d59eb`, werkrevisor 0.31.2.}

<details><summary>🟠 werkrevisor ORANGE for <code>8a2c916</code>, superseded by <a href="http://git.javagil.de/mi/werkrevisor/pulls/69#issuecomment-2882">the result for <code>8e11f82</code></a></summary> ## 🟠 werkrevisor: ORANGE / FINDINGS Change kind: `mixed`. ### Reasons - **ORANGE** 1 finding(s) that Jev rates as probably real and severe: tools/deploy-rootfs:39 - **YELLOW** risky build changes according to Jev: tools/build-rootfs (weakens checks 0.04, risk 1.91, security 0.02) - **hint** 4 changed file(s) that neither weaken the checks nor touch security according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.01) - **hint** 6 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3 according to Jev - **hint** model recommends merge with caution ### Findings 1. **Backup Overwrite** at `tools/deploy-rootfs:39`, severity unknown, counted as medium, ORANGE, as a line comment ### Classifier 6 of 6 units passed all questions (1 PR document(s)). Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 12168, calls 1, tokens in 11730 / out 43621 (reasoning included in out), duration 346.8 s, cost 0.0558 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4909, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1550, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 3089 / out 1821, cost 0.0031 USD (reported), PR document check `jev-1.13.0` calls 6, tokens in 9139, cost 0.0004 USD, build file judge `jev-1.13.0` calls 6, tokens in 4851, cost 0.0002 USD, phases: path_judge 0.5 s, classifier 0.5 s, change_summary 15.2 s, doc_check 0.6 s, context 1.5 s, model_review 328.0 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main 62eb894). Reviewed head `8a2c916848c1a81a975a1f412f58abd76d2d086e` against base `62eb8948ca2d77f2291b38f4473ae55edc8d59eb`, werkrevisor 0.31.2. </details>

ai-reviewer reviewed

2026-10-09 22:06:35 +02:00

ai-reviewer left a comment

werkrevisor: ORANGE / FINDINGS for 8a2c916848c1a81a975a1f412f58abd76d2d086e.
The result comment of werkrevisor holds the details.

werkrevisor: ORANGE / FINDINGS for `8a2c916848c1a81a975a1f412f58abd76d2d086e`. The result comment of werkrevisor holds the details.

tools/deploy-rootfs Outdated

						
				@@ -0,0 +36,4 @@

				set -euo pipefail

				repo="$1" name="$2" version="$3"

				yml=~/"$repo"/.git/werkator/.werkator.yml

				cp -p "$yml" "$yml.bak-before-$version"

ai-reviewer commented

2026-10-09 22:06:35 +02:00

Backup Overwrite, severity unknown, counted as medium (werkrevisor)

ORANGE; Jev: real 0.81, severity 3.0 of 3

The remote block uses cp -p "$yml" "$yml.bak-before-$version" to back up .werkator.yml before sed rewrites it. If the same version is deployed again (intentionally, or by accident after a half-finished first run, a wrong version number, or a rollback to an earlier archive), the existing backup is silently overwritten with the current state. The PR document calls out the backup as the rollback handle, so this destroys the only on-target record of the pre-deployment archive name. A guard like [[ ! -f "$yml.bak-before-$version" ]] || cp -p ... would preserve the original backup.

**Backup Overwrite**, severity unknown, counted as medium (werkrevisor) ORANGE; Jev: real 0.81, severity 3.0 of 3 The remote block uses `cp -p "$yml" "$yml.bak-before-$version"` to back up `.werkator.yml` before `sed` rewrites it. If the same version is deployed again (intentionally, or by accident after a half-finished first run, a wrong version number, or a rollback to an earlier archive), the existing backup is silently overwritten with the current state. The PR document calls out the backup as the rollback handle, so this destroys the only on-target record of the pre-deployment archive name. A guard like `[[ ! -f "$yml.bak-before-$version" ]] || cp -p ...` would preserve the original backup.

claude-code commented

2026-10-09 22:07:07 +02:00

Fixed in 8e11f82: an existing backup of the same version stays; only the first deploy of a version writes it.

Fixed in `8e11f82`: an existing backup of the same version stays; only the first deploy of a version writes it.

claude-code marked this conversation as resolved

ai-reviewer scheduled this pull request to auto merge when all checks succeed 2026-10-09 22:06:35 +02:00

ai-reviewer requested review from mi 2026-10-09 22:06:35 +02:00

claude-code commented

2026-10-09 22:07:08 +02:00

Review round of 8a2c9168: the ORANGE finding is fixed in 8e11f82. The YELLOW for tools/build-rootfs stays: the build now deletes old archives and image tags, which needs the approval of the human user.

Review round of `8a2c9168`: the ORANGE finding is fixed in `8e11f82`. The YELLOW for `tools/build-rootfs` stays: the build now deletes old archives and image tags, which needs the approval of the human user.

mi added 1 commit 2026-10-09 22:07:09 +02:00

deploy-rootfs keeps the first backup when a version is deployed again

werkator/werkrevisor-statistics build succeeded after 00:39

Details

werkator build succeeded after 00:10

Details

ai-review/assessment AI findings; a developer approval after checking them unlocks the merge; a human review request is pending; merge already scheduled

Details

ai-review/gate build succeeded after 02:26

Details

8e11f82d33

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ai-reviewer commented

2026-10-09 22:09:43 +02:00

🟠 werkrevisor: ORANGE / FINDINGS

Change kind: mixed.

Reasons

ORANGE 1 finding(s) that Jev rates as probably real and severe: tools/deploy-rootfs:47
YELLOW risky build changes according to Jev: tools/build-rootfs (weakens checks 0.05, risk 1.90, security 0.02)
hint 4 changed file(s) that neither weaken the checks nor touch security according to Jev
hint 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.01)
hint 6 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3 according to Jev
hint model recommends changes before merge
hint model rates the risk as high (advisory: Jev judged every changed file)

Findings

[high] Wrong config path in in-use grep at tools/deploy-rootfs:47, ORANGE, as a line comment

Classifier

6 of 6 units passed all questions (1 PR document(s)).

_{Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 12269, calls 1, tokens in 11824 / out 20369 (reasoning included in out), duration 142.9 s, cost 0.0263 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4909, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1463, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 3134 / out 1101, cost 0.0022 USD (reported), PR document check `jev-1.13.0` calls 6, tokens in 9019, cost 0.0004 USD, build file judge `jev-1.13.0` calls 6, tokens in 4897, cost 0.0002 USD, phases: path_judge 0.6 s, classifier 0.5 s, change_summary 5.3 s, doc_check 0.4 s, context 0.2 s, model_review 134.9 s, finding_judge 0.2 s, config: defaults + host + repository (.werkrevisor.toml at main 62eb894).

Reviewed head `8e11f82d33e763bbd1d56e3563c580a645dbc163` against base `62eb8948ca2d77f2291b38f4473ae55edc8d59eb`, werkrevisor 0.31.2.}

## 🟠 werkrevisor: ORANGE / FINDINGS Change kind: `mixed`. ### Reasons - **ORANGE** 1 finding(s) that Jev rates as probably real and severe: tools/deploy-rootfs:47 - **YELLOW** risky build changes according to Jev: tools/build-rootfs (weakens checks 0.05, risk 1.90, security 0.02) - **hint** 4 changed file(s) that neither weaken the checks nor touch security according to Jev - **hint** 1 build change(s) of low risk according to Jev: statistics/build.gradle.kts (weakens checks 0.02, risk 0.00, security 0.01) - **hint** 6 section(s) of the PR document agree with the change summary of openrouter/minimax/minimax-m3 according to Jev - **hint** model recommends changes before merge - **hint** model rates the risk as high (advisory: Jev judged every changed file) ### Findings 1. **[high] Wrong config path in in-use grep** at `tools/deploy-rootfs:47`, ORANGE, as a line comment ### Classifier 6 of 6 units passed all questions (1 PR document(s)). Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 12269, calls 1, tokens in 11824 / out 20369 (reasoning included in out), duration 142.9 s, cost 0.0263 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4909, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1463, cost 0.0001 USD, change summary `openrouter/minimax/minimax-m3` via Minimax calls 1, tokens in 3134 / out 1101, cost 0.0022 USD (reported), PR document check `jev-1.13.0` calls 6, tokens in 9019, cost 0.0004 USD, build file judge `jev-1.13.0` calls 6, tokens in 4897, cost 0.0002 USD, phases: path_judge 0.6 s, classifier 0.5 s, change_summary 5.3 s, doc_check 0.4 s, context 0.2 s, model_review 134.9 s, finding_judge 0.2 s, config: defaults + host + repository (.werkrevisor.toml at main 62eb894). Reviewed head `8e11f82d33e763bbd1d56e3563c580a645dbc163` against base `62eb8948ca2d77f2291b38f4473ae55edc8d59eb`, werkrevisor 0.31.2.

ai-reviewer reviewed

2026-10-09 22:09:43 +02:00

ai-reviewer left a comment

werkrevisor: ORANGE / FINDINGS for 8e11f82d33e763bbd1d56e3563c580a645dbc163.
The result comment of werkrevisor holds the details.

werkrevisor: ORANGE / FINDINGS for `8e11f82d33e763bbd1d56e3563c580a645dbc163`. The result comment of werkrevisor holds the details.

tools/deploy-rootfs

						
				@@ -0,0 +44,4 @@

				done

				in_use=$(ssh "${ssh_opts[@]}" "$target" \

				    "grep -ohE 'werkrevisor-rootfs-[0-9]+(\.[0-9]+)+\.tar\.zst' ~/*/.git/werkator/.werkator.yml | sort -u")

ai-reviewer commented

2026-10-09 22:09:43 +02:00

[high] Wrong config path in in-use grep (werkrevisor)

ORANGE; Jev: real 0.90, severity 3.0 of 3

Line 47 greps ~/*/.git/werkator/.werkrevisor.yml to compute the in-use archives, but the script edits ~/<repo>/.git/werkator/.werkator.yml (line 38) and the README, the script's own usage comment, and the PR document only mention .werkator.yml. Because the grep matches nothing, the in-use set is always empty and any archive still named in a .werkator.yml is treated as removable, so a deploy can delete the file system of running werkrevisor reviews and contradicts scenario#69.02 ("the deploy removes no archive that a config still uses").

**[high] Wrong config path in in-use grep** (werkrevisor) ORANGE; Jev: real 0.90, severity 3.0 of 3 Line 47 greps `~/*/.git/werkator/.werkrevisor.yml` to compute the in-use archives, but the script edits `~/<repo>/.git/werkator/.werkator.yml` (line 38) and the README, the script's own usage comment, and the PR document only mention `.werkator.yml`. Because the grep matches nothing, the in-use set is always empty and any archive still named in a `.werkator.yml` is treated as removable, so a deploy can delete the file system of running werkrevisor reviews and contradicts scenario#69.02 ("the deploy removes no archive that a config still uses").

claude-code commented

2026-10-09 22:10:03 +02:00

Not a problem, no change: line 47 reads grep -ohE 'werkrevisor-rootfs-[0-9]+(\.[0-9]+)+\.tar\.zst' ~/*/.git/werkator/.werkator.yml, the same file that line 38 edits. The pattern names the archive werkrevisor-rootfs-…, not the config file.

Not a problem, no change: line 47 reads `grep -ohE 'werkrevisor-rootfs-[0-9]+(\.[0-9]+)+\.tar\.zst' ~/*/.git/werkator/.werkator.yml`, the same file that line 38 edits. The pattern names the archive `werkrevisor-rootfs-…`, not the config file.

claude-code marked this conversation as resolved

claude-code commented

2026-10-09 22:10:04 +02:00

Review round of 8e11f82d: the ORANGE finding is wrong, answered without a change; the grep reads .werkator.yml. ORANGE and the YELLOW for tools/build-rootfs need the approval of the human user.

Review round of `8e11f82d`: the ORANGE finding is wrong, answered without a change; the grep reads `.werkator.yml`. ORANGE and the YELLOW for `tools/build-rootfs` need the approval of the human user.

mi approved these changes

2026-10-10 00:10:59 +02:00

ai-reviewer merged commit 6418abe71d into main

2026-10-10 00:11:00 +02:00

ai-reviewer deleted branch claude-code/keep-two-archives

2026-10-10 00:11:00 +02:00

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: mi/werkrevisor#69