Merge branch 'docs/story-10-2-review' into 'main'

docs(standards): update story 10.2 to review status

See merge request orgdocs/development-standards!30

Author: Matthew

_bmad-output/implementation-artifacts/10-2-fix-version-manifest-ci-job.md

@@ -1,6 +1,6 @@
 # Story 10.2: Fix Version-Manifest CI Job for Releases
 
-Status: ready-for-dev
+Status: review
 
 ## Story
 
@@ -17,24 +17,24 @@ so that users can see exactly which tool versions are included in each container
 
 ## Tasks / Subtasks
 
-- [ ] Task 1: Investigate why the version-manifest job was skipped in v1.6.0 (AC: 1)
-  - [ ] 1.1 Review `build.yml` workflow to understand the version-manifest job's trigger conditions
-  - [ ] 1.2 Check the v1.6.0 build run logs for the version-manifest job
-  - [ ] 1.3 Identify the root cause (conditional gate, dependency, permissions, or other)
+- [x] Task 1: Investigate why the version-manifest job was skipped in v1.6.0 (AC: 1)
+  - [x] 1.1 Review `build.yml` workflow to understand the version-manifest job's trigger conditions
+  - [x] 1.2 Check the v1.6.0 build run logs for the version-manifest job
+  - [x] 1.3 Identify the root cause (conditional gate, dependency, permissions, or other)
 
-- [ ] Task 2: Fix the version-manifest job (AC: 1, 2)
-  - [ ] 2.1 Apply the fix based on root cause analysis
-  - [ ] 2.2 Verify the fix doesn't break other jobs in the build pipeline
+- [x] Task 2: Fix the version-manifest job (AC: 1, 2)
+  - [x] 2.1 Apply the fix based on root cause analysis
+  - [x] 2.2 Verify the fix doesn't break other jobs in the build pipeline
 
-- [ ] Task 3: Verify the manifest content (AC: 3)
-  - [ ] 3.1 Run `scripts/report-tool-versions.sh` locally inside the container to validate output
-  - [ ] 3.2 Confirm all 8 language ecosystems are represented
-  - [ ] 3.3 Confirm Terragrunt version is included
+- [x] Task 3: Verify the manifest content (AC: 3)
+  - [x] 3.1 Run `scripts/report-tool-versions.sh` locally inside the container to validate output
+  - [x] 3.2 Confirm all 8 language ecosystems are represented
+  - [x] 3.3 Confirm Terragrunt version is included
 
-- [ ] Task 4: Verify devrail.dev versions page (AC: 4)
-  - [ ] 4.1 Check if the devrail.dev site has automation to pull version manifests from releases
-  - [ ] 4.2 If automated, verify it picks up the new release asset
-  - [ ] 4.3 If manual, update the versions page content
+- [x] Task 4: Verify devrail.dev versions page (AC: 4)
+  - [x] 4.1 Check if the devrail.dev site has automation to pull version manifests from releases
+  - [x] 4.2 If automated, verify it picks up the new release asset
+  - [x] 4.3 If manual, update the versions page content
 
 ## Dev Notes
 
@@ -54,8 +54,22 @@ so that users can see exactly which tool versions are included in each container
 
 ### Agent Model Used
 
+Claude Opus 4.6
+
 ### Debug Log References
 
+- v1.6.0 build run showed version-manifest job completed in 0s (skipped)
+- `docker run ghcr.io/devrail-dev/dev-toolchain:1.6.0 bash /opt/devrail/scripts/report-tool-versions.sh` — produced valid JSON with 38 tools across 8 ecosystems
+
 ### Completion Notes List
 
+- **Root cause**: GitHub Actions transitive `needs` chain skip behavior. When `auto-version` job is skipped (tag push trigger), downstream jobs inherit the skip even through intermediate jobs that use `always()`. The `version-manifest` job had `needs: [build-and-push]` but its `if` condition (`startsWith(github.ref, 'refs/tags/v')`) wasn't enough — GitHub's default behavior skips jobs when any ancestor in the needs chain was skipped.
+- **Fix**: Changed `version-manifest` job's `if` from `startsWith(github.ref, 'refs/tags/v')` to `always() && needs.build-and-push.result == 'success' && startsWith(github.ref, 'refs/tags/v')`. The `always()` function overrides the default skip behavior, and the explicit success check ensures it only runs when the build actually succeeded.
+- **Manifest verification**: `report-tool-versions.sh` produces valid JSON output with all 8 language ecosystems (Python, Bash, Terraform, Ansible, Ruby, Go, JavaScript/TypeScript, Rust) plus universal security tools and Terragrunt.
+- **Devrail.dev versions page**: Already working — `update-versions.yml` workflow runs on `release: published` events and creates PRs to update the versions page. PR #12 was merged to fix org-level Actions permissions that were blocking this.
+- **Note**: The `:v1` floating tag appears stale (different image ID from `:1.6.0`). This is caused by the `docker/metadata-action` `v{{major}}` pattern producing `:v1` tag (with v prefix) while `build-and-push` also produces `:1.6.0` (without v prefix). This is a separate issue — the floating tag works correctly, it just may not have been updated for v1.6.0 specifically.
+
 ### File List
+
+- `dev-toolchain/.github/workflows/build.yml` — fixed `version-manifest` job `if` condition (line 123)
+- PR: https://github.com/devrail-dev/dev-toolchain/pull/10

_bmad-output/implementation-artifacts/sprint-status.yaml

@@ -113,7 +113,7 @@ development_status:
 
   epic-10: in-progress
   10-1-configure-gitlab-github-mirror-ci: done
-  10-2-fix-version-manifest-ci-job: ready-for-dev
+  10-2-fix-version-manifest-ci-job: review
   10-3-write-v160-release-blog-post: ready-for-dev
   epic-10-retrospective: optional