Tags give the ability to mark specific points in history as being important
-
ci-templates-v2026.08.13
protected5bbc8020 · ·ci-templates v2026.08.13 — mirrors authenticate again Fixes the workspace-wide mirror outage that began 2026-08-20T06:08. The cause was not a credential. `github-mirror.yml` built its App JWT with `exp = now + 600`, exactly GitHub's documented 10-minute maximum, leaving no margin — so any forward clock skew on the runner tipped it over and GitHub answered 401 "'Expiration time' claim ('exp') is too far in the future". That fits every symptom: the key verified (`RSA key ok`), every repo broke at the same moment, and nothing had been rotated. `exp` is now `now + 300`, centred in the window. The JWT is exchanged for an installation token on the very next line and never reused, so a long validity buys nothing, while centring maximises tolerance both ways — about 5 minutes of skew in either direction. GitHub's own guidance pairs the 10-minute cap with keeping server time accurate via NTP; sitting on the cap made the template depend on that being exact. Also in this tag: - The App key is accepted as a PEM or as base64 of one. GitHub hands you a PEM; this variable has always wanted base64 of it, and the mismatch reported "did not decode to a valid RSA key" — which reads like a corrupt key rather than a wrong encoding, exactly the wrong message for someone rotating a key during an outage that already looks credential-shaped. Defensive: no repo needed it. Refs vauchi/scripts!535 and the record in `_private/docs/backlog/2026-08-20-github-mirroring-stopped-workspace-wide`. -
ci-templates-v2026.08.12
protectedd1ab245f · ·ci-templates v2026.08.12 — the mirror says why it failed `github-mirror.yml`: the GitHub App token exchange now captures the HTTP status and response body instead of `curl -sf | jq`. The old form could not report anything — `-f` exits 22 on any 4xx/5xx and job scripts run under pipefail, so the job died at the assignment, before the handler written to explain it. Every mirror failure since 2026-08-20T06:08 printed only `exit code 22`. Now a failure names the status and GitHub's own message, with a hint per status: 401 → App id / private key, 404 → installation id or an uninstalled App, 000 → no HTTP response at all. A non-201 response carries no token, so printing the body leaks nothing; on success only the token's length is ever observable. This does not fix the outage itself, which needs a credential change by someone with GitHub App access. It makes the next mirror run say which credential. Verified against a local server returning real 401/404/201/empty-201 responses using the block extracted verbatim from the template, plus a no-server case. Refs vauchi/scripts!533. Also since v2026.08.11: - `hooks/check-portable-shell.sh` gains **VSH13**, which flags the shape above wherever it appears: a curl/wget inside a command substitution piped into a parser, with the status discarded. Joins continuation lines, since the production case spanned four. Self-test in `scripts/tests/check-portable-shell-vsh13.test.sh`. Repos that pin this ref for their hooks pick up the new rule; 20 pre-existing sites across 8 files are documented on the rule page and are not blocking, because the hook lints only staged files. Refs vauchi/scripts!534.
-
ci-templates-v2026.08.11
protected390e77f2 · ·ci-templates v2026.08.11 — shared binding-compatibility check New: `binding-compat.yml` provides `.binding-compat-check`, the consumer-arity gate extracted from the fixed iOS block (ios!644) so iOS and macOS cannot drift apart again. It reads both the UniFFI binding and `CoreUIModels/Models.swift`, and compares enum-case signatures with newlines flattened, which is what the iOS version missed — a multi-line `case scheduleWakeup(...)` declaration slipped past it. Sets `MARK_DRAFT` so a bump whose consumer code cannot compile opens as a Draft with auto-merge withheld instead of failing to build after merge (macos!359). Parameterised by `CONSUMER_DIRS` (default `Vauchi/`). Also since v2026.08.10: - `rust-base.yml`: a dead sccache fails the job instead of hanging it — `sccache --show-stats` is wrapped in `timeout 30`, and the shared CLI domain-call baseline drops to the measured 2. - `shell-command-conformance.yml`: runner tags, so the conformance job can actually be scheduled. Consumers on v2026.07.12 additionally pick up the badges, design-drift, github-mirror, and parser-parity changes already published in v2026.07.13 and v2026.08.10.
-
ci-templates-v2026.08.10
protected36ba1a96 · ·ci-templates: shell command-pair conformance, apk retries New: - shell-command-conformance.yml — per-shell gate failing any shell that renders an overlay without handling the command that closes one. Inert until a repo extends .shell-command-conformance and sets VAUCHI_SHELL. Exemptions live in the shell's own .shell-command-conformance-allowlist, reason mandatory. Changed: - every apk add across the templates now retries three times and fails loudly, after a flaky Alpine CDN reddened a check that never ran - typos.yml no longer runs apt-get install after a successful apk add ('A || B && C' precedence) Also carries .domain-calls-job from the same period. Both new jobs are dot-prefixed anchors, so bumping to this tag activates nothing on its own — a repo must opt in explicitly. -
ci-templates-v2026.07.13
protected759e0734 · ·ci-templates v2026.07.13 — sccache telemetry no longer fails a green job (scripts 679cedc): `sccache --show-stats` in after_script is wrapped in `timeout 30`, so a wedged daemon warns instead of burning the after_script timeout and failing an otherwise-passing job (v2026.07.11 introduced the unguarded call; relay pipeline 2725615388 died this way). Also adds the reusable failure-alert.yml template for silent job failures.
-
ci-templates-v2026.07.12
protected4e2c91d3 · ·ci-templates v2026.07.12 — presentation-mode design-drift and parser-parity
-
ci-templates-v2026.07.11
protectedbbf44d5c · ·ci-templates v2026.07.11 — cold-runner resilience (scripts!472): honest sccache telemetry in after_script, .timeout-cold-rebuild tier (2h + resource_group), job_execution_timeout in default retry, registry cache deduped to one key per project
-
ci-templates-v2026.07.10
protected6c56f4a3 · ·ci-templates v2026.07.10 — vet-autofix decoupled from Cargo.lock (scripts!468): exemption sync touches supply-chain/ only, fails loud on lockfile drift; snapshot-regen band-aid retired.
-
-
-
-
ci-templates-v2026.07.6
protected8918ef2f · ·Verified fetch hardening and CI failure classification
-
-
-
-
-
ci-templates-v2026.07.1
protected61b42f9e · ·ci-templates-v2026.07.1 — pinned refs, blocking gates, change-based advisory rules
-
ci-templates-v2026.07.0
protecteda955d59c · ·ci-templates-v2026.07.0: pinned templates for vauchi/scripts consumption