Tags

Tags give the ability to mark specific points in history as being important
  • ci-templates-v2026.08.13

    protected
    ci-templates v2026.08.13 — mirrors authenticate again
    
    Fixes the workspace-wide mirror outage that began 2026-08-20T06:08.
    
    The cause was not a credential. `github-mirror.yml` built its App JWT with
    `exp = now + 600`, exactly GitHub's documented 10-minute maximum, leaving
    no margin — so any forward clock skew on the runner tipped it over and
    GitHub answered 401 "'Expiration time' claim ('exp') is too far in the
    future". That fits every symptom: the key verified (`RSA key ok`), every
    repo broke at the same moment, and nothing had been rotated.
    
    `exp` is now `now + 300`, centred in the window. The JWT is exchanged for
    an installation token on the very next line and never reused, so a long
    validity buys nothing, while centring maximises tolerance both ways —
    about 5 minutes of skew in either direction. GitHub's own guidance pairs
    the 10-minute cap with keeping server time accurate via NTP; sitting on
    the cap made the template depend on that being exact.
    
    Also in this tag:
    
    - The App key is accepted as a PEM or as base64 of one. GitHub hands you a
      PEM; this variable has always wanted base64 of it, and the mismatch
      reported "did not decode to a valid RSA key" — which reads like a
      corrupt key rather than a wrong encoding, exactly the wrong message for
      someone rotating a key during an outage that already looks
      credential-shaped. Defensive: no repo needed it.
    
    Refs vauchi/scripts!535 and the record in
    `_private/docs/backlog/2026-08-20-github-mirroring-stopped-workspace-wide`.
  • ci-templates-v2026.08.12

    protected
    ci-templates v2026.08.12 — the mirror says why it failed
    
    `github-mirror.yml`: the GitHub App token exchange now captures the HTTP
    status and response body instead of `curl -sf | jq`. The old form could
    not report anything — `-f` exits 22 on any 4xx/5xx and job scripts run
    under pipefail, so the job died at the assignment, before the handler
    written to explain it. Every mirror failure since 2026-08-20T06:08 printed
    only `exit code 22`.
    
    Now a failure names the status and GitHub's own message, with a hint per
    status: 401 → App id / private key, 404 → installation id or an
    uninstalled App, 000 → no HTTP response at all. A non-201 response carries
    no token, so printing the body leaks nothing; on success only the token's
    length is ever observable.
    
    This does not fix the outage itself, which needs a credential change by
    someone with GitHub App access. It makes the next mirror run say which
    credential.
    
    Verified against a local server returning real 401/404/201/empty-201
    responses using the block extracted verbatim from the template, plus a
    no-server case. Refs vauchi/scripts!533.
    
    Also since v2026.08.11:
    
    - `hooks/check-portable-shell.sh` gains **VSH13**, which flags the shape
      above wherever it appears: a curl/wget inside a command substitution
      piped into a parser, with the status discarded. Joins continuation
      lines, since the production case spanned four. Self-test in
      `scripts/tests/check-portable-shell-vsh13.test.sh`. Repos that pin this
      ref for their hooks pick up the new rule; 20 pre-existing sites across
      8 files are documented on the rule page and are not blocking, because
      the hook lints only staged files. Refs vauchi/scripts!534.
  • ci-templates-v2026.08.11

    protected
    ci-templates v2026.08.11 — shared binding-compatibility check
    
    New: `binding-compat.yml` provides `.binding-compat-check`, the
    consumer-arity gate extracted from the fixed iOS block (ios!644) so iOS
    and macOS cannot drift apart again. It reads both the UniFFI binding and
    `CoreUIModels/Models.swift`, and compares enum-case signatures with
    newlines flattened, which is what the iOS version missed — a multi-line
    `case scheduleWakeup(...)` declaration slipped past it. Sets `MARK_DRAFT`
    so a bump whose consumer code cannot compile opens as a Draft with
    auto-merge withheld instead of failing to build after merge (macos!359).
    Parameterised by `CONSUMER_DIRS` (default `Vauchi/`).
    
    Also since v2026.08.10:
    
    - `rust-base.yml`: a dead sccache fails the job instead of hanging it —
      `sccache --show-stats` is wrapped in `timeout 30`, and the shared CLI
      domain-call baseline drops to the measured 2.
    - `shell-command-conformance.yml`: runner tags, so the conformance job
      can actually be scheduled.
    
    Consumers on v2026.07.12 additionally pick up the badges, design-drift,
    github-mirror, and parser-parity changes already published in
    v2026.07.13 and v2026.08.10.
  • ci-templates-v2026.08.10

    protected
    ci-templates: shell command-pair conformance, apk retries
    
    New:
      - shell-command-conformance.yml — per-shell gate failing any shell that
        renders an overlay without handling the command that closes one.
        Inert until a repo extends .shell-command-conformance and sets
        VAUCHI_SHELL. Exemptions live in the shell's own
        .shell-command-conformance-allowlist, reason mandatory.
    
    Changed:
      - every apk add across the templates now retries three times and fails
        loudly, after a flaky Alpine CDN reddened a check that never ran
      - typos.yml no longer runs apt-get install after a successful apk add
        ('A || B && C' precedence)
    
    Also carries .domain-calls-job from the same period. Both new jobs are
    dot-prefixed anchors, so bumping to this tag activates nothing on its
    own — a repo must opt in explicitly.
  • ci-templates-v2026.07.13

    protected
    ci-templates v2026.07.13 — sccache telemetry no longer fails a green job (scripts 679cedc): `sccache --show-stats` in after_script is wrapped in `timeout 30`, so a wedged daemon warns instead of burning the after_script timeout and failing an otherwise-passing job (v2026.07.11 introduced the unguarded call; relay pipeline 2725615388 died this way). Also adds the reusable failure-alert.yml template for silent job failures.
  • ci-templates-v2026.07.12

    protected
    ci-templates v2026.07.12 — presentation-mode design-drift and parser-parity
  • ci-templates-v2026.07.11

    protected
    ci-templates v2026.07.11 — cold-runner resilience (scripts!472): honest sccache telemetry in after_script, .timeout-cold-rebuild tier (2h + resource_group), job_execution_timeout in default retry, registry cache deduped to one key per project
  • ci-templates-v2026.07.10

    protected
    ci-templates v2026.07.10 — vet-autofix decoupled from Cargo.lock (scripts!468): exemption sync touches supply-chain/ only, fails loud on lockfile drift; snapshot-regen band-aid retired.
  • ci-templates-v2026.07.9

    protected
    Immutable shared CI templates v2026.07.9
  • ci-templates-v2026.07.8

    protected
    Immutable shared CI templates v2026.07.8
  • ci-templates-v2026.07.7

    protected
    Immutable shared CI templates v2026.07.7
  • ci-templates-v2026.07.6

    protected
    Verified fetch hardening and CI failure classification
  • ci-templates-v2026.07.5

    protected
    ci-templates-v2026.07.5
  • ci-templates-v2026.07.1

    protected
    ci-templates-v2026.07.1 — pinned refs, blocking gates, change-based advisory rules
  • ci-templates-v2026.07.0

    protected
    ci-templates-v2026.07.0: pinned templates for vauchi/scripts consumption