Tags give the ability to mark specific points in history as being important
-
ci-templates-v2026.10.03
protectedc6929068 · ·ci-templates-v2026.10.03 Second tag cut on 2026-10-02; the scheme has three numeric parts, so it takes the next number. setup-ssh-pushgateway: the direct push sends PUSHGATEWAY_TOKEN as a bearer header, through a curl config on a file descriptor, for push.vauchi.app (private#470). A refusal keeps its HTTP status when curl exits non-zero afterwards. metrics-push: the per-job failure metric labels the job ci_job; the label job is overwritten by the Pushgateway and made the payload invalid.
-
ci-templates-v2026.10.02
protected7925877d · ·ci-templates-v2026.10.02 perf: the binary-size job lists each library once; two overlapping globs put every lib* file in the payload twice (private#470). setup-ssh-pushgateway: a failed push names the transport it tried and keeps ssh's message; a non-2xx answer is not a delivery, and the Pushgateway's response body stays in the log (private#15, private#470). core-pins: check --fetch reads pins as released, plus edge cases from review (#434). bump-core-consumers.sh is retired.
-
ci-templates-v2026.09.30
protected449d7eaa · ·ci-templates-v2026.09.30 design-drift, parser-parity: CORE_PIN_FILE / CORE_PIN_KIND read the Core ref from the consumer's own pin through scripts/core-pins.py, so the checks run against the Core the app ships (ADR-026 amendment, #434). security: semgrep gets 30 s per rule and file; the severity gate still blocks any timeout (#426).
-
ci-templates-v2026.09.28
protectede9bf783f · ·ci-templates-v2026.09.28 check-design-tokens: COLOR covers tone mappings, Color.x and Kotlin, with reasoned design-token-ok markers (#407). ci-templates: lint:links-external documents why it is advisory (#72); sync:vendor-locales opens its MR with the project access token (#406).
-
ci-templates-v2026.09.26
protectedc6ddc120 · ·ci-templates v2026.09.26 — exact-zero release ratchet (ADR-066) .release-ratchet-zero now lives in cross-cutting-lint.yml on the hash-pinned runner; --require-zero rejects TODO(HUMBLE)-marked sites and nonzero stored counters. Also carries bf037bb, 52e3e80, 3af54ff, 6b9590c, 2236efb since v2026.09.07.
-
ci-templates-v2026.09.07
protectede2d8b373 · ·ci-templates v2026.09.07 — the Rust audit becomes a standing check `cargo audit` already ran in all seven Rust repos, so this is not new coverage. It is the same job, finally able to see the advisories it was meant to catch. Two independent blind spots, either sufficient on its own: Wrong time .security-audit-job extended .validation-deps — merge requests touching Cargo.toml or Cargo.lock, nothing else. A new advisory published against an unchanged lockfile fired nothing, which is how advisories normally arrive. Adds main and schedule. Wrong severity plain `cargo audit` exits 0 on unsound, unmaintained and yanked. RUSTSEC-2026-0253 — potential use-after-free in LruCache::pop() — is classed unsound, so even a scheduled run would have passed. Now --deny warnings. web-demo already had both, which is why web-demo was the only repo where that advisory ever went red, three weeks after it landed in four consumers' lockfiles. Repos declare their own exceptions in AUDIT_IGNORES, set in top-level `variables:` so the RC-tag audit inherits the same list. Each entry carries the advisory's source and what clears it. Consuming repos must land their ignore list BEFORE bumping to this tag — the other order turns six mains red in the gap. -
ci-templates-v2026.08.13
protected5bbc8020 · ·ci-templates v2026.08.13 — mirrors authenticate again Fixes the workspace-wide mirror outage that began 2026-08-20T06:08. The cause was not a credential. `github-mirror.yml` built its App JWT with `exp = now + 600`, exactly GitHub's documented 10-minute maximum, leaving no margin — so any forward clock skew on the runner tipped it over and GitHub answered 401 "'Expiration time' claim ('exp') is too far in the future". That fits every symptom: the key verified (`RSA key ok`), every repo broke at the same moment, and nothing had been rotated. `exp` is now `now + 300`, centred in the window. The JWT is exchanged for an installation token on the very next line and never reused, so a long validity buys nothing, while centring maximises tolerance both ways — about 5 minutes of skew in either direction. GitHub's own guidance pairs the 10-minute cap with keeping server time accurate via NTP; sitting on the cap made the template depend on that being exact. Also in this tag: - The App key is accepted as a PEM or as base64 of one. GitHub hands you a PEM; this variable has always wanted base64 of it, and the mismatch reported "did not decode to a valid RSA key" — which reads like a corrupt key rather than a wrong encoding, exactly the wrong message for someone rotating a key during an outage that already looks credential-shaped. Defensive: no repo needed it. Refs vauchi/scripts!535 and the record in `_private/docs/backlog/2026-08-20-github-mirroring-stopped-workspace-wide`. -
ci-templates-v2026.08.12
protectedd1ab245f · ·ci-templates v2026.08.12 — the mirror says why it failed `github-mirror.yml`: the GitHub App token exchange now captures the HTTP status and response body instead of `curl -sf | jq`. The old form could not report anything — `-f` exits 22 on any 4xx/5xx and job scripts run under pipefail, so the job died at the assignment, before the handler written to explain it. Every mirror failure since 2026-08-20T06:08 printed only `exit code 22`. Now a failure names the status and GitHub's own message, with a hint per status: 401 → App id / private key, 404 → installation id or an uninstalled App, 000 → no HTTP response at all. A non-201 response carries no token, so printing the body leaks nothing; on success only the token's length is ever observable. This does not fix the outage itself, which needs a credential change by someone with GitHub App access. It makes the next mirror run say which credential. Verified against a local server returning real 401/404/201/empty-201 responses using the block extracted verbatim from the template, plus a no-server case. Refs vauchi/scripts!533. Also since v2026.08.11: - `hooks/check-portable-shell.sh` gains **VSH13**, which flags the shape above wherever it appears: a curl/wget inside a command substitution piped into a parser, with the status discarded. Joins continuation lines, since the production case spanned four. Self-test in `scripts/tests/check-portable-shell-vsh13.test.sh`. Repos that pin this ref for their hooks pick up the new rule; 20 pre-existing sites across 8 files are documented on the rule page and are not blocking, because the hook lints only staged files. Refs vauchi/scripts!534.
-
ci-templates-v2026.08.11
protected390e77f2 · ·ci-templates v2026.08.11 — shared binding-compatibility check New: `binding-compat.yml` provides `.binding-compat-check`, the consumer-arity gate extracted from the fixed iOS block (ios!644) so iOS and macOS cannot drift apart again. It reads both the UniFFI binding and `CoreUIModels/Models.swift`, and compares enum-case signatures with newlines flattened, which is what the iOS version missed — a multi-line `case scheduleWakeup(...)` declaration slipped past it. Sets `MARK_DRAFT` so a bump whose consumer code cannot compile opens as a Draft with auto-merge withheld instead of failing to build after merge (macos!359). Parameterised by `CONSUMER_DIRS` (default `Vauchi/`). Also since v2026.08.10: - `rust-base.yml`: a dead sccache fails the job instead of hanging it — `sccache --show-stats` is wrapped in `timeout 30`, and the shared CLI domain-call baseline drops to the measured 2. - `shell-command-conformance.yml`: runner tags, so the conformance job can actually be scheduled. Consumers on v2026.07.12 additionally pick up the badges, design-drift, github-mirror, and parser-parity changes already published in v2026.07.13 and v2026.08.10.
-
ci-templates-v2026.08.10
protected36ba1a96 · ·ci-templates: shell command-pair conformance, apk retries New: - shell-command-conformance.yml — per-shell gate failing any shell that renders an overlay without handling the command that closes one. Inert until a repo extends .shell-command-conformance and sets VAUCHI_SHELL. Exemptions live in the shell's own .shell-command-conformance-allowlist, reason mandatory. Changed: - every apk add across the templates now retries three times and fails loudly, after a flaky Alpine CDN reddened a check that never ran - typos.yml no longer runs apt-get install after a successful apk add ('A || B && C' precedence) Also carries .domain-calls-job from the same period. Both new jobs are dot-prefixed anchors, so bumping to this tag activates nothing on its own — a repo must opt in explicitly. -
ci-templates-v2026.07.13
protected759e0734 · ·ci-templates v2026.07.13 — sccache telemetry no longer fails a green job (scripts 679cedc): `sccache --show-stats` in after_script is wrapped in `timeout 30`, so a wedged daemon warns instead of burning the after_script timeout and failing an otherwise-passing job (v2026.07.11 introduced the unguarded call; relay pipeline 2725615388 died this way). Also adds the reusable failure-alert.yml template for silent job failures.
-
ci-templates-v2026.07.12
protected4e2c91d3 · ·ci-templates v2026.07.12 — presentation-mode design-drift and parser-parity
-
ci-templates-v2026.07.11
protectedbbf44d5c · ·ci-templates v2026.07.11 — cold-runner resilience (scripts!472): honest sccache telemetry in after_script, .timeout-cold-rebuild tier (2h + resource_group), job_execution_timeout in default retry, registry cache deduped to one key per project
-
ci-templates-v2026.07.10
protected6c56f4a3 · ·ci-templates v2026.07.10 — vet-autofix decoupled from Cargo.lock (scripts!468): exemption sync touches supply-chain/ only, fails loud on lockfile drift; snapshot-regen band-aid retired.
-
-
-
-
ci-templates-v2026.07.6
protected8918ef2f · ·Verified fetch hardening and CI failure classification
-
-