From 983f10dccf28d4cb7394f6855f40deb394b7ed20 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" Date: Wed, 16 Sep 2026 20:29:07 +0000 Subject: [PATCH] chore: sync from vibgrate-cli monorepo (v2026.916.3) Outbound mirror of packages/vibgrate-cli-public. Passed the public-surface leak gate. --- .github/workflows/helm.yml | 44 ++++++++++++++++++++++++++++----- .github/workflows/packaging.yml | 36 ++++++++++++++++++++++++++- action.yml | 2 +- charts/vibgrate/Chart.yaml | 2 +- package.json | 2 +- releases/v2026.916.3.md | 42 +++++++++++++++++++++++++++++++ scripts/stamp-packaging.mjs | 14 +++++++++-- src/version.ts | 2 +- 8 files changed, 131 insertions(+), 13 deletions(-) create mode 100644 releases/v2026.916.3.md diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index fdf8bbe..e7e12b1 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -151,17 +151,49 @@ jobs: - name: Log in to GHCR if: github.event_name != 'workflow_dispatch' || inputs.dry-run == false - run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin + run: | + set -euo pipefail + echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${{ github.actor }}" --password-stdin + # oras uses its own (docker-style) credential store, separate from + # helm's — needed so the push step can verify via `oras resolve` + # against a package that may still be private. + echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u "${{ github.actor }}" --password-stdin - name: Push to OCI registry id: push if: github.event_name != 'workflow_dispatch' || inputs.dry-run == false run: | - set -euo pipefail - helm push "vibgrate-${{ steps.chart.outputs.version }}.tgz" "${OCI_REPO}" 2> push.log - cat push.log - digest=$(grep -oE 'sha256:[0-9a-f]{64}' push.log | head -1) - if [ -z "${digest}" ]; then echo "::error::could not determine pushed digest"; exit 1; fi + set -uo pipefail + ref="${CHART_REF}:${{ steps.chart.outputs.version }}" + attempts=5 + digest="" + for i in $(seq 1 "${attempts}"); do + if helm push "vibgrate-${{ steps.chart.outputs.version }}.tgz" "${OCI_REPO}" 2> push.log; then + push_ok=true + else + push_ok=false + fi + cat push.log + # GHCR/helm push can report a transient error on the final manifest + # step even though the chart already landed — verify against the + # registry itself rather than trusting helm's exit code alone. + digest="$(oras resolve "${ref}" 2>/dev/null || true)" + if [ -n "${digest}" ]; then + if [ "${push_ok}" = "false" ]; then + echo "::warning::helm push reported an error but ${ref} is present in the registry (verified via oras resolve) — treating as success." + fi + break + fi + if [ "${i}" -lt "${attempts}" ]; then + delay=$((5 * i)) + echo "::warning::helm push attempt ${i}/${attempts} did not land — retrying in ${delay}s." + sleep "${delay}" + fi + done + if [ -z "${digest}" ]; then + echo "::error::helm push did not succeed after ${attempts} attempts" + exit 1 + fi echo "digest=${digest}" >> "$GITHUB_OUTPUT" - name: Make GHCR chart package public diff --git a/.github/workflows/packaging.yml b/.github/workflows/packaging.yml index 857626b..cb47fba 100644 --- a/.github/workflows/packaging.yml +++ b/.github/workflows/packaging.yml @@ -48,13 +48,14 @@ concurrency: permissions: contents: write # commit refreshed stamps back to main when they change + actions: read # poll this commit's Release run status on the push trigger jobs: publish: name: Stamp and publish tap + bucket if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' runs-on: ubuntu-latest - timeout-minutes: 10 + timeout-minutes: 25 steps: - name: Checkout uses: actions/checkout@v7 @@ -64,6 +65,39 @@ jobs: with: node-version: 24 + # The `push` trigger above (for packaging/** or stamp-script edits) fires + # on the SAME push event as release.yml's own `push: branches: [main]` + # trigger — there is no `needs:`/ordering between the two workflows, so + # a sync commit that both bumps package.json's version AND touches + # packaging/** can start this job before (or while) the Release job is + # still building/publishing. Only the workflow_run trigger is naturally + # ordered after a publish; for the push path, explicitly wait for this + # commit's Release run to finish so we don't race it. + - name: Wait for this commit's Release run (npm publish) + if: github.event_name == 'push' + env: + GH_TOKEN: ${{ github.token }} + run: | + set -euo pipefail + sha="${{ github.sha }}" + for i in $(seq 1 80); do + status="$(gh run list --repo "${{ github.repository }}" --workflow=release.yml --commit "${sha}" --json status --jq '.[0].status // "none"' 2>/dev/null || echo "none")" + case "${status}" in + completed) + echo "Release run for ${sha} completed — continuing." + exit 0 + ;; + none) + echo "No Release run found yet for ${sha} (attempt ${i}/80)." + ;; + *) + echo "Release run for ${sha} is ${status} (attempt ${i}/80)." + ;; + esac + sleep 15 + done + echo "::warning::Gave up waiting for the Release run on ${sha} after 20 minutes — proceeding anyway; the tarball download retry below is the fallback." + - name: Stamp formula and manifest id: stamp env: diff --git a/action.yml b/action.yml index d29249e..25c3f51 100644 --- a/action.yml +++ b/action.yml @@ -46,7 +46,7 @@ inputs: image-tag: description: 'Scanner image tag to run (defaults to a pinned, tested release).' required: false - default: '2026.916.2' # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs + default: '2026.916.3' # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs verify: description: 'Verify the image cosign signature + provenance before running (requires cosign on the runner).' required: false diff --git a/charts/vibgrate/Chart.yaml b/charts/vibgrate/Chart.yaml index 04e962e..74028ea 100644 --- a/charts/vibgrate/Chart.yaml +++ b/charts/vibgrate/Chart.yaml @@ -7,7 +7,7 @@ type: application # stamped to the released @vibgrate/cli calendar version by # scripts/stamp-release-pins.mjs (via the marker on the appVersion line below). version: 0.1.2 -appVersion: "2026.916.2" # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs +appVersion: "2026.916.3" # vibgrate:cli-version — stamped by scripts/stamp-release-pins.mjs home: https://vibgrate.com icon: https://vibgrate.com/web-app-manifest-512x512.png sources: diff --git a/package.json b/package.json index 3f96556..f814c37 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@vibgrate/cli", - "version": "2026.916.2", + "version": "2026.916.3", "description": "vg — local codebase intelligence CLI + MCP server for AI coding agents: deterministic code graph, drift reporting, and version-correct library docs (Apache-2.0)", "//mcpName": "Official MCP registry ownership proof: the registry fetches the published npm package and requires this field to match the com.vibgrate/ai-context server entry (see docs/marketing/mcp-registry/README.md). Must ship in the published @vibgrate/cli package.json.", "mcpName": "com.vibgrate/ai-context", diff --git a/releases/v2026.916.3.md b/releases/v2026.916.3.md new file mode 100644 index 0000000..721b011 --- /dev/null +++ b/releases/v2026.916.3.md @@ -0,0 +1,42 @@ +# Vibgrate CLI 2026.916.3 + +_Released 2026-09-16_ + +Routine maintenance update for the CLI. + +## What changed + +### Changed + +- Maintenance release with internal improvements and dependency updates. + +## Benchmarks + +Two-arm benchmark of this release against 2026.916.2, interleaved on one runner against the pinned corpus (236 metrics compared). + +| Metric | Previous | This release | +| --- | --- | --- | +| Languages with extraction | 19 count | 19 count | +| Definitions extracted (corpus total) | 25690 count | 25690 count | +| Call edges extracted (corpus total) | 17316 count | 17316 count | +| Locate accuracy (top-1) | 0.94 ratio | 0.94 ratio | +| Dependency detection (authored manifest truth) | 0.96 ratio | 0.96 ratio | +| CLI startup (--version, median) | 478.80 ms | 476.90 ms | + +5 regression(s) — published, not omitted: +- Token reduction vs baseline agent (equal success): 0.37 → 0.23 (-37.3%) +- Tasks passed on both arms: 36 → 35 (-2.8%) +- Comparable-task rate (both arms passed / total): 0.95 → 0.92 (-2.8%) +- Agent tokens with vg (comparable tasks, total): 507315 → 603265 (18.9%) +- Tool calls per task with vg (median, comparable tasks): 6 → 7 (16.7%) + +Full report and methodology: https://vibgrate.com/cli/benchmarks + +## Install or update + +```sh +npm install -g @vibgrate/cli +vg +``` + +Full changelog: https://vibgrate.com/changelog/cli/2026.916.3 diff --git a/scripts/stamp-packaging.mjs b/scripts/stamp-packaging.mjs index b9aed8b..82027d7 100644 --- a/scripts/stamp-packaging.mjs +++ b/scripts/stamp-packaging.mjs @@ -59,7 +59,15 @@ export function stampScoop(template, { version, sha256, tarballUrl }) { return out; } -export async function sha256OfUrl(url, { retries = 4, fetchImpl = fetch } = {}) { +// npm registry propagation after `npm publish` is eventually consistent — the +// tarball can 404 for a couple of minutes even after the Release workflow's +// publish step reports success. Retry generously (default ~4.5 minutes of +// total backoff) before giving up, so a normal propagation lag doesn't fail +// the packaging job. +export async function sha256OfUrl( + url, + { retries = 8, fetchImpl = fetch, baseDelayMs = 5000, maxDelayMs = 60_000 } = {}, +) { let lastErr; for (let attempt = 1; attempt <= retries; attempt += 1) { try { @@ -82,7 +90,9 @@ export async function sha256OfUrl(url, { retries = 4, fetchImpl = fetch } = {}) } catch (err) { lastErr = err; if (attempt < retries) { - await new Promise((r) => setTimeout(r, 1000 * 2 ** (attempt - 1))); + const delay = Math.min(maxDelayMs, baseDelayMs * 2 ** (attempt - 1)); + console.warn(`stamp-packaging: ${err instanceof Error ? err.message : err} (attempt ${attempt}/${retries}, retrying in ${delay}ms)`); + await new Promise((r) => setTimeout(r, delay)); } } } diff --git a/src/version.ts b/src/version.ts index e440720..f03e77e 100644 --- a/src/version.ts +++ b/src/version.ts @@ -1,2 +1,2 @@ // Calendar version (YYYY.DDD.PATCH), shared scheme with @vibgrate/cli. -export const VERSION = '2026.916.2'; +export const VERSION = '2026.916.3';