Skip to content

Release 2.1.117 (2026-07-07)

Bug fixes

  • also freeze relative workflow refs (#2177) (#2178) vrg-freeze-refs rewrote ./actions/ and /...@develop, but not relative workflow refs (./.github/workflows/). A reusable workflow that nests another reusable via a relative ./ ref therefore shipped unfrozen and unresolvable cross-repo (the cd-docs-refresh startup failure, vergil-actions#751). Add the rewrite ./.github/workflows/ -> /.github/workflows/@ and flag unfrozen relative workflow refs in validate_no_unfrozen. TDD; 100% covered.

  • strip GitHub-injected dismissal_restriction from ruleset comparison (#2180) GitHub's rulesets API now returns dismissal_restriction as a server-side default on the pull_request rule. The desired state never sets it, so it survived into compute_diff as phantom drift: audit reported NON-COMPLIANT and apply could never clear it (GitHub re-injects the default on every write) — an unwinnable audit/apply loop that failed the vrg-release audit gate.

Add dismissal_restriction to _STRIP_RULE_PARAMS, the existing mechanism for API-default fields the tool does not manage, exactly as do_not_enforce_on_create is handled. Extend the normalize-rules tests to cover it.