Skip to content

Release 2.1.134 (2026-07-13)

Bug fixes

  • grant actions:read so CD starts with cd-release@v2.1 (#2322) cd-release.yml@v2.1 (T9, vergil-actions#769) added actions:read to its job permissions so the evidence step can download the release PR's ci-evidence artifacts. A reusable workflow cannot request more than the caller grants, and cd.yml granted only {attestations, contents, id-token, pull-requests}. The missing actions scope made every CD run fail at load with startup_failure (the job graph is validated at startup even on develop where release is skipped).

Add actions:read to the top-level permissions block so the release job, which inherits top-level, grants it to cd-release.yml. The docs job's contents:write override is untouched.

Documentation

  • document the CI evidence convention and bundle format (#2321) Add the convention doc that any release-publishing repo or future CI gate conforms to: the ci-evidence- artifact name and evidence.json fragment schema, the evidence-producing gate set derived from desired_ci_gates_ruleset, the producer prerequisite that gates emit real report files, the bundle tree and manifest.json v1.0 schema (per-file sha256, missing_gates, provenance), verification via gh attestation verify plus sha256, and a pointer to the warning-mode deployment lifecycle. Registers the page in the mkdocs Guides nav. Ref #2317.

Features

  • link CI evidence bundle from release pages (#2318) Add evidence_link_line(repo, tag, , has_asset) to lib/docs.py — a pure builder for the 'CI Evidence:* ... Download →' line on a release page, or None when the release has no evidence asset. Wire vrg-docs-stage to resolve has_asset per staged release via 'gh release view --json assets' (one cheap call at docs-build time; a 404 means no asset, other gh errors propagate) and append the line.

Prevent drift: extract evidence_asset_name(tag)/evidence_manifest_name(tag) into lib/ci_evidence.py as the single source of truth for the bundle's published filename, and have both the harvester (vrg-ci-evidence) and this doc-site link derive the name from them.

Task T6 of epic vergil-project/.github#140.