Skip to content

Release 2.1.136 (2026-07-13)

Refactoring

  • split vrg-ci-evidence into harvest + assemble subcommands (#2331) The atomic vrg-ci-evidence bundle re-harvests on every call (resolve PR, select CI run, download ci-evidence-* artifacts). cd-release runs it twice per release (gate + attach), doubling the artifact downloads and the failure surface for no benefit (#2330).

Split the flow into two subcommands backed by lib orchestrators:

  • harvest --repo --merge-sha --out-dir <staging>: resolve -> select run -> download -> read conclusions -> validate_completeness; persist the harvested evidence/ tree plus a versioned harvest-state.json (PR number, validated head SHA, run URLs, raw check conclusions, per-gate conclusions) into the staging dir. The pre-publish gate.
  • assemble --staging <dir> --version --generated-at --out-dir [--sbom-file]: read the persisted harvest -> checks.json/README/SBOM -> build + write manifest -> tarball + standalone manifest. No network.
  • bundle: recomposed as harvest + assemble over a temp staging dir, byte-for-byte identical to the prior atomic behaviour (back-compat + local dogfooding).

The harvest-state.json schema (HARVEST_STATE_SCHEMA_VERSION) is a stable interface so cd-release can persist one harvest across its two workflow steps. main stays a thin orchestrator; shared logic lives in lib.ci_evidence. Deterministic (generated_at injected). Full unit coverage for each subcommand plus a harvest-then-assemble == bundle equivalence test; 100% line coverage.