Skip to content

Release 2.1.147 (2026-07-15)

Bug fixes

  • add actions:read to generated cd.yml release permissions (#2399) For a publish.release=true repo, the generated cd.yml top-level permissions block granted attestations/contents/id-token/pull-requests but not actions. The release job inherits that block and calls cd-release.yml@v2.1, which requests actions:read. Because the caller sets an explicit permissions block, unlisted scopes default to none, and GitHub validates reusable-workflow permissions at parse time — so the entire CD workflow failed with startup_failure on every push to develop and main, even though the release job is if:main-gated (if is evaluated after parse). Add actions:read to the top-level permissions so the release job's inherited permissions satisfy cd-release.yml.

  • reflow generated README description under markdownlint MD013 (#2400) The scaffolded README.md emitted the user-supplied description paragraph verbatim as a single line. A typical description exceeds the bundled markdownlint MD013 limit (100), and vrg-validate lints README.md, so the first PR of every new repo failed validation on generated content before any real code.

Reflow the description to <=100-char lines with a paragraph-aware wrap (word boundaries; long tokens like URLs are never split; blank-line-separated paragraphs are preserved). A freshly-created repo now passes vrg-validate with no manual README edit.

Features

  • run the finalize/release/install cascade on the relay branch path (#2401) The relay/positional-branch submit path refused --finalize/--release/--install, forcing the human to open the PRs and then run the cascade separately (looking up each PR number). The refusal was an artificial narrowing, not a technical constraint: the cascade is a local macOS action, and vrg-finalize-pr already merges and cleans up a branch that is not checked out locally — the cloud-to-Mac case the relay exists for.

Route the relay path through the cascade when a cascade flag is passed, reusing the same batch semantics as the local worktree batch: finalize each opened PR (vrg-finalize-pr --skip-post-checks), then — only if every branch merged — a single end-of-batch validation followed by one vrg-release (never one per branch). A branch already carrying a submitted PR is fail-fast in the cascade; without a cascade flag it is reported and skipped as before. Dry-run previews each PR and names the cascade without side effects.

CI Evidence: All gates passed — full audit bundle available. Download →