Skip to content

Release 2.0.33 (2026-05-22)

Bug fixes

  • add missing container-tag to audit and test jobs The render_ci_workflow() generator always emits container-tag for every reusable workflow job, but the audit and test jobs in this repo's ci.yml were missing the parameter — drift from a generator default change after initial generation.

  • make status comment failures non-fatal in orchestrator Move comment_phase_complete() outside the phase try block so a transient GitHub API failure (e.g. HTTP 502) posting a status comment cannot kill the release pipeline after the phase itself has already succeeded. Comment failures are now logged as warnings.

  • decouple status comment from phase error handling in orchestrator Move comment_phase_complete() into its own try/except so a failure posting a status comment is raised as a ReleaseError with phase='comment()' rather than being attributed to the phase that already succeeded. The comment is still error-checked and still fatal — it is just no longer conflated with the phase function itself.

  • raise ReleaseError on comment failure instead of logging warning Complete the decoupling: replace the logger.warning fallback with a ReleaseError that uses phase='comment()' so comment failures are still fatal and properly attributed.

  • validate template tag to prevent SSRF in fetch_template Reject tags that don't match vN.N or vN.N.N pattern before constructing the template download URL. Eliminates CodeQL SSRF warning. Ref #1017

  • handle first release when no prior tags exist git describe --tags fails with exit 128 when a repo has never been tagged. The _check_version_not_tagged preflight check now catches CalledProcessError and returns early — no tags means the version cannot be double-tagged.

Chores

  • bump version to 2.0.33

Documentation

  • update Plan 3 for dynamic-only token architecture Reflect the architecture decision that no standalone token tool is needed. All token acquisition happens dynamically at runtime via vrg-git / vrg-gh wrappers. Removed vrg-app-token references, GHCR bootstrap, and git identity bootstrap from the plan. Marked Tasks 1-3 complete per vergil-vm PR #24.

Features

  • vrg-vm CLI for identity VM lifecycle management Add vrg-vm command with subcommands: create, start, stop, restart, destroy, list, session. Absorbs vrg-session into vrg-vm session. Adds default_identity and projects_dir to identity config. New lib/lima.py module wraps all limactl subprocess calls. Ref #1017