Skip to content

Release 2.1.234 (2026-10-09)

Not published. 2.1.234 was merged to main but never tagged or released: the enforcing CI-evidence gate failed closed because its artifact harvest read only the first API page of artifacts (fixed by #3160; tracking issue #3158 closed as not planned). These changes ship in 2.1.235.

Bug fixes

  • retry transient GitHub GraphQL 'Something went wrong' errors (#3152) GitHub's GraphQL endpoint intermittently fails with 'Something went wrong while executing your query' (its 5xx-equivalent, usually a backend timeout). It stopped vrg-release confirm/wait stages repeatedly where a manual re-run always succeeded. Add the exact phrasing to retry._RETRYABLE_PATTERNS so every gh/git path (github._run_with_retry, release _stream_with_retry, vrg-gh) rides it out with the existing bounded, logged backoff (MAX_RETRIES=4) and then re-raises the original error. Matched on the exact phrasing so an unrelated 'something went wrong' still fails fast. Ref #3148

  • apply the fail-fast apt options to vrg-vm install and upgrade (#3154) The apt-get update and apt-get install calls in lib/vm_packages.py, used by vrg-vm create and update, ran without the fail-fast options. They now build their argv through repo_setup.apt_get, so APT_FAIL_FAST stays the single definition shared by repository setup, the builders and the VM install. vm-spec.md now says the options cover every vrg-vm apt call. Ref #3149

  • add Retries::Delay=false and DPkg::Lock::Timeout=60 to the fail-fast apt options (#3155) APT_FAIL_FAST now matches the apt.conf that vergil-actions os-prereqs.sh writes for CI. Retries::Delay=false avoids the apt 2.4-2.8 mirror-failover deadlock (Launchpad #2003851); DPkg::Lock::Timeout=60 waits out a dpkg lock held by unattended-upgrades or apt-daily on a freshly booted VM. Both verified accepted by apt 2.8.3 (ubuntu:24.04) and apt 3.2.0 (ubuntu:26.04). Ref #3150

  • retry transient GitHub errors in pr_checks and failed_check_names (#3156) gh pr checks exits non-zero for failing or pending checks, so pr_checks and failed_check_names ran it with check=False and the shared retry layer never fired: a transient blip (502/504, transport error, GraphQL error) failed them on the first attempt.

Add github.run_tolerating, which runs a gh command whose non-zero exit can be a valid answer. An exit the caller's is_answer predicate accepts (check-state JSON, "no checks reported", an HTTP 404 from gh api -i) is returned immediately and never retried. Any other exit is retried with the shared retry.is_retryable classification and retry.compute_delay backoff, then raises GitHubAPIError (MissingGitHubTokenError for a missing token) once the budget is spent or for a non-transient error.

The same audit found two other gh call sites in lib/ that bypassed the retry layer and also failed silently: github.delete_if_exists read any failure as "deleted", and github_config._fetch_vulnerability_alerts read any non-204 status (including a 502) as "disabled" and skipped App-credential injection. Both now go through run_tolerating and raise on an unexpected status.

  • retry transient GitHub errors in the package-index collector's gh calls (#3157) Route every gh call in lib/package/index/collect.py (release list/view/download and attestation verify) through a new retry.call_with_retry, the callable form of run_with_retry, so they share lib/retry.py's transient classification and bounded backoff while keeping the injectable Run transport. Non-transient failures (release not found, failed attestation) raise at once; a transient failure that outlasts the budget still fails the index run with PackageError. Local tools (dpkg-deb, rpm, rpmkeys) are never retried. repo_setup.py is unchanged.

Documentation

  • document binary package publishing across tooling docs (#3145) Closing documentation review for epic vergil-project/.github#356 (Ref #3072): the secrets-inherit exception for [package] repos, the package build/sign/index release flow and package-index wait, agent-VM consumer rows, vrg-package/vrg-sarif-filter/vrg-vm entries, the three-target consumption model, apt install pointers, and a corrected reduced-tier comment in matrix.py.

Features

  • generate packaging-capable ci.yml and cd.yml for [package] repos (#3146) For a vergil.toml with [package], ci.yml gains the package job calling ci-package.yml (the package / evidence gate) and the cd.yml release job uses secrets: inherit, since an explicit secrets map does not deliver the package-signing environment secrets to a cross-repo reusable workflow (vergil-project/packages#6). Repos without [package] keep the least-privilege explicit map. Adopt now preserves hand-written vergil.toml tables such as [package] and [container] verbatim (verified by re-parse, failing loudly otherwise), so re-running init keeps [package] and step 9 requires package / evidence. Documents the opt-in in consuming-repo-setup.md. Ref #3144