Skip to content

Release 2.1.236 (2026-10-10)

Bug fixes

  • bound every merge wait and treat a concluded stale check-run as terminal (#3174) Release, finalize, update-deps and wait-until-green now share one bounded poller (github.wait_for_checks). The release path previously streamed gh pr checks --watch, which had no deadline and hung release 2.1.235 for 12+ hours on a check-run GitHub left at status=IN_PROGRESS with conclusion=SUCCESS.

  • gh pr checks derives state from status unless it is COMPLETED, so it reports such a check pending forever. pr_checks and failed_check_names now re-bucket any pending check whose statusCheckRollup check-run carries a conclusion (check_run_bucket, keyed by detailsUrl), warning once per stale check-run.

  • The deadline (default 1800s, ~4x the longest legitimate CI) is configurable via VRG_CHECKS_TIMEOUT; a malformed or non-positive value raises. On expiry ChecksTimeoutError names each pending check and its link, and wait_and_merge turns it into MergeAbortError (ReleaseError in vrg-release) with the recovery path.

  • The waiter prints each pending check with how long it has been pending.

  • harvest the newest same-named gate artifact by id (#3176) A re-run of a gate's evidence job uploads a second artifact under the same name, and the harvester downloaded every match by name into one directory, aborting on 'evidence.json: file exists' (2.1.235 release). Group the listed artifacts per required gate, choose the newest unexpired copy (created_at, then id) with a warning naming the duplicates, and fetch it by id via the actions/artifacts/{id}/zip endpoint through a new retrying github.download_api_binary helper. Extraction rejects absolute or traversing member paths before writing anything. Every copy expired, or an unsafe archive, raises EvidenceArtifactError, which the CLI reports as a one-line error. Ref #3171

  • adopt a merged release PR whose head was updated server-side; never push when merged (#3177) On resume, prepare now adopts a merged release PR whose head descends from the local branch tip (the merge-release server-side update-branch case), fast-forwarding the local branch to the fetched PR head. An unrelated tip (the #1719 straggler) or a missing head SHA now fails loud instead of falling through to a push that re-created the deleted remote release branch at a stale tip. Adds git.is_ancestor, which raises on errors rather than reading them as 'not an ancestor'. Ref #3172

  • sync the local release branch after a server-side update-branch (#3178) pr_merge.wait_and_merge gains an on_branch_updated hook, called after each successful update-branch; the engine stays local-checkout agnostic and the default (None) leaves vrg-finalize-pr and update-deps unchanged. merge_release records whether the release PR was updated and, after the merge, fast-forwards the local release branch in the managed worktree to the merged PR head (release.merge.sync_local_branch). It fails loudly when the worktree is on another branch or the head does not descend from the local tip, and never resets over local commits. Ref #3175.

CI Evidence: All gates passed — full audit bundle available. Download →