Skip to content

Release 2.1.257 (2026-10-23)

Bug fixes

  • pin uv to the docs image's Python in vrg-container-docs (#3448) A Python repo's docs build now sets UV_PYTHON_PREFERENCE=only-system, matching the CI docs jobs (vergil-actions#1002). A repo with python-preference = "only-managed" can no longer make uv fetch, or fail to find, a managed interpreter. Docs builds resolve no version, so only the source is pinned, through the new source_env() in the Python resolver extension, which container_env() now builds on. There is no fallback: if the image's Python misses requires-python, uv fails loudly. Ref #3414

  • use the repo's ad-hoc epic when the sweep epic is in another org (#3450)

  • surface an unreadable vergil.toml in the managed-file renders (#3453) dependabot.resolve_language and repo_config._gitignore_language no longer turn a ConfigError into None. An absent vergil.toml or undeclared language still resolves to None. vrg-dependabot-sync and vrg-gitignore-sync exit 2 with the config error and write nothing, which the fleet sweep records as a per-repo error row. The local gitignore audit reports an explicit failure instead of judging the fence against a silent base-only language. Ref #3451

  • recognise local reusable-workflow calls in the CI-gates guard (#3457) _CI_USES_RE required a trailing @, so a ci.yml that calls its reusable workflows by local path (uses: ./.github/workflows/.yml, as vergil-actions does) yielded no caller jobs and apply refused every required context. A local call now maps to the same reusable-workflow name as the remote form. Ref #3454.

  • build against the per-series vergil-python package and derive vergil-tooling's runtime (#3458) The python builder used the full [package.python].runtime value as the package name and install root, so a 3.14.8 pin installed the legacy per-patch vergil-python3.14.8 at /opt/vergil/python/3.14.8. It now installs, builds against and depends on the per-series vergil-python at /opt/vergil/python/ for pinned and derived runtimes. An exact-patch pin is checked against the installed CPython patch and the build fails loudly when the series package serves another one. vergil-tooling drops its own 3.14.8 pin so its runtime is derived from the window. Ref #3455

Chores

  • uv lock --upgrade
  • add the report-only dependabot.yml (#3449)

Features

  • an app pins exactly one version (#3445) Flip STRICT_APP_PINS to True (epic vergil-project/.github#407, Task 14): an app (any repository-type other than library) whose [ci].versions lists more than one version now fails resolution instead of warning. The fleet sweep that removed those lists is done. vrg-ci-resolve, vrg-validate, vrg-container-run and repo init all fail on it. The error now says exactly what to do: pin a single version, or set [project].repository-type = "library" if the repo really is a library. Ref #3372

Refactoring

  • remove the strict-app-pins switch and resolution warnings (#3452) Task 14 made an app multi-pin fatal, which left the transition machinery dead: the STRICT_APP_PINS constant, the strict_app_pins parameter on resolve, resolve_language and resolve_config, and Resolution.warnings, whose only producer was the app multi-pin warning. Remove them, and the loops in vrg-ci-resolve, vrg-container-run, vrg-validate and repo init that printed those warnings, along with the tests that injected a fake warning to cover them. Floor warnings from check_floors still print in vrg-validate. Behaviour is unchanged: an app multi-pin is fatal everywhere, and the vrg-ci-resolve JSON shape is the same. Ref #3442

CI Evidence: All gates passed — full audit bundle available. Download →