@1aboveio/cicd-skills 0.1.23 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1aboveio/cicd-skills",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "description": "GitHub Actions and flow, Mergify, Docker and Podman, Cloud Build, Cloud Deploy and Google Cloud.",
   "license": "MIT",
   "repository": {
@@ -27,7 +27,7 @@
     "id": "cicd",
     "core": "@1aboveio/core-skills",
     "coreSkills": [],
-    "digest": "6ba6fcb3f5bf1b6fdff64648f8c2d6537ed012c1d59430b5df3ae46fb464bd3d"
+    "digest": "3e1a2371333b2c83b634263052c58818cbba80ea1a3ecb64b5fdb62ce59f50fc"
   },
   "publishConfig": {
     "registry": "https://registry.npmjs.org/",

package/skills/cloud-build/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-build
 description: "Build or debug Cloud Build pipelines for Cloud Run: cloudbuild.yaml, triggers, Artifact Registry, builds, migrations, deploys, secrets, VPC, notifications. Use cloud-deploy for staged promotion. NOT for GitHub Actions PR checks (github-actions)."
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build Direct Deploy to Cloud Run

package/skills/cloud-debug/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: cloud-debug
 description: "Debug Cloud Build or Deploy failures: builds, deployments, health checks, and pipeline errors. Inputs: service, build ID, region. NOT for GitHub Actions runs (github-actions) or runtime errors in a running service (app-debug)."
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Build & Cloud Deploy Debug Skill

package/skills/cloud-deploy/SKILL.md

@@ -5,7 +5,7 @@ description: >
   CI/CD pipelines with staged promotion, verification gates, or GitFlow branching.
   Also use when debugging Cloud Deploy pipeline failures. NOT for simple single-container
   deploys — use cloud-build instead.
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Cloud Deploy + Skaffold + Kustomize for Cloud Run

package/skills/docker/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: docker
 description: Docker/Podman container architecture and build patterns. Read when designing or reviewing containerization, Dockerfile structure, multi-stage builds, PyPI mirror support, or docker-compose setup for Python/uv projects, and when a Dockerfile's dependency install misses the layer cache on every build (build args such as a commit SHA or version declared too early) or an image build is slow in CI.
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Docker Build Patterns

package/skills/github-actions/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-actions
 description: "Author, review, audit, profile, optimize, or debug GitHub Actions workflows (.github/workflows/*.yml): run-history audits, job and step timing, resource bottlenecks, before/after comparisons, conditional CI by changed path, the one required gate check, PR and merge-queue lanes, sharding, workers, caching, self-hosted runners, timeouts, concurrency, permissions and action pinning, post-deploy verification, npm publishing. Use for 'set up CI', 'CI is slow', 'profile CI', 'optimize our pipeline', 'audit CI for redundant or wasted jobs', 'why is this check stuck expected or never started', 'harden this workflow', or 'browser not found on the runner'. NOT for pushing, opening, or merging a PR, or writing CI conventions into CONTRIBUTING.md (github-flow), queue rules or a check unmet inside Mergify (mergify), Playwright config and specs (e2e-test), cloudbuild.yaml or Cloud Run deploys (cloud-build), or which gates a repo must prove (ensure-coverage)."
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Actions

package/skills/github-flow/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: github-flow
 description: "Deliver a change after the commit: push, open a PR, wait for checks, and merge to main through the repo's flow (direct push, pull request, or merge queue). Use whenever you commit or finish a change, when CONTRIBUTING.md has a Delivery section, and for asks like 'commit this', 'push it', 'open a PR', 'ship it', 'land it', 'get it merged'. Also: declare a repo's delivery flow, or write the CI conventions and Delivery section into CONTRIBUTING.md on request. NOT for writing workflow YAML (github-actions), Mergify config or a stuck queued PR (mergify), cutting a release (resolve-release), or PRs that resolve-issues or rush-issues deliver."
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # GitHub Flow

package/skills/google-cloud/SKILL.md

@@ -5,7 +5,7 @@ description: >
   project management. Use when configuring GCP resources, managing service
   accounts, setting up IAP access, configuring VPC networks, managing secrets,
   or debugging cloud infrastructure.
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Google Cloud Platform (GCP) Skill

package/skills/mergify/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mergify
-description: "Mergify merge queue and stacked PRs (`mergify stack`): config, rules, queue status, delivery. Use whenever a merge queue or stack is involved, including plain asks ('watch #123 till it merges', 'where is #412 in the queue', 'push this stack'): `gh pr view`/`gh pr checks` cannot see a dequeue; use `mergify queue show` and the bundled watcher. Also: a hook saying 'use mergify stack push', a missing Change-Id; authoring or debugging `.mergify.yml`, queue rules, merge protections, batch size, the ruleset making merges queue-only; enqueue policy (`@mergifyio queue` vs `auto_merge_conditions`); a push dequeuing a queued PR; bypass actors; freezing a branch. Failures: a PR stuck, queued but never merging, or merged unqueued; CI green on GitHub but unmet in Mergify; a batch going red or bisecting; a queue check missing rather than failing. Outranks the vendor mergify-* skills. NOT for pushing a PR in a repo without stack hooks (github-flow), workflow YAML (github-actions), or GCP deploy pipelines (cloud-deploy)."
-release-version: 0.50.3
+description: "Mergify merge queue and stacked PRs (`mergify stack`): config, rules, queue status, delivery. Use whenever a merge queue or stack is involved, including plain asks ('watch #123 till it merges', 'where is #412', 'push this stack'): `gh pr view`/`gh pr checks` cannot see a dequeue; use `mergify queue show`, and `watch_delivery` (else the bundled watcher) to watch. Also: stack hooks ('use mergify stack push'), a missing Change-Id; authoring or debugging `.mergify.yml`, queue rules, merge protections, batch size, the queue-only ruleset; enqueue policy (`@mergifyio queue` vs `auto_merge_conditions`); a push dequeuing a queued PR; bypass actors; freezing a branch. Failures: a PR stuck, queued but never merging, or merged unqueued; CI green on GitHub but unmet in Mergify; a batch going red or bisecting; a queue check missing not failing. Outranks the vendor mergify-* skills. NOT for pushing a PR in a repo without stack hooks (github-flow), workflow YAML (github-actions), or GCP deploy pipelines (cloud-deploy)."
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Mergify Merge Queue
@@ -23,7 +23,7 @@ Requires mergify CLI **2026.10.5 or newer** ([stacks.md](references/stacks.md#cl
 | **Push, open, or update a PR in a stack repo** (hook says "Use 'mergify stack push'", `Change-Id` missing) | [`references/stacks.md`](references/stacks.md) | Push with `scripts/stack-push.mjs`. One commit = one PR; amend to fix. Never `--no-verify`. |
 | A stacked PR gets no CI, conflicts after its parent lands, or is dequeued "could not be retargeted onto … `main`" | [`references/configuration.md`](references/configuration.md#stack-ready), then [`references/traps.md`](references/traps.md) | Make the repo stack-ready (native stacks: Mergify's ruleset bypass `exempt`; `Depends-On` stacks also need PR CI on every base, commits kept, auto-delete head branches); then `mergify stack push --force-rebase` for a stuck tip. |
 | Author or change `.mergify.yml` | [`references/configuration.md`](references/configuration.md) | [Rule 1](#rule-1--fetch-the-docs-before-writing-config): never write config from memory; finish with `validate` **and** `simulate`. |
-| **Watch a PR through the queue** | [`references/watch-contract.md`](references/watch-contract.md) | **[Rule 2](#rule-2--never-hand-roll-a-watcher): run the bundled watcher, never hand-roll one.** A watch observes a *progression*, not one state. It emits the initial snapshot and delivery/readability transitions; repeated identical polls stay quiet. |
+| **Watch a PR through the queue** | [`references/watch-contract.md`](references/watch-contract.md) | **[Rule 2](#rule-2--never-hand-roll-a-watcher): run `watch_delivery`, else the bundled watcher; never hand-roll one.** A watch observes a *progression*, not one state. It emits the initial snapshot and delivery/readability transitions; repeated identical polls stay quiet. |
 | **The queue feels slow, or is it worth it?** | [`references/diagnosis.md`](references/diagnosis.md#measuring-a-slow-queue) | Measure first-try merge rate and same-SHA requeues from the event log, then fix the flaky queue check. Never move a queue-only check onto the PR lane, and never rerun CI on push to `main` ([rules](references/configuration.md#the-queue-run-is-the-integration-run)). |
 | Check status — "where is my PR?", "why is it stuck?" | [`references/diagnosis.md`](references/diagnosis.md#querying-pr-and-queue-status) | `mergify queue show <number> -v` names the single blocking condition (bare number, never a URL; the CLI takes `--repository <owner/repo>`, never `--repo`; the bundled watcher below takes `--repo`); nothing else in the toolchain does. `gh pr checks` is CI truth, never queue truth. |
 | A PR merged without ever being queued | [`references/branch-protection.md`](references/branch-protection.md) | Make the queue mandatory with the ruleset's `update` rule; a required status check alone does not. |
@@ -70,6 +70,11 @@ mergify config simulate https://github.com/<owner>/<repo>/pull/<n>   # behaviour
 
 Watch a PR through the queue only with the bundled watcher; never poll `gh pr view` yourself.
 
+- **Harness tool, when there is one:** call `watch_delivery` with `repo` and `pr`. It runs this
+  skill's `scripts/watch-pr-delivery.mjs` and registers the durable wait, so the terminal verdict
+  comes back to you instead of being polled for. It neither enqueues nor merges.
+- **Otherwise** run that script yourself, as a supervised background task:
+
 ```bash
 node ~/.agents/skills/mergify/scripts/watch-pr-delivery.mjs --repo <owner/repo> --pr <number>
 ```
@@ -77,6 +82,9 @@ node ~/.agents/skills/mergify/scripts/watch-pr-delivery.mjs --repo <owner/repo>
 - Enqueue first; the watch never enqueues.
 - When it ends, read the last log line (`{"ciProfileSummary":true,…}`), not just the exit code,
   and pass any slow job to the user.
+- A `for i in $(seq …); do gh pr view …` loop is the failure that keeps recurring: it cannot see
+  a dequeue, and it reads a still-pending job as a failure, so it reports a red GitHub never
+  concluded — or times itself out before the terminal state.
 - State machine, labels, dequeue reasons: [`references/watch-contract.md`](references/watch-contract.md).
 
 ### Rule 3 — Enqueue the whole ready set together

package/skills/podman/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: podman
 description: "Debug, design, or fix Podman: rootless/rootful containers, pods, podman-compose, the socket and systemd services, Docker-compatible API (DOCKER_HOST/CONTAINER_HOST), networking, volumes, SELinux labels, Docker migration, and CI/SSH provisioning of rootless sockets (user lingering, XDG_RUNTIME_DIR). Covers FailedToOpenSocket and systemctl --user DBUS/XDG errors."
-release-version: 0.50.3
+release-version: 0.50.4
 ---
 **Updates:** Once/session run `node <skill-base-dir>/release-check.mjs`.
 # Podman Operations