@clear-capabilities/agentic-security-scanner 0.191.0 → 0.193.0

package/CHANGELOG.md

@@ -9,6 +9,25 @@
 > make the history less accurate, not more.
 
 
+## 0.193.0 - A shorter release: no gate on a tag push, one early gate instead of two, a lighter tag-time workflow
+
+The 0.192.0 release took 64 minutes end to end (push 55 s, hosted checks 895 s, release gate 1350 s, tag 700 s, release workflow 592 s, npm 267 s). This release removes the parts of that which repeated work or waited without a reason. None of it was measured end to end at the time of writing: the next `TIMINGS` line is the measurement, and this entry does not quote a number it has not seen.
+
+- **A tag push is no longer gated.** The pre-push gate ran again, for 697 s, when ship pushed the release tag, although the tag names a commit that was already gated when its branch was pushed. A tag whose commit is already contained in a remote-tracking branch now counts as "no new commits". A tag on a commit the remote lacks is still gated, and a branch is never exempt.
+- **The early release gate is now actually used.** A defect found in the 0.192.0 run: right after a push, the pull request API can still report the previous head commit, so ship recorded the early gate's pass (and the pre-push pass) against a stale commit. The post-merge `verify` then found no matching early pass and ran 25 checks again, 1350 s that overlapped nothing. The pull request head is now taken from the branch on origin when that is the commit just pushed. `verify` after the merge then runs only the two checks that need the merge (`head-pushed`, `remote-ci-green`).
+- **A slow informational job no longer restarts the whole run.** The stuck-job detector counted informational jobs. A 40 minute `local-model` run made ship cancel and re-run the entire CI run, discarding the progress of every blocking job (about 40 minutes in the second 0.192.0 attempt). Informational jobs are now exempt from that detector.
+- **The tag-time release workflow runs less.** On a tag push only the `rest` leg runs its checks (changelog, version, catalogs, dependency currency and the hosted-CI check that requires every blocking pull-request check to be green for the commit). The test shards, both bench groups and the closure leg are marked `full_only` and run for real on a `workflow_dispatch` dry run. What this gives up is a clean-runner re-run, with the cache off, of those legs at tag time; the pull request's blocking jobs ran the same work for the same tree. A tag pushed for a commit that never had a pull request is guarded only by the hosted-CI check in `rest`, so run the dry run first in that case. `publish` still needs the gate job, still verifies the bundle and package shape on its own runner, and is still the only job with `id-token: write`.
+- **The npm check no longer holds the release open.** `ship` waits 90 s for the registry to show the version. If it is still behind, the release is reported as shipped with the npm check PENDING and marked "NOT YET VERIFIED"; `node scripts/ship.mjs --resume` re-runs only that check. It is never reported as verified before the registry shows the version with its provenance attestation.
+- **Not done, and why.** (a) Running the local release closure in parallel with the other early checks: the closure rebuilds `dist` in place, so overlapping it with checks that read the bundle on the same checkout is unsafe; it needs its own worktree. (b) Moving `language-tools-ghc` and `language-suites` to the informational tier: the early gate (the closure alone is 1080 s, of which `test:loop` is 567 s) is longer than the slowest hosted blocking job, so the change would remove a merge check and save no wall-clock time until the closure shrinks. (c) Dropping the hosted release workflow's remaining checks entirely: not done, and not recommended.
+
+## 0.192.0 - Faster pushes: a fast gate tier, an early release gate, and the bench gates on the pull request
+
+- **What a push runs.** The default pre-push tier no longer repeats work the hosted pull-request CI already runs and blocks the merge on. It skips the CVE-replay corpus and layer-recall locally, runs self-scan and the Haskell precision check live only when the change touches code they measure (the first hosted run of the new \`bench-gates\` job failed on a self-scan drift that the fast tier had skipped, which is why self-scan stays local for scripts, hooks and engine changes), and runs only the unit-test files that can see the change (reverse import graph plus named-path mentions in `scripts/gate-select.mjs`) instead of the whole suite. A change it cannot bound, or a selection over 60% of the suite, runs everything. `--full` or `AGENTIC_SECURITY_PUSH_GATE=full` restores the old gate. Every skipped check is printed with its reason and is never reported as passed.
+- **Those checks now run on the pull request.** A new `bench-gates` job (self-scan, mutation, fix verification, layer recall, Haskell precision) runs in parallel with the test shards and is a required check, so a regression the local push no longer catches turns the pull request red instead of failing an hour into a release.
+- **Overlapping the waits in `ship`.** The part of the release gate that hosted CI does not cover (chiefly the release closure, 18 of the last 22 minutes of the verify phase) now starts on the pull-request head while the hosted checks run, and a failure stops the run before the merge instead of after it. After the merge only the two checks that need it remain. Dependency currency is also checked before anything is pushed: it failed an hour into the 0.190.0 release on a newly published advisory.
+- **Measured, with a caveat.** On the one real change tried (a one-line edit to a Haskell engine module, base set to the previous commit), the fast tier selected 390 of 1,028 test files and passed in 1,633 s, but the machine was heavily loaded by other applications, so the benches ran 1.2 to 5 times slower than in an earlier idle profile of the old gate (1,155 s, of which the full suite was 704 s). Estimated idle time for that change is under 10 minutes, **not** the under-5-minute target. A change to a central module still reaches about 40% of the suite through static imports. Getting a central change under 5 minutes needs per-test line coverage so a comment-only or unexercised edit selects almost nothing; that is not built.
+- **Not changed:** the hosted release workflow still runs the whole gate with caching off before it publishes, and the tag-time trust model is unchanged.
+
 ## 0.191.0 - GitHub Release pages from the changelog
 
 - **A Release page for every tag.** The `publish` job now creates a GitHub Release after `npm publish`, with its body taken from this file's section for the version (one shared `changelogSection` extractor, which no longer lets `1.2.3` match a `1.2.3-rc1` heading). An existing Release is edited, never recreated; `--verify-tag` means the step cannot create or move a tag; a dry run never creates one; `contents: write` is held by `publish` alone. **This step has not run on hosted infrastructure yet.** It is first exercised by this release's own tag, and if it fails after npm has published, the workflow run fails while the package stays published.