@clear-capabilities/agentic-security-scanner 0.192.0 → 0.193.0

package/CHANGELOG.md

@@ -9,6 +9,17 @@
 > make the history less accurate, not more.
 
 
+## 0.193.0 - A shorter release: no gate on a tag push, one early gate instead of two, a lighter tag-time workflow
+
+The 0.192.0 release took 64 minutes end to end (push 55 s, hosted checks 895 s, release gate 1350 s, tag 700 s, release workflow 592 s, npm 267 s). This release removes the parts of that which repeated work or waited without a reason. None of it was measured end to end at the time of writing: the next `TIMINGS` line is the measurement, and this entry does not quote a number it has not seen.
+
+- **A tag push is no longer gated.** The pre-push gate ran again, for 697 s, when ship pushed the release tag, although the tag names a commit that was already gated when its branch was pushed. A tag whose commit is already contained in a remote-tracking branch now counts as "no new commits". A tag on a commit the remote lacks is still gated, and a branch is never exempt.
+- **The early release gate is now actually used.** A defect found in the 0.192.0 run: right after a push, the pull request API can still report the previous head commit, so ship recorded the early gate's pass (and the pre-push pass) against a stale commit. The post-merge `verify` then found no matching early pass and ran 25 checks again, 1350 s that overlapped nothing. The pull request head is now taken from the branch on origin when that is the commit just pushed. `verify` after the merge then runs only the two checks that need the merge (`head-pushed`, `remote-ci-green`).
+- **A slow informational job no longer restarts the whole run.** The stuck-job detector counted informational jobs. A 40 minute `local-model` run made ship cancel and re-run the entire CI run, discarding the progress of every blocking job (about 40 minutes in the second 0.192.0 attempt). Informational jobs are now exempt from that detector.
+- **The tag-time release workflow runs less.** On a tag push only the `rest` leg runs its checks (changelog, version, catalogs, dependency currency and the hosted-CI check that requires every blocking pull-request check to be green for the commit). The test shards, both bench groups and the closure leg are marked `full_only` and run for real on a `workflow_dispatch` dry run. What this gives up is a clean-runner re-run, with the cache off, of those legs at tag time; the pull request's blocking jobs ran the same work for the same tree. A tag pushed for a commit that never had a pull request is guarded only by the hosted-CI check in `rest`, so run the dry run first in that case. `publish` still needs the gate job, still verifies the bundle and package shape on its own runner, and is still the only job with `id-token: write`.
+- **The npm check no longer holds the release open.** `ship` waits 90 s for the registry to show the version. If it is still behind, the release is reported as shipped with the npm check PENDING and marked "NOT YET VERIFIED"; `node scripts/ship.mjs --resume` re-runs only that check. It is never reported as verified before the registry shows the version with its provenance attestation.
+- **Not done, and why.** (a) Running the local release closure in parallel with the other early checks: the closure rebuilds `dist` in place, so overlapping it with checks that read the bundle on the same checkout is unsafe; it needs its own worktree. (b) Moving `language-tools-ghc` and `language-suites` to the informational tier: the early gate (the closure alone is 1080 s, of which `test:loop` is 567 s) is longer than the slowest hosted blocking job, so the change would remove a merge check and save no wall-clock time until the closure shrinks. (c) Dropping the hosted release workflow's remaining checks entirely: not done, and not recommended.
+
 ## 0.192.0 - Faster pushes: a fast gate tier, an early release gate, and the bench gates on the pull request
 
 - **What a push runs.** The default pre-push tier no longer repeats work the hosted pull-request CI already runs and blocks the merge on. It skips the CVE-replay corpus and layer-recall locally, runs self-scan and the Haskell precision check live only when the change touches code they measure (the first hosted run of the new \`bench-gates\` job failed on a self-scan drift that the fast tier had skipped, which is why self-scan stays local for scripts, hooks and engine changes), and runs only the unit-test files that can see the change (reverse import graph plus named-path mentions in `scripts/gate-select.mjs`) instead of the whole suite. A change it cannot bound, or a selection over 60% of the suite, runs everything. `--full` or `AGENTIC_SECURITY_PUSH_GATE=full` restores the old gate. Every skipped check is printed with its reason and is never reported as passed.