@goodtek/vibeops 3.1.1 → 3.1.4

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to VibeOps are documented here.
 
 ## Unreleased
 
+## 3.1.4 - 2026-10-16
+
+### Changed
+
+- No CLI changes. First release published from GitHub Actions (`publish.yml`, npm Trusted Publishing with provenance) instead of a maintainer machine.
+
+## 3.1.3 - 2026-10-16
+
+### Fixed
+
+- **Negated flags were ignored.** commander stores `--no-foo` as `foo: false` and never sets `noFoo`, but the CLI read `noFoo`, so these flags did nothing: `task release --no-merge` (created the release PR and merged it anyway — observed merging before the PR's checks finished), `task del --no-remote-delete` / `--no-close-mr` (deleted the remote branch / closed the open PR anyway) and `task sync --no-remote-delete` (deleted the remote branch anyway). They now take effect, in dry-run plans too (TASK-025).
+- **`task add --dry-run` crashed** with `ENOENT` after printing its plan: the branch step read the TASK file the dry run never wrote. The plan now also names the real branch (`task/<NNN>-<slug>`; it omitted the TASK number) (TASK-026).
+
+## 3.1.2 - 2026-10-16
+
+### Fixed
+
+- **`task merge` / `task release` merged before CI started (GitHub).** The gate judged only `statusCheckRollup`, which also holds checks from other events on the head commit (e.g. a finished `push` workflow). Right after a PR was opened or pushed, its own `pull_request` run — or that run's jobs — did not exist yet, so earlier green checks counted as "all green" (observed: a release PR merged 5 s after opening, before its CI job was created; a required check name satisfied by the same-named job of a `push` workflow). The gate now also reads the GitHub Actions API for the head SHA: every workflow whose `on:` triggers `pull_request` for this PR (base-branch, path and type filters evaluated as GitHub does; disabled workflows skipped) must have a `pull_request` run, and every Actions run for the SHA must be completed with `success` / `neutral` / `skipped`. Missing or running → wait up to `waitTimeoutSeconds`, then refuse with the workflow named; `startup_failure`, `action_required` and other conclusions → refuse immediately; unreadable Actions API → wait, then refuse (TASK-024).
+- **Head SHA race:** right before merging, the gate re-reads the PR head; if it moved while checks were read, the new head is evaluated from scratch (the merge stays pinned with `--match-head-commit` / `--sha`) (TASK-024).
+- The `task merge` header no longer prints `checks all green` before anything was checked; it states the rule (`waits until every check on the head commit is green`).
+
+### Added
+
+- **CI** (`.github/workflows/ci.yml`, pull requests + `main`): lint (ESLint, new `pnpm lint`), typecheck, build, tests and smoke on Node 20 / 22 / 24, GitHub-hosted runners only, read-only token, actions pinned by commit SHA (TASK-023).
+- **Secret scanning in CI:** gitleaks 8.30.1 CLI (pinned release, sha256 checked against the pinned value and the release checksums file); PR commits `base..head`, full history on `main`; any finding fails the job (TASK-023).
+- **npm Trusted Publishing** (`.github/workflows/publish.yml`): tag `vX.Y.Z` on `main` → verify → `npm publish` via OIDC with automatic provenance; no npm token in CI. Owner setup in `docs/project/09-deployment.md`; the manual `pnpm publish:npm` path stays until it is configured (TASK-023).
+
+### Changed
+
+- `merge.pollIntervalSeconds` default **5 → 10** (the default of `gh pr checks --watch`). Host read errors back off exponentially with jitter (cap 60 s) within `waitTimeoutSeconds`.
+- "No checks at all" now also requires that no GitHub Actions run exists or is expected for the head commit; `emptyRollupGraceSeconds` only matters for CI outside GitHub Actions.
+- New runtime dependency: `yaml` (ISC) to read workflow triggers.
+- `package.json` `repository` / `homepage` / `bugs` point at `github.com/goodtek-xyz/vibeops` (required to match exactly for Trusted Publishing provenance).
+- Docs, scripts and examples use placeholders instead of maintainer-internal hosts and paths; `.infisical.json` is no longer tracked (gitignored).
+
 ## 3.1.1 - 2026-10-15
 
 ### Fixed

package/README.md

@@ -213,11 +213,16 @@ Before calling `gh pr merge` / `glab mr merge`:
   - **failed:** `FAILURE`, `CANCELLED`, `TIMED_OUT`, `ACTION_REQUIRED`, `STARTUP_FAILURE`, `STALE`, `ERROR`
   - **pending:** CheckRun `REQUESTED`, `QUEUED`, `IN_PROGRESS`, `WAITING`, `PENDING`; StatusContext `PENDING`, `EXPECTED`
   - **anything missing or undocumented fails closed** (treated as failed). Several checks with the same name: any failure fails.
+- **GitHub Actions — the PR's own CI, not leftovers:** the rollup lists every check on the head commit, including checks from other events (e.g. a finished `push` workflow on `develop` when a release PR `develop → main` is opened). Right after a PR is opened or pushed, GitHub has not created its `pull_request` run — or that run's jobs — yet, so such a rollup looked green and 3.1.x merged before CI started. The gate therefore also reads the GitHub Actions API for the head SHA:
+  - **Expected workflows:** every `.github/workflows/*.yml|yaml` at the head commit whose `on:` triggers `pull_request` for this PR, using GitHub's filter rules — `branches` / `branches-ignore` against the base branch, `paths` / `paths-ignore` against the PR's changed files (first 300, like GitHub), and `types` (a custom list must contain both `opened` and `synchronize`). Disabled workflows are skipped; `pull_request_target`, `workflow_call` and other events are not awaited. Each expected workflow must have a `pull_request` run for the head SHA — until it appears the gate **waits** (`workflow … (pull_request) has not started for <sha> yet`), then refuses at `waitTimeoutSeconds`.
+  - **All runs for the head SHA** (any event, latest run per workflow + event) must be `completed` with `success`, `neutral` or `skipped`. A queued / in-progress / waiting run waits; any other conclusion refuses immediately — including `startup_failure` (no jobs, so nothing in the rollup) and `action_required` (fork PR awaiting approval).
+  - The Actions API is required: if it cannot be read, the gate keeps waiting (back-off) and refuses at the timeout — it never merges blind.
 - **GitLab:** the MR head pipeline must be `success` or `skipped`. `failed`, `canceled`, `manual` and unknown statuses refuse; `created` / `pending` / `running` / `scheduled` / … wait.
 - **Host output is verified:** if `gh pr view` lacks or has empty `state`, `mergeable`, `headRefOid`, or `statusCheckRollup` is not a list (GitLab: `state`, `sha`, `merge_status`, `detailed_merge_status`, `head_pipeline`), the merge is refused.
 - **Failed check → refuse immediately** (exit code 1, checks named). **Pending → wait** up to `waitTimeoutSeconds`, then refuse. There is no override flag: fix CI (re-run `task ship`) and rerun `task merge`.
-- **No checks at all → refuse** (after `emptyRollupGraceSeconds`, which covers checks not yet registered right after a push) unless `allowNoChecks: true`.
-- **The merge is pinned to the checked commit:** `gh pr merge --match-head-commit <sha>` (requires **gh ≥ 2.13.0**) / `glab mr merge --auto-merge=false --sha <sha>` (verified with glab 1.106). A push after the check makes the host refuse. A GitLab `405` re-runs the gate and retries once with the same flags.
+- **No checks at all → refuse** unless `allowNoChecks: true`. "No checks" means: empty rollup, no GitHub Actions run and no expected workflow for the head commit (GitLab: no pipeline). For CI outside GitHub Actions (commit statuses / check apps), the empty list is re-polled for `emptyRollupGraceSeconds` first; list such checks in `requiredChecks` so the gate waits for them by name.
+- **Waiting** polls the host (`gh pr view` + the Actions REST API) every `pollIntervalSeconds` (default 10 s, the default of `gh pr checks --watch`) until the state changes, bounded by `waitTimeoutSeconds` (default 900 s). Host read errors back off exponentially with jitter (capped at 60 s, GitHub's guidance for rate-limited clients).
+- **The merge is pinned to the checked commit:** right before merging the gate re-reads the PR head; if it moved, the new head is evaluated from scratch. The merge itself uses `gh pr merge --match-head-commit <sha>` (requires **gh ≥ 2.13.0**) / `glab mr merge --auto-merge=false --sha <sha>` (verified with glab 1.106), so a push between the last check and the merge makes the host refuse. A GitLab `405` re-runs the gate and retries once with the same flags.
 
 ### Configuration (`.vibeops.json` → `merge`)
 
@@ -227,7 +232,7 @@ Before calling `gh pr merge` / `glab mr merge`:
     "requiredChecks": ["build", "lint*"],
     "releaseRequiredChecks": ["release smoke"],
     "waitTimeoutSeconds": 900,
-    "pollIntervalSeconds": 5,
+    "pollIntervalSeconds": 10,
     "emptyRollupGraceSeconds": 30,
     "allowNoChecks": false
   }
@@ -239,13 +244,13 @@ Before calling `gh pr merge` / `glab mr merge`:
 | `requiredChecks` | `[]` | array of non-empty strings | Checks that must be present and green for `task merge`. A missing one refuses: `required check "X" never ran`. |
 | `releaseRequiredChecks` | `[]` | array of non-empty strings | Same for `task release` (integration → production). Shown by `task release --dry-run`. |
 | `waitTimeoutSeconds` | `900` | integer 1–7200 | Max wait for pending checks. |
-| `pollIntervalSeconds` | `5` | integer 1–300, ≤ timeout | Poll interval while waiting. |
-| `emptyRollupGraceSeconds` | `30` | integer 0–600 | How long an empty check list is re-polled before "no checks" applies. |
+| `pollIntervalSeconds` | `10` | integer 1–300, ≤ timeout | Poll interval while waiting (same default as `gh pr checks --watch`). |
+| `emptyRollupGraceSeconds` | `30` | integer 0–600 | Only when no GitHub Actions workflow is expected: how long an empty check list is re-polled before "no checks" applies (time for external CI to report). |
 | `allowNoChecks` | `false` | boolean | Merge a PR that has no checks at all (repo without CI). Prints one warning per such merge. |
 
 - Check names are exact (`CheckRun.name` / `StatusContext.context`) or a `*` glob (`"lint*"`, `"* · linux"`). Required checks are GitHub-only; GitLab gates on the head pipeline.
 - The block is validated strictly: it must be an object, unknown keys (typos) and wrong types are errors, and `task merge` / `task release` exit 1 naming the key.
-- **Recommended:** list your CI jobs in `requiredChecks`. Without it, the gate only sees the checks that happened to start — a workflow that never triggers is invisible.
+- **Recommended:** list your CI jobs in `requiredChecks`. Required checks must be present **and** completed green; missing or pending means wait. Without them the gate still waits for every GitHub Actions workflow that triggers on the PR (see above), but checks from other CI systems are only seen once they report.
 
 ## License
 

package/dist/cli.js

@@ -88,8 +88,8 @@ task
     await taskDelCommand(taskRef, {
         dryRun: Boolean(opts.dryRun),
         force: Boolean(opts.force),
-        noRemoteDelete: Boolean(opts.noRemoteDelete),
-        noCloseMr: Boolean(opts.noCloseMr),
+        noRemoteDelete: opts.remoteDelete === false,
+        noCloseMr: opts.closeMr === false,
         cwd: opts.cwd,
     });
 });
@@ -148,7 +148,7 @@ task
     .action(async (taskRef, opts) => {
     await taskSyncCommand(taskRef, {
         dryRun: Boolean(opts.dryRun),
-        noRemoteDelete: Boolean(opts.noRemoteDelete),
+        noRemoteDelete: opts.remoteDelete === false,
         force: Boolean(opts.force),
         cwd: opts.cwd,
     });
@@ -165,7 +165,7 @@ task
     .action(async (opts) => {
     await taskReleaseCommand({
         dryRun: Boolean(opts.dryRun),
-        noMerge: Boolean(opts.noMerge),
+        noMerge: opts.merge === false,
         merge: Boolean(opts.merge),
         squash: Boolean(opts.squash),
         rebase: Boolean(opts.rebase),

package/dist/commands/task-add.js

@@ -12,7 +12,7 @@ import { findBlockingTask, relPath } from "../lib/task-context.js";
 import { allocateTaskId, TaskIdAllocationError } from "../lib/task-id-allocation.js";
 import { readTaskLockConfig, TaskLockConfigError, TaskLockHeldError, withTaskLock, } from "../lib/task-lock.js";
 import { isIncompleteTaskStart, startTaskBranch } from "../lib/task-start.js";
-import { loadActionableTasks, readGitContext } from "../lib/task.js";
+import { branchNameForTaskFile, loadActionableTasks, readGitContext } from "../lib/task.js";
 async function loadGitConfigOrNull(root, dryRun) {
     try {
         return await requireGitConfig(root);
@@ -242,7 +242,7 @@ export async function taskAddCommand(opts = {}) {
         const integration = gitCfg?.integrationBranch ?? "integration";
         if (dryRun) {
             log.info(`[dry-run] Would create ${bold(taskId)} → ${cyan(relFile)}`);
-            log.info(dim(`  branch task/${slugify(slug || title).replace(/^(\d+)-/, "$1-")} from ${gitCfg?.remote ?? "origin"}/${integration}`));
+            log.info(dim(`  branch ${branchNameForTaskFile(filePath)} from ${gitCfg?.remote ?? "origin"}/${integration}`));
             if (gitCfg) {
                 await startTaskBranch({
                     cwd: root,

package/dist/commands/task-merge.js

@@ -95,7 +95,7 @@ export async function taskMergeCommand(taskRef, options = {}) {
     log.info(`  ${dim("MR/PR")}      ${mergeRequestUrl}`);
     log.info(`  ${dim("target")}     ${ctx.baseBranch} (${gitCfg.integrationBranch})`);
     log.info(`  ${dim("method")}     ${method}`);
-    log.info(`  ${dim("checks")}     all green${requiredChecks.length > 0 ? ` + required: ${requiredChecks.join(", ")}` : ""}${mergeCfg.allowNoChecks ? dim(" (allowNoChecks: true)") : ""}`);
+    log.info(`  ${dim("gate")}       waits until every check on the head commit is green${requiredChecks.length > 0 ? ` + required: ${requiredChecks.join(", ")}` : ""}${mergeCfg.allowNoChecks ? dim(" (allowNoChecks: true)") : ""}`);
     log.blank();
     if (dryRun) {
         await mergeMergeRequest({

package/dist/lib/github-actions-gate.js

@@ -0,0 +1,355 @@
+/**
+ * GitHub Actions part of the merge gate: which workflow runs a PR head commit
+ * is still owed, and whether the runs that exist for it are finished and green.
+ *
+ * Why: `statusCheckRollup` lists every check on the head commit, including
+ * checks from other events (e.g. a `push` workflow on the same commit). Right
+ * after a PR is opened or pushed, GitHub has not created the `pull_request`
+ * workflow run — or its jobs — yet, so a rollup made only of earlier, finished
+ * checks looks green although the PR's own CI has not started. The gate
+ * therefore also asks the Actions API:
+ *
+ * 1. Expected runs: workflows in `.github/workflows` at the head commit whose
+ *    `on:` triggers `pull_request` for this PR (base branch, changed paths,
+ *    activity types — GitHub's documented filter rules) and that are active.
+ *    Each must have a `pull_request` run for the head SHA.
+ * 2. Every workflow run for the head SHA (any event) must be completed with
+ *    `success`, `neutral` or `skipped` (latest run per workflow + event).
+ *
+ * Docs: https://docs.github.com/actions/writing-workflows/workflow-syntax-for-github-actions#onpull_requestpull_request_targetbranchesbranches-ignore
+ *       https://docs.github.com/rest/actions/workflow-runs#list-workflow-runs-for-a-repository
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { parse as parseYaml } from "yaml";
+const execFileAsync = promisify(execFile);
+// ---------------------------------------------------------------------------
+// Filter patterns (GitHub "Filter pattern cheat sheet")
+// ---------------------------------------------------------------------------
+/**
+ * GitHub filter pattern → anchored RegExp. `*` = any chars except `/`,
+ * `**` = any chars, `?` / `+` = zero-or-one / one-or-more of the preceding
+ * char, `[…]` = character class, `\` escapes the next char.
+ */
+export function filterPatternToRegExp(pattern) {
+    let out = "";
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === "\\" && i + 1 < pattern.length) {
+            out += escapeRegExp(pattern[++i]);
+        }
+        else if (ch === "*") {
+            if (pattern[i + 1] === "*") {
+                out += ".*";
+                i++;
+            }
+            else {
+                out += "[^/]*";
+            }
+        }
+        else if (ch === "?" || ch === "+") {
+            out += ch;
+        }
+        else if (ch === "[") {
+            const end = pattern.indexOf("]", i + 1);
+            if (end === -1) {
+                out += "\\[";
+            }
+            else {
+                out += pattern.slice(i, end + 1);
+                i = end;
+            }
+        }
+        else {
+            out += escapeRegExp(ch);
+        }
+    }
+    return new RegExp(`^${out}$`);
+}
+function escapeRegExp(ch) {
+    return ch.replace(/[.^$(){}|[\]\\*+?/]/g, "\\$&");
+}
+/**
+ * Ordered include list with `!` negations (`branches`, `paths`): the last
+ * matching pattern decides; no match → not included.
+ */
+export function includedByFilter(patterns, value) {
+    let included = false;
+    for (const raw of patterns) {
+        const negated = raw.startsWith("!");
+        const pattern = negated ? raw.slice(1) : raw;
+        if (filterPatternToRegExp(pattern).test(value))
+            included = !negated;
+    }
+    return included;
+}
+/** Ignore list (`branches-ignore`, `paths-ignore`): any match ignores. */
+export function ignoredByFilter(patterns, value) {
+    return patterns.some((p) => filterPatternToRegExp(p).test(value));
+}
+// ---------------------------------------------------------------------------
+// Workflow triggers
+// ---------------------------------------------------------------------------
+/** GitHub evaluates path filters against at most this many changed files. */
+export const PATH_FILTER_FILE_LIMIT = 300;
+function stringList(raw) {
+    if (raw === undefined || raw === null)
+        return null;
+    if (typeof raw === "string")
+        return [raw];
+    if (Array.isArray(raw))
+        return raw.filter((x) => typeof x === "string");
+    return [];
+}
+/**
+ * Does this workflow start a `pull_request` run for the PR's head commit?
+ *
+ * - `on: pull_request` in string, list or map form (no other key counts;
+ *   `pull_request_target` runs on the base commit and is not awaited).
+ * - `types`: the head commit is reported by `opened` (new PR) or
+ *   `synchronize` (push); a custom list must contain both, otherwise the
+ *   workflow is not awaited (configure `merge.requiredChecks` for it).
+ * - `branches` / `branches-ignore` against the base branch;
+ *   `paths` / `paths-ignore` against the PR's changed files (first 300).
+ * - YAML GitHub cannot parse still produces a failed run → expected.
+ */
+export async function workflowExpectedForPullRequest(yamlText, ctx) {
+    let doc;
+    try {
+        doc = parseYaml(yamlText);
+    }
+    catch {
+        return { expected: true };
+    }
+    if (doc === null || typeof doc !== "object" || Array.isArray(doc)) {
+        return { expected: true };
+    }
+    const on = doc["on"] ?? doc["true"];
+    if (typeof on === "string") {
+        return on === "pull_request"
+            ? { expected: true }
+            : { expected: false, reason: "not triggered by pull_request" };
+    }
+    if (Array.isArray(on)) {
+        return on.includes("pull_request")
+            ? { expected: true }
+            : { expected: false, reason: "not triggered by pull_request" };
+    }
+    if (on === null || typeof on !== "object" || !("pull_request" in on)) {
+        return { expected: false, reason: "not triggered by pull_request" };
+    }
+    const cfg = on["pull_request"];
+    if (cfg === null || cfg === undefined || typeof cfg !== "object" || Array.isArray(cfg)) {
+        return { expected: true };
+    }
+    const c = cfg;
+    const types = stringList(c["types"]);
+    if (types !== null && !(types.includes("opened") && types.includes("synchronize"))) {
+        return { expected: false, reason: `pull_request types [${types.join(", ")}]` };
+    }
+    if (ctx.baseBranch !== null) {
+        const branches = stringList(c["branches"]);
+        const branchesIgnore = stringList(c["branches-ignore"]);
+        if (branches !== null && !includedByFilter(branches, ctx.baseBranch)) {
+            return { expected: false, reason: `branches filter excludes ${ctx.baseBranch}` };
+        }
+        if (branchesIgnore !== null && ignoredByFilter(branchesIgnore, ctx.baseBranch)) {
+            return { expected: false, reason: `branches-ignore matches ${ctx.baseBranch}` };
+        }
+    }
+    const paths = stringList(c["paths"]);
+    const pathsIgnore = stringList(c["paths-ignore"]);
+    if (paths !== null || pathsIgnore !== null) {
+        const files = (await ctx.changedFiles()).slice(0, PATH_FILTER_FILE_LIMIT);
+        if (paths !== null && !files.some((f) => includedByFilter(paths, f))) {
+            return { expected: false, reason: "paths filter matches no changed file" };
+        }
+        if (pathsIgnore !== null && files.every((f) => ignoredByFilter(pathsIgnore, f))) {
+            return { expected: false, reason: "paths-ignore matches every changed file" };
+        }
+    }
+    return { expected: true };
+}
+const RUN_PASS = new Set(["success", "neutral", "skipped"]);
+function runPath(run) {
+    return run.path.split("@")[0];
+}
+function describeRun(run, detail) {
+    return `workflow "${run.name}" (${run.event}) ${detail}`;
+}
+/**
+ * Latest run per (workflow, event) must be completed and passing; every
+ * expected workflow must have a `pull_request` run. Unknown statuses /
+ * conclusions fail closed.
+ */
+export function evaluateActionsRuns(runs, expectedPaths) {
+    const latest = new Map();
+    for (const run of runs) {
+        const key = `${runPath(run)}\u0000${run.event}`;
+        const prev = latest.get(key);
+        if (prev === undefined || run.id > prev.id)
+            latest.set(key, run);
+    }
+    const failed = [];
+    const pending = [];
+    for (const run of latest.values()) {
+        const status = run.status.toLowerCase();
+        if (status !== "completed") {
+            pending.push(describeRun(run, `is ${status || "missing status"}`));
+            continue;
+        }
+        const conclusion = (run.conclusion ?? "").toLowerCase();
+        if (RUN_PASS.has(conclusion))
+            continue;
+        failed.push(describeRun(run, conclusion === "action_required"
+            ? "needs approval (action_required)"
+            : `concluded ${conclusion || "without a conclusion"}`));
+    }
+    const missing = expectedPaths.filter((p) => ![...latest.values()].some((r) => r.event === "pull_request" && runPath(r) === p));
+    return { failed, pending, missing };
+}
+/** `https://<host>/<owner>/<repo>/pull/<n>` → parts, else `null`. */
+export function parseGitHubPullUrl(url) {
+    const m = /^https?:\/\/([^/]+)\/([^/]+)\/([^/]+)\/pull\/(\d+)/i.exec(url.trim());
+    if (m === null)
+        return null;
+    return { hostname: m[1], owner: m[2], repo: m[3], number: m[4] };
+}
+/** `gh api` failed with HTTP 404 (resource absent). */
+export class GitHubNotFoundError extends Error {
+}
+async function ghApi(cwd, pr, path, accept) {
+    const args = ["api"];
+    if (pr.hostname.toLowerCase() !== "github.com")
+        args.push("--hostname", pr.hostname);
+    if (accept !== undefined)
+        args.push("-H", `Accept: ${accept}`);
+    args.push(path);
+    try {
+        const { stdout } = await execFileAsync("gh", args, { cwd, maxBuffer: 16 * 1024 * 1024 });
+        return stdout;
+    }
+    catch (error) {
+        const e = error;
+        const text = `${e.stderr ?? ""} ${e.message ?? ""}`;
+        if (/HTTP 404|Not Found/i.test(text))
+            throw new GitHubNotFoundError(path);
+        throw new Error(`gh api ${path}: ${(e.stderr ?? e.message ?? "").trim().split("\n")[0]}`);
+    }
+}
+function repoPath(pr) {
+    return `repos/${encodeURIComponent(pr.owner)}/${encodeURIComponent(pr.repo)}`;
+}
+const RUNS_PAGE_SIZE = 100;
+const RUNS_MAX_PAGES = 10;
+const FILES_PAGE_SIZE = 100;
+/** All workflow runs for `sha` (Actions disabled / absent → empty). */
+export async function listWorkflowRunsForSha(cwd, pr, sha) {
+    const runs = [];
+    for (let page = 1; page <= RUNS_MAX_PAGES; page++) {
+        let text;
+        try {
+            text = await ghApi(cwd, pr, `${repoPath(pr)}/actions/runs?head_sha=${sha}&per_page=${RUNS_PAGE_SIZE}&page=${page}`);
+        }
+        catch (error) {
+            if (error instanceof GitHubNotFoundError)
+                return runs;
+            throw error;
+        }
+        const parsed = JSON.parse(text);
+        if (!Array.isArray(parsed.workflow_runs)) {
+            throw new Error("Actions API returned no workflow_runs list");
+        }
+        for (const r of parsed.workflow_runs) {
+            if (typeof r["id"] !== "number" || typeof r["path"] !== "string") {
+                throw new Error("Actions API returned a workflow run without id/path");
+            }
+            runs.push({
+                id: r["id"],
+                name: typeof r["name"] === "string" ? r["name"] : String(r["path"]),
+                path: r["path"],
+                event: typeof r["event"] === "string" ? r["event"] : "",
+                status: typeof r["status"] === "string" ? r["status"] : "",
+                conclusion: typeof r["conclusion"] === "string" ? r["conclusion"] : null,
+            });
+        }
+        if (parsed.workflow_runs.length < RUNS_PAGE_SIZE)
+            return runs;
+    }
+    throw new Error(`more than ${RUNS_PAGE_SIZE * RUNS_MAX_PAGES} workflow runs for ${sha}`);
+}
+/** Paths of workflows GitHub will not run (`disabled_*`). */
+async function listDisabledWorkflowPaths(cwd, pr) {
+    let text;
+    try {
+        text = await ghApi(cwd, pr, `${repoPath(pr)}/actions/workflows?per_page=100`);
+    }
+    catch (error) {
+        if (error instanceof GitHubNotFoundError)
+            return new Set();
+        throw error;
+    }
+    const parsed = JSON.parse(text);
+    const out = new Set();
+    for (const w of parsed.workflows ?? []) {
+        if (typeof w.path === "string" && typeof w.state === "string" && w.state !== "active") {
+            out.add(w.path);
+        }
+    }
+    return out;
+}
+async function listChangedFiles(cwd, pr) {
+    const files = [];
+    // GitHub path filters look at the first 300 changed files only.
+    for (let page = 1; files.length < PATH_FILTER_FILE_LIMIT; page++) {
+        const text = await ghApi(cwd, pr, `${repoPath(pr)}/pulls/${pr.number}/files?per_page=${FILES_PAGE_SIZE}&page=${page}`);
+        const rows = JSON.parse(text);
+        if (!Array.isArray(rows))
+            throw new Error("pulls files API returned no list");
+        for (const row of rows)
+            if (typeof row.filename === "string")
+                files.push(row.filename);
+        if (rows.length < FILES_PAGE_SIZE)
+            break;
+    }
+    return files;
+}
+/**
+ * Workflows that will start a `pull_request` run for the head commit:
+ * `.github/workflows/*.y{a,}ml` at `sha`, triggered for this PR, not disabled.
+ */
+export async function listExpectedPullRequestWorkflows(cwd, pr, sha, baseBranch) {
+    let listing;
+    try {
+        listing = await ghApi(cwd, pr, `${repoPath(pr)}/contents/.github/workflows?ref=${sha}`);
+    }
+    catch (error) {
+        if (error instanceof GitHubNotFoundError)
+            return [];
+        throw error;
+    }
+    const entries = JSON.parse(listing);
+    if (!Array.isArray(entries))
+        return [];
+    const candidates = entries
+        .filter((e) => e.type === "file" && typeof e.path === "string")
+        .map((e) => e.path)
+        .filter((p) => /\.ya?ml$/i.test(p));
+    if (candidates.length === 0)
+        return [];
+    const disabled = await listDisabledWorkflowPaths(cwd, pr);
+    let changed = null;
+    const ctx = {
+        baseBranch,
+        changedFiles: () => (changed ??= listChangedFiles(cwd, pr)),
+    };
+    const expected = [];
+    for (const path of candidates) {
+        if (disabled.has(path))
+            continue;
+        const text = await ghApi(cwd, pr, `${repoPath(pr)}/contents/${path.split("/").map(encodeURIComponent).join("/")}?ref=${sha}`, "application/vnd.github.raw+json");
+        if ((await workflowExpectedForPullRequest(text, ctx)).expected)
+            expected.push({ path });
+    }
+    return expected;
+}

package/dist/lib/logger.js

@@ -1,4 +1,3 @@
-/* eslint-disable no-console */
 const useColor = () => {
     if (process.env["NO_COLOR"])
         return false;

package/dist/lib/merge-config.js

@@ -5,7 +5,8 @@ export const MERGE_GATE_DEFAULTS = {
     requiredChecks: [],
     releaseRequiredChecks: [],
     waitTimeoutSeconds: 900,
-    pollIntervalSeconds: 5,
+    // Same default as `gh pr checks --watch --interval` (cli.github.com/manual/gh_pr_checks).
+    pollIntervalSeconds: 10,
     emptyRollupGraceSeconds: 30,
     allowNoChecks: false,
 };

package/dist/lib/pr-create.js

@@ -3,6 +3,7 @@ import { promisify } from "node:util";
 import { mergeRequestLabel } from "./git-host.js";
 import { classifyRollup, evaluateCheckGate, formatCheckGateProblems, } from "./check-rollup.js";
 import { isMergeRequestReadyToMerge, isPipelineActive, pipelineGateState, pipelineStatusFromHost, } from "./merge-request-readiness.js";
+import { evaluateActionsRuns, listExpectedPullRequestWorkflows, listWorkflowRunsForSha, parseGitHubPullUrl, } from "./github-actions-gate.js";
 import { dim, log } from "./logger.js";
 import { MERGE_GATE_DEFAULTS, mergeGateTiming } from "./merge-config.js";
 const execFileAsync = promisify(execFile);
@@ -268,6 +269,7 @@ export async function readMergeRequestDetails(cwd, host, url, options) {
             hasConflicts: parsed.has_conflicts ?? null,
             checks: null,
             headSha: parsed.sha ?? null,
+            baseBranch: parsed.target_branch ?? null,
         };
     }
     const { stdout } = await execFileAsync("gh", [
@@ -275,7 +277,7 @@ export async function readMergeRequestDetails(cwd, host, url, options) {
         "view",
         ref,
         "--json",
-        "state,mergedAt,mergeCommit,mergeable,headRefOid,statusCheckRollup",
+        "state,mergedAt,mergeCommit,mergeable,headRefOid,baseRefName,statusCheckRollup",
     ], { cwd, maxBuffer: 4 * 1024 * 1024 });
     const parsed = JSON.parse(stdout.trim());
     if (options.strict) {
@@ -312,6 +314,7 @@ export async function readMergeRequestDetails(cwd, host, url, options) {
         hasConflicts: mergeable === "CONFLICTING" ? true : mergeable === "MERGEABLE" ? false : null,
         checks,
         headSha: parsed.headRefOid ?? null,
+        baseBranch: parsed.baseRefName ?? null,
     };
 }
 /** Poll host until MR/PR state is merged (or timeout). */
@@ -365,11 +368,56 @@ function evaluateDetailsGate(details, requiredChecks) {
     };
 }
 const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
+/**
+ * Upper bound for the back-off after consecutive host read errors. GitHub asks
+ * clients that hit a secondary rate limit to wait at least one minute before
+ * retrying (docs.github.com/rest/using-the-rest-api/rate-limits-for-the-rest-api).
+ */
+const ERROR_BACKOFF_CAP_MS = 60_000;
+/** Exponential back-off with full jitter in [base, min(cap, base·2^n)]. */
+export function errorBackoffMs(baseMs, consecutiveErrors) {
+    const ceiling = Math.min(ERROR_BACKOFF_CAP_MS, baseMs * 2 ** Math.max(0, consecutiveErrors));
+    return baseMs + Math.random() * Math.max(0, ceiling - baseMs);
+}
+/**
+ * GitHub Actions view of the head commit (see `github-actions-gate.ts`).
+ * Expected workflows depend only on the head SHA, so they are cached per SHA.
+ */
+async function evaluateGitHubActions(cwd, url, details, expectedCache) {
+    const pr = parseGitHubPullUrl(url);
+    if (pr === null) {
+        throw new MergeGateError("PR", [
+            `cannot derive the repository from "${url}" to read its GitHub Actions runs`,
+        ]);
+    }
+    const sha = details.headSha;
+    let expected = expectedCache.get(sha);
+    if (expected === undefined) {
+        expected = await listExpectedPullRequestWorkflows(cwd, pr, sha, details.baseBranch);
+        expectedCache.set(sha, expected);
+    }
+    const runs = await listWorkflowRunsForSha(cwd, pr, sha);
+    return {
+        result: evaluateActionsRuns(runs, expected.map((w) => w.path)),
+        runCount: runs.length,
+        expectedCount: expected.length,
+    };
+}
+function shortSha(sha) {
+    return (sha ?? "?").slice(0, 7);
+}
 /**
  * Merge gate: poll the MR/PR until every check is green and the host reports it
  * mergeable. Refuses immediately on any failed check, on host output it cannot
  * trust, and on "no checks at all" (unless allowed); refuses after the timeout
- * when checks stay pending or a required check never appears.
+ * when checks stay pending or a required / expected check never appears.
+ *
+ * GitHub: besides `statusCheckRollup`, the head commit's GitHub Actions runs
+ * must all be finished and green, and every workflow that triggers on this
+ * PR's `pull_request` event must have a run for the head SHA — so checks left
+ * on the commit by other events never stand in for the PR's own CI. Before
+ * returning green, the head SHA is read again; if it moved, the new head is
+ * evaluated from scratch (the merge is also pinned with `--match-head-commit`).
  */
 export async function waitForMergeGate(cwd, host, url, options = {}) {
     const defaults = mergeGateTiming(MERGE_GATE_DEFAULTS);
@@ -382,10 +430,13 @@ export async function waitForMergeGate(cwd, host, url, options = {}) {
     const label = mergeRequestLabel(host);
     const start = Date.now();
     const deadline = start + timeoutMs;
-    let loggedWait = false;
+    const expectedCache = new Map();
+    let lastLogged = "";
     let warnedGitLabRequired = false;
+    let consecutiveErrors = 0;
     for (;;) {
         let problems = [];
+        let readError = false;
         let details = null;
         try {
             details = await readMergeRequestDetails(cwd, host, url, { strict: true });
@@ -396,6 +447,7 @@ export async function waitForMergeGate(cwd, host, url, options = {}) {
             }
             const msg = error instanceof Error ? error.message.split("\n")[0] : String(error);
             problems = [`could not read ${label} details from the host: ${msg}`];
+            readError = true;
         }
         if (details === null) {
             // problems set in catch; keep polling (transient CLI / network error).
@@ -419,12 +471,39 @@ export async function waitForMergeGate(cwd, host, url, options = {}) {
             if (details.hasConflicts === true) {
                 return { ok: false, problems: [`${label} has merge conflicts`] };
             }
+            let actions = null;
+            if (!gitlab) {
+                try {
+                    actions = await evaluateGitHubActions(cwd, url, details, expectedCache);
+                }
+                catch (error) {
+                    if (error instanceof MergeGateError)
+                        return { ok: false, problems: error.problems };
+                    const msg = error instanceof Error ? error.message.split("\n")[0] : String(error);
+                    problems = [`could not read GitHub Actions runs for ${shortSha(details.headSha)}: ${msg}`];
+                    readError = true;
+                }
+                if (actions !== null && actions.result.failed.length > 0) {
+                    return { ok: false, problems: [...actions.result.failed] };
+                }
+            }
+            const actionsPending = actions === null
+                ? []
+                : [
+                    ...actions.result.pending,
+                    ...actions.result.missing.map((p) => `workflow ${p} (pull_request) has not started for ${shortSha(details.headSha)} yet`),
+                ];
+            const actionsSilent = actions === null || (actions.runCount === 0 && actions.expectedCount === 0);
             // "No checks at all" is judged here only when no required check could
-            // report it instead (GitHub with requiredChecks → "never ran" path).
-            const noChecksRule = ev.noChecks && (gitlab || required.length === 0);
+            // report it instead (GitHub with requiredChecks → "never ran" path) and
+            // no GitHub Actions run exists or is expected for the head commit.
+            const noChecksRule = !readError && ev.noChecks && actionsSilent && (gitlab || required.length === 0);
             const inGrace = waitForPending && noChecksRule && Date.now() - start < graceMs;
-            if (ev.state === "pending") {
-                problems = ev.problems;
+            if (readError) {
+                // problems set above; keep polling with back-off.
+            }
+            else if (ev.state === "pending" || actionsPending.length > 0) {
+                problems = [...ev.problems, ...actionsPending];
             }
             else if (inGrace) {
                 problems = ["no status checks reported yet"];
@@ -441,17 +520,42 @@ export async function waitForMergeGate(cwd, host, url, options = {}) {
             else {
                 const readiness = mergeRequestReadinessFromDetails(details);
                 if (readiness !== null && isMergeRequestReadyToMerge(readiness)) {
-                    if (noChecksRule) {
-                        // Once, after the gate has decided to merge — not on every poll.
-                        log.warn(`WARNING: merging ${label} with NO checks (merge.allowNoChecks is true). Nothing verified this change.`);
+                    // Race guard: the head may have moved while the checks were read.
+                    let again = null;
+                    try {
+                        again = await readMergeRequestDetails(cwd, host, url, { strict: true });
+                    }
+                    catch (error) {
+                        if (error instanceof MergeRequestShapeError) {
+                            return { ok: false, problems: [error.message] };
+                        }
+                        readError = true;
+                        problems = [`could not re-read the ${label} head before merging`];
+                    }
+                    if (again !== null && again.state === "merged") {
+                        return { ok: true, alreadyMerged: true, details: again };
+                    }
+                    if (again !== null && again.headSha === details.headSha && again.state === "open") {
+                        if (noChecksRule) {
+                            // Once, after the gate has decided to merge — not on every poll.
+                            log.warn(`WARNING: merging ${label} with NO checks (merge.allowNoChecks is true). Nothing verified this change.`);
+                        }
+                        return { ok: true, alreadyMerged: false, details };
+                    }
+                    if (again !== null) {
+                        problems = [
+                            `${label} head moved from ${shortSha(details.headSha)} to ${shortSha(again.headSha)} while checks were read; re-checking the new head`,
+                        ];
                     }
-                    return { ok: true, alreadyMerged: false, details };
                 }
-                problems = [
-                    `host does not report the ${label} as mergeable yet (${details.detailedMergeStatus || details.mergeStatus || "unknown"})`,
-                ];
+                else {
+                    problems = [
+                        `host does not report the ${label} as mergeable yet (${details.detailedMergeStatus || details.mergeStatus || "unknown"})`,
+                    ];
+                }
             }
         }
+        consecutiveErrors = readError ? consecutiveErrors + 1 : 0;
         const now = Date.now();
         if (!waitForPending || now >= deadline) {
             const suffix = waitForPending
@@ -462,11 +566,13 @@ export async function waitForMergeGate(cwd, host, url, options = {}) {
                 problems: problems.map((p, i) => (i === problems.length - 1 ? `${p}${suffix}` : p)),
             };
         }
-        if (!loggedWait) {
-            log.info(dim(`Waiting for ${label} checks: ${problems.join("; ")}…`));
-            loggedWait = true;
+        const summary = problems.join("; ");
+        if (summary !== lastLogged) {
+            log.info(dim(`Waiting for ${label} checks: ${summary}…`));
+            lastLogged = summary;
         }
-        await sleep(Math.min(intervalMs, deadline - now));
+        const delay = readError ? errorBackoffMs(intervalMs, consecutiveErrors) : intervalMs;
+        await sleep(Math.min(delay, deadline - now));
     }
 }
 function isMergeHttp405(error) {

package/dist/lib/task-add-llm.js

@@ -63,7 +63,7 @@ export async function llmScaffoldTask(params) {
         });
         const parsed = JSON.parse(extractJsonObject(raw));
         const title = typeof parsed.title === "string"
-            ? parsed.title.replace(/^TASK-\d+\s*[:\-]\s*/i, "").trim()
+            ? parsed.title.replace(/^TASK-\d+\s*[:-]\s*/i, "").trim()
             : "";
         const slug = typeof parsed.slug === "string" ? slugify(parsed.slug, "task") : slugify(title, "task");
         const markdown = typeof parsed.markdown === "string" ? parsed.markdown.trim() : "";

package/dist/lib/task-git-commit.js

@@ -1,7 +1,7 @@
 import { dim, log } from "./logger.js";
 import { gitAddPaths, gitPush, listUnstagedRelPaths, listWorkingTreeRelPaths, partitionPathsForAutoCommit, readGitInfo, runGit, } from "./git.js";
 export function featCommitMessageFor(taskId, title) {
-    const slug = title.replace(/^TASK-\d+\s*[:\-]\s*/i, "").trim() || taskId;
+    const slug = title.replace(/^TASK-\d+\s*[:-]\s*/i, "").trim() || taskId;
     return `feat(${taskId.toLowerCase()}): ${slug}`;
 }
 export function docsCommitMessageFor(taskId, suffix) {

package/dist/lib/task-pr-llm.js

@@ -9,7 +9,7 @@ Body: markdown with Summary, Changes, Test plan sections. Facts only from the in
 /** Normalize PR titles to Conventional Commits with the TASK id as scope. */
 export function normalizeTaskPrTitle(taskId, rawTitle) {
     const trimmed = rawTitle.trim().replace(/\s+/g, " ");
-    const withoutTaskPrefix = trimmed.replace(/^TASK-\d+\s*[:\-]\s*/i, "").trim();
+    const withoutTaskPrefix = trimmed.replace(/^TASK-\d+\s*[:-]\s*/i, "").trim();
     return taskScopedCommitMessage(taskId, withoutTaskPrefix || trimmed).slice(0, 72);
 }
 export async function generateTaskPrWithLlm(input, cwd, preference) {

package/dist/lib/task-start.js

@@ -21,7 +21,6 @@ export async function startTaskBranch(opts) {
     const taskFile = opts.taskFile;
     const integrationBranch = opts.integrationBranch;
     const remote = opts.remote ?? "origin";
-    const meta = await readTaskFile(taskFile);
     const git = await readGitInfo(cwd);
     if (!git.isRepo) {
         if (opts.dryRun) {
@@ -39,8 +38,9 @@ export async function startTaskBranch(opts) {
         }
         log.warn("Only governance paths are dirty — proceeding.");
     }
+    // The branch name comes from the file name: a dry run plans for a TASK file
+    // that `task add --dry-run` never wrote, so nothing above reads the file.
     const taskBranch = branchNameForTaskFile(taskFile);
-    const existingCtx = await readGitContext(taskFile);
     const branchExists = await gitBranchExists(cwd, taskBranch);
     if (opts.dryRun) {
         const base = (await resolveIntegrationBaseRef(cwd, remote, integrationBranch)) ??
@@ -52,6 +52,8 @@ export async function startTaskBranch(opts) {
             : `dry-run — would git fetch ${remote} ${integrationBranch}, then git switch -c ${taskBranch} --no-track ${base}`));
         return true;
     }
+    const meta = await readTaskFile(taskFile);
+    const existingCtx = await readGitContext(taskFile);
     // Worktree-safe (D-006): never check out the integration branch — another
     // worktree may own it. New task branches start from <remote>/<integration>.
     let baseRef = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@goodtek/vibeops",
-  "version": "3.1.1",
+  "version": "3.1.4",
   "description": "Minimal CLI rails for Cursor-based TASK-driven vibe coding.",
   "type": "module",
   "packageManager": "pnpm@9.15.9",
@@ -8,11 +8,11 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/goodtekxyz/vibeops.git"
+    "url": "git+https://github.com/goodtek-xyz/vibeops.git"
   },
-  "homepage": "https://github.com/goodtekxyz/vibeops#readme",
+  "homepage": "https://github.com/goodtek-xyz/vibeops#readme",
   "bugs": {
-    "url": "https://github.com/goodtekxyz/vibeops/issues"
+    "url": "https://github.com/goodtek-xyz/vibeops/issues"
   },
   "publishConfig": {
     "access": "public"
@@ -34,9 +34,10 @@
     "dev": "tsx src/cli.ts",
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint .",
     "start": "node dist/cli.js",
-    "test": "pnpm build && node --test \"tests/*.test.mjs\"",
-    "smoke": "pnpm typecheck && pnpm build && node --test \"tests/*.test.mjs\" && node scripts/smoke.mjs",
+    "test": "pnpm build && node --test tests/*.test.mjs",
+    "smoke": "pnpm typecheck && pnpm build && node --test tests/*.test.mjs && node scripts/smoke.mjs",
     "clean": "rm -rf dist",
     "prepack": "pnpm clean && pnpm build",
     "publish:dry": "pnpm publish --dry-run --no-git-checks",
@@ -55,11 +56,15 @@
   "dependencies": {
     "@inquirer/prompts": "^8.4.3",
     "commander": "^12.1.0",
-    "gray-matter": "^4.0.3"
+    "gray-matter": "^4.0.3",
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
+    "@eslint/js": "10.0.1",
     "@types/node": "^20.14.0",
+    "eslint": "10.11.0",
     "tsx": "^4.19.0",
-    "typescript": "^5.5.4"
+    "typescript": "^5.5.4",
+    "typescript-eslint": "8.71.0"
   }
 }