fix: silence stray CI/tool noise, fix real --silent leak in agents-vault/agents-init #166

2026-09-22T06:38:15Z

rootiest commented

2026-09-22 06:38:15 +00:00

Summary

Follow-up to the mkrep git-init hint fix (#165): asked agy to scan a full green run's test and build-docs job logs for any remaining stray output that isn't the harness's own PASS/FAIL/section output. Found 15 items (spot-checked 5 directly against the raw logs, all matched). This PR fixes what's fixable in this repo.

What / Why

Real bug, not just log noise: agents-vault.fish and agents-init.fish both do set -l x (some_helper ...) to capture a helper function's stdout message. Fish command substitutions don't inherit a caller-scoped stderr redirect — proven with a 2-line repro (outer 2>/dev/null where outer does set -l x (inner) still leaks inner's stderr to the real terminal). This meant _agents_repo_ensure_symlink's and _agents_repo_sync's raw internal error messages leaked past --silent for real users too, always duplicating the clean summary message the caller already echoes on failure. Fixed at all 4 call sites with an explicit 2>/dev/null directly on the command substitution — a redirect on the outer call can't reach it.

CI cosmetics (.github/workflows/ci.yml):

Added NODE_OPTIONS: --no-deprecation at the build-docs job level — silences Node's internal punycode-module deprecation notice (astro's toolchain still pulls it in transitively).
npm ci --no-fund drops the funding nag.
gpg --batch --quiet --import drops gpg's normal-case import status lines during the bot commit-signing setup.
apt-utils is now installed alongside the other early packages so debconf has something configured for later triggers. Its own "delaying package configuration" notice on its first install is not eliminated by this and is documented as accepted, not fixed — see below.

Deliberately NOT touched, all live-verified before giving up on them:

debconf's "delaying package configuration" notice for apt-utils itself. Tried twice: bundling it with another package, then installing it fully alone as the very first step. Both still print the notice exactly once per job — it fires during apt-utils' own first-ever install, before debconf considers it "installed." No install ordering this workflow controls can pre-seed that away; it needs a base image that already has apt-utils baked in, out of scope here.
npm's deprecated-glob warning, its audit vulnerability summary, and its allow-scripts notice about esbuild's postinstall — genuine dependency-hygiene signal, not noise. No flag hides these without also hiding real future findings.
A Gitea Actions/act runner warning ('runs-on' key not defined in CI/test) — traces to neither workflow YAML in this repo (both already set runs-on on every job, confirmed twice). Runner-internal, same class as actions/checkout's own git-init hint in its Checkout-step preamble.

Verification

Full suite: fish tests/run-tests.fish — 730/730, $status 0
The exact mkdir-collision repro that surfaced the command-substitution bug, re-run standalone: rc=1, stderr empty (previously leaked)
test-agents-vault.fish standalone — 320/320, zero occurrences of the previously-leaked messages
Two live CI runs against this branch (workflow_dispatch) confirmed: punycode/npm-fund/gpg-import lines all at 0 occurrences; debconf's apt-utils notice confirmed unavoidable (still 1/job) across both orderings tried
python3 -c "import yaml; yaml.safe_load(...)" on ci.yml
fish -n on both touched .fish files

Manual verification checklist

Confirm CI's build-docs job log for this branch shows no punycode/npm-fund/gpg-import lines (debconf's apt-utils line is expected and fine)
Trigger a real agents-vault/agents-init link failure locally and confirm only the clean summary message prints, not the raw duplicate

## Summary Follow-up to the mkrep git-init hint fix (#165): asked agy to scan a full green run's `test` and `build-docs` job logs for any remaining stray output that isn't the harness's own PASS/FAIL/section output. Found 15 items (spot-checked 5 directly against the raw logs, all matched). This PR fixes what's fixable in this repo. ## What / Why **Real bug, not just log noise:** `agents-vault.fish` and `agents-init.fish` both do `set -l x (some_helper ...)` to capture a helper function's stdout message. Fish command substitutions don't inherit a caller-scoped stderr redirect — proven with a 2-line repro (`outer 2>/dev/null` where `outer` does `set -l x (inner)` still leaks `inner`'s stderr to the real terminal). This meant `_agents_repo_ensure_symlink`'s and `_agents_repo_sync`'s raw internal error messages leaked past `--silent` **for real users too**, always duplicating the clean summary message the caller already echoes on failure. Fixed at all 4 call sites with an explicit `2>/dev/null` directly on the command substitution — a redirect on the outer call can't reach it. **CI cosmetics** (`.github/workflows/ci.yml`): - Added `NODE_OPTIONS: --no-deprecation` at the `build-docs` job level — silences Node's internal punycode-module deprecation notice (astro's toolchain still pulls it in transitively). - `npm ci --no-fund` drops the funding nag. - `gpg --batch --quiet --import` drops gpg's normal-case import status lines during the bot commit-signing setup. - `apt-utils` is now installed alongside the other early packages so debconf has *something* configured for later triggers. Its own "delaying package configuration" notice on its first install is **not** eliminated by this and is documented as accepted, not fixed — see below. **Deliberately NOT touched, all live-verified before giving up on them:** - **debconf's "delaying package configuration" notice for apt-utils itself.** Tried twice: bundling it with another package, then installing it fully alone as the very first step. Both still print the notice exactly once per job — it fires *during* apt-utils' own first-ever install, before debconf considers it "installed." No install ordering this workflow controls can pre-seed that away; it needs a base image that already has apt-utils baked in, out of scope here. - npm's deprecated-`glob` warning, its audit vulnerability summary, and its allow-scripts notice about esbuild's postinstall — genuine dependency-hygiene signal, not noise. No flag hides these without also hiding real future findings. - A Gitea Actions/act runner warning (`'runs-on' key not defined in CI/test`) — traces to neither workflow YAML in this repo (both already set `runs-on` on every job, confirmed twice). Runner-internal, same class as `actions/checkout`'s own git-init hint in its Checkout-step preamble. ## Verification - [x] Full suite: `fish tests/run-tests.fish` — 730/730, `$status` 0 - [x] The exact mkdir-collision repro that surfaced the command-substitution bug, re-run standalone: `rc=1`, stderr empty (previously leaked) - [x] `test-agents-vault.fish` standalone — 320/320, zero occurrences of the previously-leaked messages - [x] Two live CI runs against this branch (workflow_dispatch) confirmed: punycode/npm-fund/gpg-import lines all at 0 occurrences; debconf's apt-utils notice confirmed unavoidable (still 1/job) across both orderings tried - [x] `python3 -c "import yaml; yaml.safe_load(...)"` on `ci.yml` - [x] `fish -n` on both touched `.fish` files ## Manual verification checklist - [x] Confirm CI's `build-docs` job log for this branch shows no punycode/npm-fund/gpg-import lines (debconf's apt-utils line is expected and fine) - [x] Trigger a real `agents-vault`/`agents-init` link failure locally and confirm only the clean summary message prints, not the raw duplicate

rootiest added 1 commit 2026-09-22 06:38:20 +00:00

fix(ci): silence CI/tool noise found auditing the test-job log af7502d6b1

An audit of a full green run's test + build-docs logs (agy scan, spot-
checked) turned up stray output beyond the mkrep git-init hint already
fixed. Two real bugs, plus CI-config cosmetics:

- agents-vault.fish/agents-init.fish: `set -l x (some_fish_function ...)`
  command substitutions do not inherit a caller-scoped stderr redirect in
  fish (proven with a two-line repro: `outer 2>/dev/null` where outer
  does `set -l x (inner)` still leaks inner's stderr to the real
  terminal). This let _agents_repo_ensure_symlink's and
  _agents_repo_sync's raw internal error messages leak past `--silent`
  for real users too, always duplicating the clean summary message each
  caller already echoes on failure. Fixed at all 4 call sites by adding
  an explicit `2>/dev/null` directly on each command substitution, since
  a redirect on the outer call cannot reach it.
- ci.yml: apt-get install missing `apt-utils`, so debconf printed
  "delaying package configuration" on every install in both jobs --
  installing it first fixes the chicken-and-egg.
- ci.yml: added `NODE_OPTIONS: --no-deprecation` at the build-docs job
  level to silence Node's internal punycode-module deprecation notice
  (astro's toolchain still pulls it in transitively).
- ci.yml: `npm ci --no-fund` drops the funding nag.
- ci.yml: `gpg --batch --quiet --import` drops gpg's normal-case import
  status lines during the bot commit-signing setup.

Deliberately NOT silenced: npm's deprecated-glob warning, its audit
vulnerability summary, and its allow-scripts notice about esbuild's
postinstall -- these are genuine dependency-hygiene signal, not noise,
and no workflow-level flag exists to hide them without also hiding real
future findings. Also not fixable here: a Gitea Actions/act runner
warning ('runs-on' key not defined in CI/test) that traces to neither
workflow YAML in this repo -- both already set runs-on on every job,
confirmed twice; it's runner-internal, like actions/checkout's own
git-init hint in its Checkout-step preamble.

Verified: full suite 730/730 passing ($status 0); the exact mkdir-
collision repro that surfaced the command-substitution bug re-run
clean (rc=1, empty stderr); test-agents-vault.fish standalone,
320/320, zero occurrences of the previously-leaked messages.

rootiest added the Area/CI Area/Functions Kind/Bug labels 2026-09-22 06:38:28 +00:00

rootiest added 1 commit 2026-09-22 06:46:49 +00:00

fix(ci): install apt-utils in its own step, not bundled 135c375dcf

The previous fix bundled apt-utils into the same apt-get install as
software-properties-common. Verified against a live CI run: debconf
still printed "delaying package configuration" once per job, because
apt-utils configures in the same transaction as everything else and
still lands after at least one other package -- bundling doesn't help.
Installing it alone, first, actually finishes it before anything else
runs.

rootiest added 1 commit 2026-09-22 06:59:11 +00:00

fix(ci): stop chasing apt-utils' own debconf notice, document why 9614ee17e1

Verified live, twice: bundling apt-utils with another package (first
attempt) and installing it fully alone, first (second attempt) both
still print debconf's "delaying package configuration" notice exactly
once per job. It fires during apt-utils' own first-ever install, before
debconf considers it "installed" -- no install ordering this workflow
controls can pre-seed that. Reverted to the simpler bundled form (the
separate-step version added a step for zero measured benefit) and
documented it as accepted/unfixable, same class as the runs-on/
checkout-hint noise already left alone.

rootiest merged commit 8b1689aa82 into main

2026-09-22 07:17:51 +00:00

rootiest deleted branch fix/ci-log-noise-cleanup

2026-09-22 07:17:51 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rootiest/fish-config#166