From af7502d6b10b2bac4019c1333be910124b873190 Mon Sep 17 00:00:00 2001 From: Rootiest Date: Tue, 22 Sep 2026 02:37:42 -0400 Subject: [PATCH 1/3] fix(ci): silence CI/tool noise found auditing the test-job log An audit of a full green run's test + build-docs logs (agy scan, spot- checked) turned up stray output beyond the mkrep git-init hint already fixed. Two real bugs, plus CI-config cosmetics: - agents-vault.fish/agents-init.fish: `set -l x (some_fish_function ...)` command substitutions do not inherit a caller-scoped stderr redirect in fish (proven with a two-line repro: `outer 2>/dev/null` where outer does `set -l x (inner)` still leaks inner's stderr to the real terminal). This let _agents_repo_ensure_symlink's and _agents_repo_sync's raw internal error messages leak past `--silent` for real users too, always duplicating the clean summary message each caller already echoes on failure. Fixed at all 4 call sites by adding an explicit `2>/dev/null` directly on each command substitution, since a redirect on the outer call cannot reach it. - ci.yml: apt-get install missing `apt-utils`, so debconf printed "delaying package configuration" on every install in both jobs -- installing it first fixes the chicken-and-egg. - ci.yml: added `NODE_OPTIONS: --no-deprecation` at the build-docs job level to silence Node's internal punycode-module deprecation notice (astro's toolchain still pulls it in transitively). - ci.yml: `npm ci --no-fund` drops the funding nag. - ci.yml: `gpg --batch --quiet --import` drops gpg's normal-case import status lines during the bot commit-signing setup. Deliberately NOT silenced: npm's deprecated-glob warning, its audit vulnerability summary, and its allow-scripts notice about esbuild's postinstall -- these are genuine dependency-hygiene signal, not noise, and no workflow-level flag exists to hide them without also hiding real future findings. Also not fixable here: a Gitea Actions/act runner warning ('runs-on' key not defined in CI/test) that traces to neither workflow YAML in this repo -- both already set runs-on on every job, confirmed twice; it's runner-internal, like actions/checkout's own git-init hint in its Checkout-step preamble. Verified: full suite 730/730 passing ($status 0); the exact mkdir- collision repro that surfaced the command-substitution bug re-run clean (rc=1, empty stderr); test-agents-vault.fish standalone, 320/320, zero occurrences of the previously-leaked messages. --- .github/workflows/ci.yml | 17 +++++++++++++---- functions/agents-init.fish | 6 +++++- functions/agents-vault.fish | 21 ++++++++++++++++++--- 3 files changed, 36 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 77e6838..fde4c94 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,7 +48,9 @@ jobs: - name: Install fish run: | sudo apt-get -o Acquire::Retries=3 update -qq - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common + # apt-utils first: its absence is what makes debconf print + # "delaying package configuration" on every install below. + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common sudo add-apt-repository -y ppa:fish-shell/release-4 sudo apt-get -o Acquire::Retries=3 update -qq sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish @@ -65,6 +67,11 @@ jobs: ((github.event_name != 'workflow_dispatch' || github.event.inputs.job == 'all') && needs.test.result == 'success')) runs-on: racknerd-mini + env: + # Silences Node's internal "punycode module is deprecated" notice + # (astro's toolchain still requires it transitively) on every node + # invocation in this job, setup-node's own included. + NODE_OPTIONS: --no-deprecation steps: - name: Checkout uses: actions/checkout@v4 @@ -74,7 +81,9 @@ jobs: - name: Install dependencies run: | sudo apt-get -o Acquire::Retries=3 update -qq - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common + # apt-utils first: its absence is what makes debconf print + # "delaying package configuration" on every install below. + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common sudo add-apt-repository -y ppa:fish-shell/release-4 sudo apt-get -o Acquire::Retries=3 update -qq sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish @@ -112,7 +121,7 @@ jobs: - name: Build project wiki working-directory: docs/site run: | - npm ci + npm ci --no-fund npx astro build - name: Deploy to Cloudflare Pages @@ -146,7 +155,7 @@ jobs: echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf" echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf" command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg - echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --import + echo "$BOT_GPG_KEY" | base64 -d | gpg --batch --quiet --import git config user.name "Gitea Actions Bot" git config user.email "fishconfig-bot@git.rootiest.dev" git config user.signingkey CAA082C2F3467E1F7217AD492075C120312D23F4 diff --git a/functions/agents-init.fish b/functions/agents-init.fish index 6cd030c..95da318 100644 --- a/functions/agents-init.fish +++ b/functions/agents-init.fish @@ -482,7 +482,11 @@ function agents-init --description 'scaffold AGENTS/ sub-repo with agent spec fi # a hook-rejected commit fell straight through to a reported success. set -l msg "chore: sync AGENTS repository" test $did_init -eq 1; and set msg "chore: initialize AGENTS repository" - set -l sync_out (_agents_repo_sync "$agents_dir" "$msg") + # 2>/dev/null: a command substitution's stderr does not inherit a + # caller-scoped redirect on this call (fish quirk), so _agents_repo_sync's + # own error message leaks past --silent regardless; it is redundant with + # the $sync_rc-driven echoes just below anyway. + set -l sync_out (_agents_repo_sync "$agents_dir" "$msg" 2>/dev/null) set -l sync_rc $status set -l failed 0 if test $sync_rc -eq 2 diff --git a/functions/agents-vault.fish b/functions/agents-vault.fish index 1a7ba79..125d9f9 100644 --- a/functions/agents-vault.fish +++ b/functions/agents-vault.fish @@ -769,7 +769,11 @@ function agents-vault --description 'track curated agent memory in a host-scoped if not mkdir -p "$gvault" echo "$c_warn""agents-vault: could not create $gvault; skipping global memory$c_reset" >&2 else - set -l gmsg (_agents_repo_ensure_symlink "$glive" "$gvault") + # 2>/dev/null: see the same call's comment further down this + # function -- a command substitution's stderr bypasses this + # call's own caller-scoped redirect, and the raw message is + # always redundant with the $grc-driven echo just below. + set -l gmsg (_agents_repo_ensure_symlink "$glive" "$gvault" 2>/dev/null) set -l grc $status if test $grc -ne 0 echo "$c_warn""agents-vault: could not link $glive; global memory not backed up$c_reset" >&2 @@ -939,7 +943,14 @@ function agents-vault --description 'track curated agent memory in a host-scoped # idempotent and makes its own parent directories, so there is # nothing this guard would protect that the helper does not already # handle on its own. - set -l link_msg (_agents_repo_ensure_symlink "$live" "$vmem") + # + # 2>/dev/null: a command substitution's stderr does not inherit a + # caller-scoped redirect on this call (fish quirk -- proven with a + # two-line repro: `outer 2>/dev/null` where outer does `set -l x + # (inner)` still leaks inner's stderr to the real terminal). The + # raw message below is always redundant: failure is re-announced on + # $link_rc below in this function's own voice. + set -l link_msg (_agents_repo_ensure_symlink "$live" "$vmem" 2>/dev/null) set -l link_rc $status if test $link_rc -ne 0 echo "$c_err""agents-vault: could not link $live$c_reset" >&2 @@ -973,7 +984,11 @@ function agents-vault --description 'track curated agent memory in a host-scoped if not set -q _flag_link set -l msg "chore: sync agent memory vault" test $did_init -eq 1; and set msg "chore: initialize agent memory vault" - set -l sync_out (_agents_repo_sync "$vault" "$msg") + # 2>/dev/null: command-substitution stderr bypasses this call's + # caller-scoped redirect (see the _agents_repo_ensure_symlink calls + # above for the proof); the raw message is redundant with the + # $sync_rc-driven echoes just below. + set -l sync_out (_agents_repo_sync "$vault" "$msg" 2>/dev/null) set -l sync_rc $status if test $sync_rc -eq 2 echo "$c_err""agents-vault: unresolved rebase in the vault; nothing committed$c_reset" >&2 -- 2.54.0 From 135c375dcff4ec816fa8e1e27027173125997d25 Mon Sep 17 00:00:00 2001 From: Rootiest Date: Tue, 22 Sep 2026 02:46:36 -0400 Subject: [PATCH 2/3] fix(ci): install apt-utils in its own step, not bundled The previous fix bundled apt-utils into the same apt-get install as software-properties-common. Verified against a live CI run: debconf still printed "delaying package configuration" once per job, because apt-utils configures in the same transaction as everything else and still lands after at least one other package -- bundling doesn't help. Installing it alone, first, actually finishes it before anything else runs. --- .github/workflows/ci.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fde4c94..1dae0cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,9 +48,14 @@ jobs: - name: Install fish run: | sudo apt-get -o Acquire::Retries=3 update -qq - # apt-utils first: its absence is what makes debconf print - # "delaying package configuration" on every install below. - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common + # apt-utils on its own, before anything else: bundled into the + # same transaction as another package, apt-utils prints the + # "delaying package configuration" notice anyway (it configures + # last in dependency order, same as any other transaction + # member) -- only a fully separate, already-finished install + # ahead of the rest actually silences it. + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common sudo add-apt-repository -y ppa:fish-shell/release-4 sudo apt-get -o Acquire::Retries=3 update -qq sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish @@ -81,9 +86,10 @@ jobs: - name: Install dependencies run: | sudo apt-get -o Acquire::Retries=3 update -qq - # apt-utils first: its absence is what makes debconf print - # "delaying package configuration" on every install below. - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common + # apt-utils on its own, before anything else: see the "Install + # fish" step's identical comment in the test job. + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common sudo add-apt-repository -y ppa:fish-shell/release-4 sudo apt-get -o Acquire::Retries=3 update -qq sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish -- 2.54.0 From 9614ee17e1a5e757a1cc081ab7c36c069a37cfde Mon Sep 17 00:00:00 2001 From: Rootiest Date: Tue, 22 Sep 2026 02:58:55 -0400 Subject: [PATCH 3/3] fix(ci): stop chasing apt-utils' own debconf notice, document why Verified live, twice: bundling apt-utils with another package (first attempt) and installing it fully alone, first (second attempt) both still print debconf's "delaying package configuration" notice exactly once per job. It fires during apt-utils' own first-ever install, before debconf considers it "installed" -- no install ordering this workflow controls can pre-seed that. Reverted to the simpler bundled form (the separate-step version added a step for zero measured benefit) and documented it as accepted/unfixable, same class as the runs-on/ checkout-hint noise already left alone. --- .github/workflows/ci.yml | 26 ++++++++++++++------------ 1 file changed, 14 insertions(+), 12 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1dae0cd..7163bb0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -48,14 +48,16 @@ jobs: - name: Install fish run: | sudo apt-get -o Acquire::Retries=3 update -qq - # apt-utils on its own, before anything else: bundled into the - # same transaction as another package, apt-utils prints the - # "delaying package configuration" notice anyway (it configures - # last in dependency order, same as any other transaction - # member) -- only a fully separate, already-finished install - # ahead of the rest actually silences it. - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common + # apt-utils, so debconf has a target for the "delaying package + # configuration" notice's OWN follow-up run (irrelevant to + # anything else in this job). That notice still fires exactly + # once here regardless -- verified live against two orderings + # (bundled with another package, and installed fully alone, + # first) -- because it fires *during* apt-utils' own first + # install, before debconf considers it "installed". Nothing + # this workflow controls can pre-seed that; accepted as + # unavoidable, same as the runs-on/checkout hint noise below. + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common sudo add-apt-repository -y ppa:fish-shell/release-4 sudo apt-get -o Acquire::Retries=3 update -qq sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y fish @@ -86,10 +88,10 @@ jobs: - name: Install dependencies run: | sudo apt-get -o Acquire::Retries=3 update -qq - # apt-utils on its own, before anything else: see the "Install - # fish" step's identical comment in the test job. - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils - sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y software-properties-common + # apt-utils: see the "Install fish" step's identical comment in + # the test job for why its own debconf notice is accepted, not + # chased further. + sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y apt-utils software-properties-common sudo add-apt-repository -y ppa:fish-shell/release-4 sudo apt-get -o Acquire::Retries=3 update -qq sudo DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y pandoc python3-yaml fish -- 2.54.0