Vibe CI & Supply Chain

Conventions for git workflow, CI configuration, and supply-chain security in Vibe.

Startup import cost

CI gates cold-start module count via vibe/scripts/check_startup_import_cost.py (budgets in vibe/scripts/startup_import_cost.vibe.toml).

• When a change touches imports or module structure on the path of import vibe, the vibe launcher (vibe.cli.launcher) or vibe.app_server.stdio, run cd vibe && uv run scripts/check_startup_import_cost.py and confirm the count stays within budget.
• Verify, do not bump. An overshoot is a regression to investigate (lazy import, drop the dependency, defer the import), not a reason to raise the budget. Only widen for a deliberate, PR-justified increase, and set to observed count + ~10% headroom, never the exact count.

Git

• Never use git commit --amend, git push --force, or git push --force-with-lease.
• Always create new commits and push with a plain git push.
• Reconciling with the upstream of the current branch (e.g. push rejected because origin/<current-branch> advanced): rebase the current branch onto its upstream, do not merge the upstream branch into the current one, never force-push.
• Reconciling with the base branch (e.g. origin/main) once the PR is open: merge the base branch into the current branch, do not rebase, since rebasing rewrites already-pushed history and would require a force-push.
• Run git commands through uv run (e.g. uv run git commit, uv run git push) so pre-commit hooks resolve the project's venv, bare git commit fails pre-commit with reportMissingImports because pyright can't find third-party packages.

CI / GitHub Actions