# Vibe Ci Supply Chain

Git workflow, CI/GitHub Actions, and supply-chain pinning rules for Mistral Vibe.

- Repository: https://github.com/mistralai/mistral-vibe (5270 stars)
- Category: Git and review
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add mistralai/mistral-vibe --skill vibe-ci-supply-chain -g -a claude-code -y`
Codex: `npx skills add mistralai/mistral-vibe --skill vibe-ci-supply-chain -g -a codex -y`
Cursor: `npx skills add mistralai/mistral-vibe --skill vibe-ci-supply-chain -g -a cursor -y`
Gemini CLI: `npx skills add mistralai/mistral-vibe --skill vibe-ci-supply-chain -g -a gemini-cli -y`

## Description

Git workflow, CI/GitHub Actions, and supply-chain pinning rules for Mistral Vibe. Use when changing CI pipelines, GitHub Actions, dependency pinning, container images, pre-commit hooks, git workflow, or external binary downloads.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Vibe CI & Supply Chain

Conventions for git workflow, CI configuration, and supply-chain security in Vibe.

## Startup import cost

CI gates cold-start module count via `vibe/scripts/check_startup_import_cost.py` (budgets in `vibe/scripts/startup_import_cost.vibe.toml`).

- When a change touches imports or module structure on the path of `import vibe`, the `vibe` launcher (`vibe.cli.launcher`) or `vibe.app_server.stdio`, run `cd vibe && uv run scripts/check_startup_import_cost.py` and confirm the count stays within budget.
- **Verify, do not bump.** An overshoot is a regression to investigate (lazy import, drop the dependency, defer the import), not a reason to raise the budget. Only widen for a deliberate, PR-justified increase, and set to observed count + ~10% headroom, never the exact count.

## Git

- Never use `git commit --amend`, `git push --force`, or `git push --force-with-lease`.
- Always create new commits and push with a plain `git push`.
- Reconciling with the upstream of the current branch (e.g. push rejected because `origin/<current-branch>` advanced): rebase the current branch onto its upstream, do not merge the upstream branch into the current one, never force-push.
- Reconciling with the base branch (e.g. `origin/main`) once the PR is open: merge the base branch into the current branch, do not rebase, since rebasing rewrites already-pushed history and would require a force-push.
- Run git commands through `uv run` (e.g. `uv run git commit`, `uv run git push`) so pre-commit hooks resolve the project's venv, bare `git commit` fails pre-commit with `reportMissingImports` because pyright can't find third-party packages.

## CI / GitHub Actions

The rest: https://github.com/mistralai/mistral-vibe/blob/HEAD/.agents/skills/vibe-ci-supply-chain/SKILL.md