Skip to content

v0.6.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 May 22:37
· 141 commits to main since this release
v0.6.0
a2b4149
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

sykli 0.6.0

Released 2026-04-29

Local-first CI for the next generation of software developers.

This is the release that makes that one-liner mean something. The CLI looks the way the project sounds. The runtime layer is decoupled from the engine. The supply chain is signed. AI agents read your runs natively. And the foundation for replacing GitHub Actions — sykli running on your own mesh, GitHub talking to it directly — is in place.

sykli · build.exs                                  local · 0.6.0

  ●  test         go test ./...                       1.8s
  ●  build        go build ./cmd/app                  912ms
  ●  lint         golangci-lint run                   220ms

  ─  3 passed                                          2.9s

Highlights

The CLI looks designed now

A full visual reset (ADR-020). One accent color, glyph-driven status, single redraw region for animations, hidden task stdout by default, one summary per run. No more "Level", no more "1L", no more debug headers. Failure mode draws a horizontal rule under the failed task and points at sykli fix for AI-readable analysis. Reference set for the aesthetic: Linear, Vercel CLI, Raycast.

Runtime decoupling — :test defaults to a Fake

The execution layer is now properly separated from the engine. Sykli.Runtime.Resolver is the single source of truth for runtime selection (priority chain: CLI flag → opts → app env → SYKLI_RUNTIME → auto-detect → Shell). Sykli.Runtime.Fake is the new in-memory deterministic runtime that :test defaults to — your unit tests no longer need Docker. New: Sykli.Runtime.Podman (rootless container parity), mix sykli.runtime.info for inspection, --runtime CLI flag, and test tiers (mix test.docker, mix test.podman, mix test.integration).

sykli fix and friends — AI-readable failures

Four new commands for AI-native CI:

  • sykli fix — failure analysis with source context, git provenance, and a single-line cause statement. The screenshot moment.
  • sykli mcp — MCP server so Claude Code, Cursor, and Copilot can read your run state directly without log scraping.
  • sykli query — structured queries against pipeline / history / health data without an LLM.
  • sykli plan — dry-run execution planning with git-diff-driven task selection.

All --json output now flows through a shared envelope ({ok, version, data, error}) so agents parse one shape across every command.

SLSA v1.0 attestations

Every run now produces a DSSE-signed SLSA v1.0 provenance envelope. Per-run and per-task attestations. Configure signing via SYKLI_SIGNING_KEY (HMAC) or SYKLI_ATTESTATION_KEY_FILE (file-based). The supply-chain story is no longer aspirational.

GitHub-native foundation (ADR-021 Phase 1)

The first slab of the v0.7 line: sykli now ships a GitHub App, a webhook receiver (Plug + Bandit), a Checks API client, and a :webhook_receiver mesh role. A signed webhook arrives at the user's mesh, signature is verified (HMAC-SHA256, constant-time, body never logged on mismatch), the receiver opens a queued check suite. Phase 2 (pipeline dispatch from the webhook) is in progress; Phase 3 (PR-diff annotations from sykli fix) is next.

This means: in v0.7, sykli replaces GitHub Actions instead of running inside it. Local-first throughout — the receiver lives on hardware you control, never on Sykli-owned infrastructure. ADR-021 supersedes ADR-004; the in-Actions integration remains as a documented fallback.

FALSE Protocol first-class

Internal events are now Sykli.Occurrence structs end-to-end (refactor — events used to be wrapped by occurrences). New: chain_id for correlating retry chains, configurable source URI via SYKLI_SOURCE_URI, and an :errored task status distinct from :failed for infrastructure failures. :failed gets causality analysis; :errored gets infrastructure diagnostics.

Eval harness + oracle

55 ground-truth oracle cases for AI-agent CI behavior validation. Run via eval/oracle/run.sh. The full Claude Code → build → oracle → report loop is in eval/harness/run.sh for AI-agent regression testing.

Hardening

A full sweep across the security and reliability backlog:

  • SEC-001..007 all closed: OIDC TLS verification, secret_refs path traversal, Docker mount containment, webhook SSRF guard, broader secret masking, OIDC-derived runtime cache keys.
  • REL-002..008 closed: graceful shutdown, concurrent-run race fix, S3 cache circuit breaker, async SCM status calls, telemetry duration units, RunRegistry eviction, PubSub failure handling.
  • 35+ PR review comments addressed across the release.

Breaking change

Cache fingerprint scheme now includes the repo-relative workdir. This prevents cross-project cache pollution but means .sykli/occurrence.json payloads from before 0.6.0 are not backward-compatible.

What you need to do: nothing. The first run after upgrade rebuilds local cache state automatically. Expect one cold run.

Install / upgrade

# Single binary
curl -fsSL https://raw.githubusercontent.com/false-systems/sykli/main/install.sh | bash

# Or with a specific version
curl -fsSL https://raw.githubusercontent.com/false-systems/sykli/main/install.sh | bash -s v0.6.0

SDKs (all bumped to 0.6.0 in lockstep):

# Go
go get github.com/yairfalse/sykli/sdk/go@v0.6.0

# Rust
cargo add sykli@0.6.0

# TypeScript
npm install sykli@0.6.0

# Python
pip install sykli==0.6.0

# Elixir
{:sykli, "~> 0.6.0"}

What's next

  • Phase 2 of the GitHub-native rollout (CODEX_PROMPT_PHASE_2.md in the repo): webhook → mesh placement → executor → check-run lifecycle. Per-task check runs transition through queued → in_progress → conclusion.
  • Phase 3: sykli fix annotations rendered onto the PR diff via the Checks API's annotation surface.
  • Phase 4: GitHub App marketplace listing.

Thanks

To everyone who pushed back on early drafts of the visual reset, who reviewed the runtime decoupling RC.0–RC.7 chain, who pointed out the cache-fingerprint cross-project-pollution bug, and to the Codex agents that shipped the visual reset (PR #123) and the GitHub-native foundation (PR #125) cleanly.

Full changelog: see CHANGELOG.md for the comprehensive list of additions, changes, fixes, and security closures across all 142 commits.

Architectural reference: ADR-020 (positioning + visual direction), ADR-021 (GitHub-native via webhook + mesh receiver).

Assets 7
Loading