ci: pin Vector 0.54.0 and remove repeat() compatibility guard

[TerrifiedBug]

Summary

• Adds a Install Vector 0.54.0 step to the CI check job — downloads the musl tarball from GitHub releases and verifies with vector --version
• Removes vectorSupportsRepeat() capability probe, REQUIRES_REPEAT set, and the describe.skipIf wrapper from dlp-vrl-integration.test.ts
• dlp-credit-card-masking now runs unconditionally alongside all other DLP templates

Test plan

• CI check job installs Vector 0.54.0 and runs pnpm test — DLP VRL integration tests pass including credit card masking fixtures
• No vectorSupportsRepeat references remain in the test file

[greptile-apps]

Greptile Summary

This PR pins the CI check job to Vector 0.54.0 (installed via a musl tarball from GitHub Releases) and removes the vectorSupportsRepeat() capability probe along with the REQUIRES_REPEAT skip-set, allowing dlp-credit-card-masking to run unconditionally. The test-file simplification is clean and the version-pinning approach is correct — the only minor concern is that the downloaded tarball is not checksummed before extraction.

Confidence Score: 4/5

Safe to merge; only finding is a P2 recommendation to verify the Vector tarball checksum in CI.

All findings are P2 (style/hardening). No logic bugs or security vulnerabilities are introduced in the changed code.

.github/workflows/ci.yml — missing SHA-256 verification on the Vector tarball download.

Important Files Changed

Filename	Overview
.github/workflows/ci.yml	Adds a Vector 0.54.0 install step via curl+tar before tests; no SHA verification of the downloaded tarball.
src/server/services/tests/dlp-vrl-integration.test.ts	Removes vectorSupportsRepeat() capability probe, REQUIRES_REPEAT set, and describe.skipIf wrapper; dlp-credit-card-masking now runs unconditionally alongside all other DLP templates.

Sequence Diagram

sequenceDiagram
    participant CI as GitHub Actions (check job)
    participant GH as GitHub Releases
    participant Runner as ubuntu-latest runner

    CI->>GH: curl -fsSL vector-0.54.0-x86_64-unknown-linux-musl.tar.gz
    GH-->>Runner: tarball stream
    Runner->>Runner: sudo tar -xz → /usr/local/bin/vector
    Runner->>Runner: vector --version (smoke check)
    Runner->>Runner: pnpm test
    Runner->>Runner: dlp-vrl-integration tests (incl. dlp-credit-card-masking, no skip)

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 65-68

Comment:
**No checksum verification on downloaded binary**

The tarball is piped directly into `sudo tar` without verifying its SHA-256 digest against the published checksum. Vector publishes `vector-0.54.0-SHA256SUMS` alongside every release; if the GitHub CDN or a transparent proxy were to serve a corrupted artifact, the malformed binary would be silently installed and then executed as `sudo`. Consider verifying the digest before extraction.

```suggestion
      - name: Install Vector 0.54.0
        run: |
          curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
            -o /tmp/vector.tar.gz
          echo "$(curl -fsSL https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-SHA256SUMS | grep vector-0.54.0-x86_64-unknown-linux-musl.tar.gz | awk '{print $1}')  /tmp/vector.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin --strip-components=2 -f /tmp/vector.tar.gz "vector-x86_64-unknown-linux-musl/bin/vector"
          vector --version
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "ci: pin Vector 0.54.0 in CI and remove r..." | Re-trigger Greptile}

[greptile-apps]

No checksum verification on downloaded binary

The tarball is piped directly into sudo tar without verifying its SHA-256 digest against the published checksum. Vector publishes vector-0.54.0-SHA256SUMS alongside every release; if the GitHub CDN or a transparent proxy were to serve a corrupted artifact, the malformed binary would be silently installed and then executed as sudo. Consider verifying the digest before extraction.

Suggested change

	run: |
	curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
	| sudo tar -xz -C /usr/local/bin --strip-components=2 "vector-x86_64-unknown-linux-musl/bin/vector"
	vector --version
	- name: Install Vector 0.54.0
	run: |
	curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
	-o /tmp/vector.tar.gz
	echo "$(curl -fsSL https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-SHA256SUMS | grep vector-0.54.0-x86_64-unknown-linux-musl.tar.gz | awk '{print $1}') /tmp/vector.tar.gz" | sha256sum -c -
	sudo tar -xz -C /usr/local/bin --strip-components=2 -f /tmp/vector.tar.gz "vector-x86_64-unknown-linux-musl/bin/vector"
	vector --version

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/ci.yml
Line: 65-68

Comment:
**No checksum verification on downloaded binary**

The tarball is piped directly into `sudo tar` without verifying its SHA-256 digest against the published checksum. Vector publishes `vector-0.54.0-SHA256SUMS` alongside every release; if the GitHub CDN or a transparent proxy were to serve a corrupted artifact, the malformed binary would be silently installed and then executed as `sudo`. Consider verifying the digest before extraction.

```suggestion
      - name: Install Vector 0.54.0
        run: |
          curl -fsSL "https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-x86_64-unknown-linux-musl.tar.gz" \
            -o /tmp/vector.tar.gz
          echo "$(curl -fsSL https://github.com/vectordotdev/vector/releases/download/v0.54.0/vector-0.54.0-SHA256SUMS | grep vector-0.54.0-x86_64-unknown-linux-musl.tar.gz | awk '{print $1}')  /tmp/vector.tar.gz" | sha256sum -c -
          sudo tar -xz -C /usr/local/bin --strip-components=2 -f /tmp/vector.tar.gz "vector-x86_64-unknown-linux-musl/bin/vector"
          vector --version
```

How can I resolve this? If you propose a fix, please make it concise.

[TerrifiedBug]

Closing — lint failing and not verified. The DLP credit-card test currently skips when Vector isn't installed, so adding a CI install step needs more justification. Will redo as focused PR if/when DLP fixtures need to run on every PR.